Professional Documents
Culture Documents
Information Assurance and Security (Information Assurance - Module 1)
Information Assurance and Security (Information Assurance - Module 1)
I. Introduction
II. Objectives
III. Content
Information assurance (IA) is the practice of assuring information and managing risks related
to the use, processing, storage, and transmission of information or data and the systems and
processes used for those purposes.
The mission has evolved through three very distinct stages: Communications Security
(COMSEC), Information Systems Security (INFOSEC) and Information Assurance (IA). Post WWI
and the Korean War, COMSEC efforts focused primarily on cryptography (i.e., designing
and building encryption devices to provide confidentiality for information). The
introduction and widespread use of computers created new demands to protect
information exchanges between interconnected computer systems. This demand created the
Computer Security (COMPUSEC) discipline. With the introduction of COMPUSEC came the
recognition that stand-alone COMSEC and stand-alone COMPUSEC could not protect
information during storage, processing or transfer between systems. This recognition gave
rise to the term INFOSEC and the information protection mission took on a broader
perspective. IA emerged and focused on the need to protect information during transit,
processing, or storage within complex and/or widely dispersed computers and
communication system networks. IA includes a dynamic dimension where the network
architecture is itself a changing environment, including the information protection
mechanisms that detect attacks and enable a response to those attacks. Information
assurance is the process of adding business benefit through the use of IRM (Information
Risk Management) which increases the utility of information to authorized users, and
reduces the utility of information to those unauthorized. It is strongly related to the field
of information security, and also with business continuity.
1. Detection,
2. Accepting
3. Mitigating/ justify
4. Response to threats.
5. Eliminating
6. Considers prevention
7. Transferring the risks,
What is countermeasure?
It include technical tools such as firewalls and anti-virus software, policies and procedures
requiring such controls as regular backups and configuration hardening, employee
training in security awareness, or organizing personnel into dedicated computer emergency
response team (CERT) or computer security incident response team (CSIRT). The cost and
benefit of each countermeasure is carefully considered. Thus, the IA practitioner does not
seek to eliminate all risks, were that possible, but to manage them in the most cost- effective
way.
After the risk management plan is implemented, it is tested and evaluated, often by means
of formal audits. The IA process is an iterative one, in that the risk assessment and risk
management plan are meant to be periodically revised and improved based on data gathered
about their completeness and effectiveness.
The cryptologic components of information assurance primarily address the last four pillars
of integrity, authentication, confidentiality, and non-repudiation. These pillars are applied in
accordance with the mission needs of particular organizations
✓ Information Assurance (AI): Measures that protect and defend information and
information systems by ensuring their availability, integrity, authentication, confidentiality,
and non-repudiation. These measures include providing for restoration of information
systems by incorporating protection, detection, and reaction capabilities.
✓ Information protection (or information security as defined by the NIST): The protection of
information and information systems from unauthorized access, use, disclosure, disruption,
modification, or destruction in order to provide
Information security
The end of the 20th century and early years of the 21st century saw rapid
advancements in telecommunications, computing hardware and software, and data
encryption. The availability of smaller, more powerful and less expensive computing
equipment made electronic data processing within the reach of small business and the home
user. These computers quickly became interconnected through the Internet.
The rapid growth and widespread use of electronic data processing and electronic business
conducted through the Internet, along with numerous occurrences of international terrorism,
fueled the need for better methods of protecting the computers and the information they
store, process and transmit
The academic disciplines of computer security and information assurance emerged along with
numerous professional organizations - all sharing the common goals of ensuring the
security and reliability of information systems.
2. "The protection of information and information systems from unauthorized access, use,
disclosure, disruption, modification, or destruction in order to provide confidentiality,
integrity, and availability."
3. "Ensures that only authorized users (confidentiality) have access to accurate and
complete information (integrity) when required (availability)."
Computer security
The objective of computer security includes protection of information and property from
theft, corruption, or natural disaster, while allowing the information and property to
remain accessible and productive to its intended users. The term computer system security
means the collective processes and mechanisms by which sensitive and valuable information
and services are protected from publication, tampering or collapse by unauthorized activities
or untrustworthy individuals and unplanned events respectively.
The strategies and methodologies of computer security often differ from most other computer
technologies because of its somewhat elusive objective of preventing unwanted computer
behavior instead of enabling wanted computer behavior.
Computer Security - generic name for the collection of tools designed to protect
data and to thwart hackers
Network Security - measures to protect data during their transmission
Internet Security - measures to protect data during their transmission
Why Security?
1. Confidentiality:
The terms privacy and secrecy are sometimes used to distinguish between the protection
of personal data (privacy) and the protection of data belonging to an organization
(secrecy).
For example, a credit card transaction on the Internet requires the credit card number to be
transmitted from the buyer to the merchant and from the merchant to a transaction
processing network. The system attempts to enforce confidentiality by encrypting the card
number during transmission, by limiting the places where it might appear (in databases, log
files, backups, printed receipts, and so on), and by restricting access to the places where it is
stored. If an unauthorized party obtains the card number in any way, a breach of
confidentiality has occurred.
Confidentiality is necessary (but not sufficient) for maintaining the privacy of the people
whose personal information a system holds.
Preserving authorized restrictions on information access and disclosure, including means for
protecting personal privacy and proprietary information. A loss of confidentiality is the
unauthorized disclosure of information. "Prevention of unauthorized disclosure of
information".
2. Integrity:
However, additional qualifications like "being authorized to do what one does" or following
the correct procedures" have also been included under the term integrity, so that users of a
system, even if authorized, are not permitted to modify data items in such a way that assets
or accounting records of the company are lost or corrupted.
IV. 3. Availability:
INFORMATION SECURITY
Information security means protecting information and information systems from
unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or
destruction.
The terms information security, computer security and information assurance are
frequently used interchangeably. These fields are interrelated often and share the
common goals of protecting the confidentiality, integrity and availability of information;
however, there are some subtle differences between them.
These differences lie primarily in the approach to the subject, the methodologies used,
and the areas of concentration.
Enterprise security is about building systems to remain dependable in the face of malice,
error, or mischance. As a discipline, it focuses on the tools, processes, and methods needed to
design, implement, and test complete systems, and to adapt existing systems as their
environment evolves.
Many of the terms used in Enterprise security are straightforward, but some are misleading or
even controversial. There are more detailed definitions of technical terms in the relevant
chapters, which you can find using the index.
A purely threat-based approach to risk management fails to enable effective security and
business operations. The term security will carry very different meanings to different
organizations.
Cyber Defense
Cyber defense is a computer network defense mechanism which includes response to actions
and critical infrastructure protection and information assurance for organizations, government
entities and other possible networks.
It helps in devising and driving the strategies necessary to counter the malicious attacks or
threats.
Cyber defense also carries out technical analysis to identify the Threat
It helps in enhancing the security strategy utilizations and resources in the most effective
fashion.
Cyber defense also helps in improving the effectiveness of the security resources and security
expenses, especially in critical locations.
Cyber Defense protects your most important business assets against attack.
V. Activities
NONE
VI. References