Confidentiality and Information Security

<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEia5bxwFDl2OkpqKBRBMYh1jP05qoy-jYK6IxjDKn-RVmMNz4_dTHmwkOem3Kw2ggDzgQk8G5M4Wc-KCSkBQfp9EPW8_u_MED_fHq_K1rFwPa_NSSxxaxyBepo7CrsUUMPqjlQ22tyfk4IP/s1600/confidentiality.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEia5bxwFDl2OkpqKBRBMYh1jP05qoy-jYK6IxjDKn-RVmMNz4_dTHmwkOem3Kw2ggDzgQk8G5M4Wc-KCSkBQfp9EPW8_u_MED_fHq_K1rFwPa_NSSxxaxyBepo7CrsUUMPqjlQ22tyfk4IP/s1600/confidentiality.png" /></a><span style="font-family: Arial, Helvetica, sans-serif;">When it comes to confidentiality, a good information security strategy is to adopt the need-to-know basis for determining who has access to which data and when they have access to those data. Essentially, this paradigm states that a user should, by default, have access to no system capabilities or information assets. The assets or capabilities that are ultimately granted to the user, then, are done so only on a need-to-know basis. Similar to the need-to-know policy for data access, access to physical assets such as a server room or a network closet should also be granted only on a need-to-know basis. Put another way, system users and information technology workers should be provided with all of the information assets and access that they need to do their jobs effectively, </span><i style="font-family: Arial, Helvetica, sans-serif;">and nothing more</i><span style="font-family: Arial, Helvetica, sans-serif;">.</span><br /><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span><div class="MsoNormal"></div><div class="MsoNormal"><span style="font-family: Arial,Helvetica,sans-serif;">Another interesting consideration with respect to confidentiality is the question of how we know if a user truly is the person or system that they claim to be. This question speaks directly to the difference between identification and authentication. In generic terms, identification can be thought of as the process of proving that someone is who they say they are. By contrast, authentication is the process of proving that something is genuine, true, or authentic. In the world of information security, it is often very difficult or infeasible to truly identify a real human being or a specific system. Instead, we commonly use methods of authentication, and in so doing we assume that the credentials being used for purposes of authentication are being used only by the real-world system or human being to whom those credentials apply. This is, of course, a risky assumption, since through malicious or non-malicious means it might be very possible for another person to obtain your login credentials. If that person were then to use those credentials to login to, say, your social networking account, as far as the social networking site is concerned, that person <i>is </i>you. After having received appropriate credentials, the system will assume that the malicious party is, in fact, the real-world human being to whom those credentials actually belong. Confidentiality is thus difficult to ensure with 100% certainty, but it is nevertheless often the easiest security goal to assess in terms of whether or not efforts aimed at ensuring confidentiality have been successful.</span></div>

Confidentiality and Information Security

When it comes to confidentiality, a good information security strategy is to adopt the need-to-know basis for determining who has access to ...

Read more »

The Pillars of Information Security

<div class="MsoNormal"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhO-HiRWyJ2UHygtlopLZdfm5T-GpmH2CSOIihTsQIq3CHBEsNrawlIlkxhhFToWyMRtEee8hgJDicEw8DCAqPll5JuTY0Edxk_9aK31uHPKNZYJhBma-ITvVF-dEG1v5cI6yxC0XZSO22k/s1600/security+pillars.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><br /><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhO-HiRWyJ2UHygtlopLZdfm5T-GpmH2CSOIihTsQIq3CHBEsNrawlIlkxhhFToWyMRtEee8hgJDicEw8DCAqPll5JuTY0Edxk_9aK31uHPKNZYJhBma-ITvVF-dEG1v5cI6yxC0XZSO22k/s1600/security+pillars.png" /></a></div><span style="font-family: Arial,Helvetica,sans-serif;"><span id="goog_1946619458"></span><span id="goog_1946619459"></span>I’d like to begin this post by discussing information security threats in the context of what has come to be known as CIA -- confidentiality, integrity, and availability. The acronym CIA and the concepts for which it stands are commonly referred to as the <i>security triad</i>. One useful way of thinking about information security threats is that they are circumstances which have the potential to interfere with the confidentiality, integrity, or availability of an information system. Confidentiality, then, is simply the ability of the system to ensure that information assets are viewable or accessible only by authorized parties. Integrity, by contrast, is the ability of a system to ensure that information assets are modifiable or changeable only by authorized parties. Finally, availability refers to the ability of a system to ensure that information assets are usable by and accessible to all authorized parties. Confidentiality, integrity, and availability can also be seen as goals or objectives of information security, since together they represent three very desirable properties of an information system.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial,Helvetica,sans-serif;">While the CIA security triad has been around for many decades, more recently other desirable system properties have also been identified; namely, authentication, non-repudiation, and auditability. With respect to the first two of these properties -- that is, authentication and non-repudiation -- we are referring here to information systems that support communication or messaging with other systems or other users. In this regard, authentication refers to the ability of a system to confirm the identity of the sender. For example, imagine that you receive a message from your boss which instructs you to immediately discontinue working on a critical organizational project, and instead direct your attention to another task. As the receiver of such a message, you would like to be able to confirm the identity of the sender; that is, you would like to be certain that it truly was your boss who sent the message to you. On the other side of technology-supported messaging is the concept of non-repudiation, which is a property of an information system in which a sender cannot convincingly deny having sent a message. Returning to our previous example, if you received a message from your boss instructing you to immediately discontinue working on a critical project, and if we assume that your boss genuinely did send that message, a desirable property of the system from your perspective would be to ensure that your boss could not deny having sent the message. Finally, we have auditability as a desirable system property. Auditability is simply the ability of a system to trace all actions related to a given information asset. If something goes awry in the future, auditability allows us to trace backward through time and determine who performed which actions at which times in order to ensure that responsible parties are held to account.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial,Helvetica,sans-serif;">Together, these six concepts -- confidentiality, integrity, availability, authentication, non-repudiation, and auditability -- represent the pillars of information security.</span></div>

The Pillars of Information Security

I’d like to begin this post by discussing information security threats in the context of what has come to be known as CIA -- confidentiality...

Read more »