Harm and the Value of Information Assets

<br /><div class="MsoNormal"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhujEMTmSP6ZVtjsmsYfS90AWK8q_TSPT2ogtFyv3a8oMQRPyCZU7w8lahvMMcjzaEHUAmZUNJfd2QSIgjgUOFAYbvCmT-8UyiZd8unEVtPuHwcZhg1k8AzyAZ_jAf5BDiLoMo2lQgiIeRU/s1600/harm.png" imageanchor="1" style="clear: left; display: inline !important; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhujEMTmSP6ZVtjsmsYfS90AWK8q_TSPT2ogtFyv3a8oMQRPyCZU7w8lahvMMcjzaEHUAmZUNJfd2QSIgjgUOFAYbvCmT-8UyiZd8unEVtPuHwcZhg1k8AzyAZ_jAf5BDiLoMo2lQgiIeRU/s1600/harm.png" /></a><span style="font-family: Arial, Helvetica, sans-serif;">Although in an <a href="http://computersecurityconcepts.blogspot.com/2013/09/harm-and-information-assets.html">earlier post</a> I discussed the four types of acts that can cause harm to an information system, here I would like to briefly discuss harm itself. Harm refers to the negative consequences that can arise from an actualized threat. That is, if a vulnerability in an information system is exploited such that a threat becomes a reality, then harm refers to the implications of the actualized threat. Note that the quantity or amount of harm that is sustained from a successful attack is often a subjective matter. Different people in different organizations will naturally assign different values to their information assets, and with different values assigned to assets, an identical attack would be perceived to cause different amounts of harm to two different organizations.<o:p></o:p></span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjRH6STDubjYiUheeWktC35vMeNFO0YdlhWHp7stm7dr3vsjn-9wLGhRH-wxTU6ayhxkRo6IlyyIj3jTn1Ru6R8ZR2IzSFavUMMd0ahFKRrijsKTnGcs-mUxcC2KDT3dT3XedoSDJllZkY/s1600/value+of+information.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjRH6STDubjYiUheeWktC35vMeNFO0YdlhWHp7stm7dr3vsjn-9wLGhRH-wxTU6ayhxkRo6IlyyIj3jTn1Ru6R8ZR2IzSFavUMMd0ahFKRrijsKTnGcs-mUxcC2KDT3dT3XedoSDJllZkY/s1600/value+of+information.png" /></a><span style="font-family: Arial, Helvetica, sans-serif;">Quantifying harm is further complicated by the fact that the value of information assets commonly changes over time. Consider, for example, the value of the transaction records that your bank maintains for your checking account. If a malicious attacker were able to successfully delete or modify some of the records associated with your checking account, and if those records were associated with recent transactions that took place within the past few days, then your bank would almost certainly consider the attacker to have caused more harm than if the compromised records were associated with transactions from 10 years ago. This example speaks to the relationship between the value of information and time -- most modern information scientists believe that on average, the value of information assets degrades over time according to an exponential decay function. Put another way, new data are usually more valuable than older data.</span><o:p></o:p></div>

Harm and the Value of Information Assets

Although in an earlier post I discussed the four types of acts that can cause harm to an information system, here I would like to briefly d...

Read more »

Harm and Information Assets

<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj47jnJHA25GxSKb-evVH7fLbBelrTlqCkVYxS0EOP5uvstcSwlQlNiEsHQcLOWEYaDhhiqdy5_zlux-zfX5ITnCUANAOYIL5hUVZn5AHigJoSs3I_g4LB2067CwVxaGh1Ofdv3OFkUNfzR/s1600/harmful+acts.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj47jnJHA25GxSKb-evVH7fLbBelrTlqCkVYxS0EOP5uvstcSwlQlNiEsHQcLOWEYaDhhiqdy5_zlux-zfX5ITnCUANAOYIL5hUVZn5AHigJoSs3I_g4LB2067CwVxaGh1Ofdv3OFkUNfzR/s1600/harmful+acts.png" /></a><span style="font-family: Arial, Helvetica, sans-serif;">In this post, I’d like to discuss harmful acts in the context of information assets. To begin, <a href="http://computersecurityconcepts.blogspot.com/2013/09/the-pillars-of-information-security.html">recall</a> that information security seeks to protect the confidentiality, integrity, and availability of information assets. With this in mind, consider that there are four distinct ways in which harm can be caused to an information asset. The first way in which an information asset can be harmed is through <i>interception</i>. As an example, a malicious party may intercept valuable information assets while they are in transit over a network, thereby harming the confidentiality of those assets, and potentially degrading their value. The second way in which information assets can be harmed is through <i>interruption</i>. A malicious party might, for example, disrupt an information system’s ability to perform its tasks, or might interrupt the transmission of information assets, thus harming the availability of those assets. The third way in which information assets can be harmed is through <i>modification</i>. A malicious party who modifies an information asset without proper authorization is causing harm by degrading the integrity of that asset. Finally, the fourth way in which information assets can be harmed is through <i>fabrication</i>. As an example, a malicious party might fabricate an identity or might fabricate phony information assets for the purpose of causing harm.</span><br /><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span><span style="font-family: Arial, Helvetica, sans-serif;">In summary, then, we can consider each of these four acts -- interception, interruption, modification, and fabrication -- to be a harmful act because it can erode the confidentiality, integrity, or availability of an information asset.</span>

Harm and Information Assets

In this post, I’d like to discuss harmful acts in the context of information assets. To begin, recall that information security seeks to pr...

Read more »