Information Security
From Consultancy.EdVoncken.NET
Information Security (InfoSec for short) is a very broad field of expertise. This is exactly what attracts me to Information Security; I get to combine all my network infrastructure, operating system and software engineering knowledge. This is an interesting challenge, to say the least! In 2007, I became CISSP certified.
Contents |
- (most definitions in this page were copied from the Information Security Glossary)
First off, some definitions of commonly used terms in Information Security.
Authentication, Authorization, Auditing
One of the most difficult problems in Information Security is proving your Identity, by means of Authentication. All forms of Access Control depend on Authentication and Authorization.
There is an important difference between Identity (It's Me) and Authentication (Here's my Proof). For example, your username forms your online Identity. Your password is the proof that you are indeed you.
Authentication (who are you?)
Authentication refers to the verification of the authenticity of either a person or of data, e.g. a message may be authenticated to have been originated by its claimed source. Authentication techniques usually form the basis for all forms of access control to systems and / or data.
Authorization (what permissions do you have?)
The process whereby a person approves a specific event or action. In companies with access rights hierarchies it is important that audit trails identify both the creator and the authoriser of new or amended data. It is an unacceptably high risk situation for an individual to have the power to create new entries and then to authorise those same entries themselves.
Auditing (what did you do?)
An Audit Trail is a record, or series of records, which allows the processing carried out by a computer or clerical system to be accurately identified, as well as verifying the authenticity of such amendments, including details of the users who created and authorised the amendment(s).
Confidentiality, Integrity and Availability
A key aspect of Information Security is to preserve the confidentiality, integrity and availability of an organisation's information. It is only with this information, that it can engage in commercial activities. Loss of one or more of these attributes, can threaten the continued existence of even the largest corporate entities.
Confidentiality
Assurance that information is shared only among authorised persons or organisations. Breaches of Confidentiality can occur when data is not handled in a manner adequate to safeguard the confidentiality of the information concerned. Such disclosure can take place by word of mouth, by printing, copying, e-mailing or creating documents and other data etc. The classification of the information should determine is confidentiality and hence the appropriate safeguards.
Integrity
Assurance that the information is authentic and complete. Ensuring that information can be relied upon to be sufficiently accurate for its purpose. The term Integrity is used frequently when considering Information Security as it is represents one of the primary indicators of security (or lack of it). The integrity of data is not only whether the data is 'correct', but whether it can be trusted and relied upon. For example, making copies (say by e-mailing a file) of a sensitive document, threatens both confidentiality and the integrity of the information. Why? Because, by making one or more copies, the data is then at risk of change or modification.
Availability
Assurance that the systems responsible for delivering, storing and processing information are accessible when needed, by those who need them.
OK, enough with the definitions. On to Security Tools and Information!