What is Information Security?

When information security is mentioned, most people think of two things:

1. Keeping stuff on their computing devices safe, whatever safe means.
2. Confidentiality: keeping other people away from information like passwords, banking information, and so forth.

Those people are only partly correct. Let me explain.

First of all, information security has three tenets;

1. Confidentiality, which almost everyone thinks of.
2. Integrity. Making sure that your information is, and remains unaltered when it shouldn’t be.
3. Availability. Making sure that your information is not lost, either accidentally or through malicious acts by others.

But I Don’t Have Anything on My Phone/Computer That is Worth Stealing

** Danger Notice** Boy, are you wrong there! Please read on.

To gain access to your computer/phone/tablet, you must log in using a password, PIN¹, or some biometric input (facial recognition, finger print, and so forth). If I can gain access to your device for even a very short period of time, I may be able to determine what that password or PIN is. I then have the same access as you to your device. I won’t discuss how at the moment since there are many different ways; just know that I won’t need physical access.

Once I have access to your computer or other device, I can then take all the time I need to determine your other passwords. I would be able to access your emails and any websites that you save passwords for. Think your banks, social media sites, and so forth. For all intents and purposes, I am you (confidentiality). I can then change each password so that you lose access (availability). This can result in anything from minor inconvenience if you catch it soon enough to outright disaster depending on what I have time to do.

I may not even be after your personal information and finances. I may encrypt all of your information and then attempt to extort money from you to give you back access to it. (availability)

Or, I may use your internet or data connection to attack others. This is far more common than you think!

Maybe I will modify your files (integrity) or delete them (availability) just to screw with you.

What About Those Old Income Tax Returns and Bank Records You Threw Out

Information security is not just computer security. It is also what you did with that piece of paper, with personal infomation on it, that you disposed of.

If I can gain access to your bank, income tax, and other financial records, even old ones, I have more information about you that I could use to impersonate you. Once I have enough information, I would be able to access to your bank accounts, take out loans in your name, and so forth. It will take you years to undo the damage I could wreak.

My Computer Crashed and Now I Can’t Access My Data

You probably didn’t think that this falls under information security, but it does. Remember that information security involves keeping your data safe. It is not safe if you can’t access it.

Summary

So, information security involves keeping your data available and correct, not just away from others.

Information security is not just computer security; it involves many things including how you disposed of that sheet of paper with personal information on it.

Where Do We Go From Here?

Future posts will cover many aspects of information security, including steps you can take to improve the confidentiality, integrity, and availability of your information.

1. PIN = Personal Identification Number ↩