A Multilayered Approach to Information Security
Establishing multiple layers of defense is critical to protecting valuable information assets. An effective multilayered defense involves not only defining and defending the system perimeter, but also preempting and deterring attacks, implementing tools that can deflect attacks, and then constantly …
Physical, Procedural, and Technical Controls in Information Security
In this post, I will briefly discuss the three major types or categories of controls that can be used to defend information systems – namely (1) physical controls, (2) procedural controls, and (3) technical controls. First, physical controls are those controls which seek to prevent an attack through…
Using Multiple Controls or Countermeasures for Information Security
In this post I would like to talk about using multiple controls or countermeasures for information security purposes. To begin, consider a castle in the Middle Ages. You may have noticed that many castles were built in locations that leveraged natural obstacles in order to protect the castle during …
Defending against Attacks on Information Systems
In broad terms, there are six different approaches that can be used to defend information systems against attacks by malicious parties. The first of these approaches is prevention, and preventing an attack can be accomplished by either blocking the attack, or by entirely closing or eliminating a vul…
Prerequisites for Attacking an Information System
In order for an attack on an information system to succeed, an attacker must possess three specific things: (1) method, (2) opportunity, and (3) motive. One useful way of remembering these prerequisites is through the acronym MOM (Method, Opportunity, and Motive). In the context of conducting attack…
Harm and the Value of Information Assets
Although in an earlier post I discussed the four types of acts that can cause harm to an information system, here I would like to briefly discuss harm itself. Harm refers to the negative consequences that can arise from an actualized threat. That is, if a vulnerability in an information system is ex…
Types of Information System Attackers
Who are these people who seek to compromise the confidentiality, integrity, or availability of our information assets? Surprisingly, many attackers are simply amateurs who act opportunistically. As an example, such an amateur might find someone’s lost mobile device or laptop computer and decide to s…
Understanding Threats to Information Systems
To better understand the various ways in which the confidentiality, integrity, or availability of information assets can be threatened, consider first that threats to information systems can be subdivided into two major groups: (1) threats that originate from nature, and (2) threats that originate f…
Integrity, Availability, and Information Security
In an earlier post, I discussed confidentiality in the context of information security. In this post, I would like to elaborate on the remaining two components of the C-I-A security triad -- namely, integrity and availability. In order to understand the difference between confidentiality and integri…
Confidentiality and Information Security
When it comes to confidentiality, a good information security strategy is to adopt the need-to-know basis for determining who has access to which data and when they have access to those data. Essentially, this paradigm states that a user should, by default, have access to no system capabilities or i…
Harm and Information Assets
In this post, I’d like to discuss harmful acts in the context of information assets. To begin, recall that information security seeks to protect the confidentiality, integrity, and availability of information assets. With this in mind, consider that there are four distinct ways in which harm can be …
The Pillars of Information Security
I’d like to begin this post by discussing information security threats in the context of what has come to be known as CIA -- confidentiality, integrity, and availability. The acronym CIA and the concepts for which it stands are commonly referred to as the security triad. One useful way of thinking a…
Vulnerabilities, Threats, and Controls in Information Security
In an earlier post, I noted that one of the major goals of information security is to mitigate security risks. Another major goal of information security as a discipline and as a profession is to try to protect valuable information assets. In order to approach the study of methods of protecting thes…
On the Valuation of Information Assets
When considering the diagram below, remember that the perceived value of an information asset depends in part upon the ease with which that asset can be replaced. Certain components of an information system such as hardware, mobile devices, operating systems, and off-the-shelf software can be easily…
Information Assets and the Scope of Information Security
When thinking about information security, it’s important to remember that as a discipline and as a profession, information security has a vast scope. Information security involves protecting components as small as tiny integrated circuits all the way up to massive clusters of servers that may involv…
Computer Security and Information Technology Failure
Although many people think of the world of information privacy and security as one characterized by hackers, cyber terrorists, or government-sponsored information espionage, in reality the scope of information privacy and security is much broader. One way of understanding this scope is to consider c…
Information Security and Human Dependence on Computers
How dependent are you upon information and communication technologies? If you’re like most people in the developed world, your day-to-day activities are increasingly characterized by interactions with technology. Computational capabilities are being embedded in a rapidly increasing number and variet…
Philosophical Thoughts on Information Security
To begin this series of posts on computer and information security, I wanted to pose an interesting philosophical question: namely, why is information security necessary? Although many of the investments that are made into information privacy and security are not related to malicious attacks, there …
