Confidentiality and Information Security
When it comes to confidentiality, a good information security strategy is to adopt the need-to-know basis for determining who has access to which data and when they have access to those data. Essentially, this paradigm states that a user should, by default, have access to no system capabilities or i…
Harm and Information Assets
In this post, I’d like to discuss harmful acts in the context of information assets. To begin, recall that information security seeks to protect the confidentiality, integrity, and availability of information assets. With this in mind, consider that there are four distinct ways in which harm can be …
The Pillars of Information Security
I’d like to begin this post by discussing information security threats in the context of what has come to be known as CIA -- confidentiality, integrity, and availability. The acronym CIA and the concepts for which it stands are commonly referred to as the security triad. One useful way of thinking a…
Vulnerabilities, Threats, and Controls in Information Security
In an earlier post, I noted that one of the major goals of information security is to mitigate security risks. Another major goal of information security as a discipline and as a profession is to try to protect valuable information assets. In order to approach the study of methods of protecting thes…
On the Valuation of Information Assets
When considering the diagram below, remember that the perceived value of an information asset depends in part upon the ease with which that asset can be replaced. Certain components of an information system such as hardware, mobile devices, operating systems, and off-the-shelf software can be easily…
Information Assets and the Scope of Information Security
When thinking about information security, it’s important to remember that as a discipline and as a profession, information security has a vast scope. Information security involves protecting components as small as tiny integrated circuits all the way up to massive clusters of servers that may involv…
Computer Security and Information Technology Failure
Although many people think of the world of information privacy and security as one characterized by hackers, cyber terrorists, or government-sponsored information espionage, in reality the scope of information privacy and security is much broader. One way of understanding this scope is to consider c…
Information Security and Human Dependence on Computers
How dependent are you upon information and communication technologies? If you’re like most people in the developed world, your day-to-day activities are increasingly characterized by interactions with technology. Computational capabilities are being embedded in a rapidly increasing number and variet…
Philosophical Thoughts on Information Security
To begin this series of posts on computer and information security, I wanted to pose an interesting philosophical question: namely, why is information security necessary? Although many of the investments that are made into information privacy and security are not related to malicious attacks, there …
