Published on Thu 30 March 2017 by Gary Hall in Security with tag(s): infosec
Much of our personal and business information is now held on computers, so keeping information secure is an extremely important concept. Information needs to be available to people who should have access to it, but protected from those who should not. There are three main principles that apply to information security: confidentiality, integrity and availability.
Confidentiality is the principle that information should not be disclosed or accessible to anyone who is not authorised to know it. Usually, confidentiality of data on computers is achieved using encryption, which makes it unreadable to anyone who is not authorised to access it.
Operating systems have access controls that allow system users to be identified (by their username), authenticated (by their password) and authorised (by the file access permissions granted by the system administrator) so that information held on the system is only accessible to those who should be able to see it.
Integrity ofdata on computers means that the information is accurate and complete, and also that it is not possible for unauthorised changes to be made to the information.
Hashing provides a way to check the integrity of digital files. A hash is simply a number produced by applying a hashing algorithm to a file.
Digital signatures and certificates also provide integrity by providing assurance that an email is from the person from whom it appears to be. In database systems the normalisation process used at the design stage is used to help ensure data is not duplicated which can impact on integrity. Bear in mind also that out of date or inaccurate information can impact on the integrity of a database.
Digital signatures can also provide non-repudiation, as do operating system features such as audit logs, which show which particular user accessed a file and when.
For information to be useful it must be available to those people and systems who need to have access to it. Therefore system managers must take steps to ensure that information systems provide the required level of availability to users. An organisation must decide what level of availability it needs for its computer systems.
For some companies, Monday to Friday 9 am to 6 pm is sufficient; for others there must be 24 hour, 365 day availability of systems. An organisation must also decide how long it can survive without its systems in the case of hardware failure or a disaster such as a fire or flood.
In order to increase the availability of a system, an organisation has to remove any single point of failure from the system. They can achieve this through a number of methods, including the following:
Disc redundancy - using multiple discs systems, such as RAID, to allow the system to continue uninterrupted if one disc fails.
Backup - to replace any data lost due, for example, to corruption or human error.
Server redundancy - duplicated hardware in case of a serious hardware failure.
Disaster recovery - putting plans in place to run the whole system from a different location in the case of a physical disaster such as fire or flood.
Companies need to have considered what level of access can be given to specific users or groups of users, particularly with regard to systems that contain a lot of sensitive data. The ideal situation would be that each user only has access to the data that they actually require for doing their job. This is the principle of providing minimal access to information or lowest required access permission, so as to maximise protection of data.
Most systems allow various levels of access, which are ysually defined as:
full access - ability to read, write and delete files
write access - ability to read and write files but not delete them
read access - ability only to read (view) files.
In a large organisation with many employees, it may not be possible to define exactly which files and what level of access each individual user should have in order merely to do their job, so user access rights to files are normally allocated to groups of users, perhaps based on the department they work for or their seniority within the company.
As well as giving the correct level of access to the users who should be able to access the data, the system should protect the data from unauthorised access of information and from theft, because personal, financial and commercially sensitive information (or intellectual property) may be valuable to others. The system should also protect data from deliberate or accidental loss, trhough the use of backups.