What is information security?
Information security means protecting a system, and the data in it, from harm. Once you know the three things to protect, you can describe any incident in one sentence.
A shop loses its customer list, a school finds its marks changed, a website goes down on a sale day. Each is a different kind of harm. Each has a name.
By the end of this lesson
Note
I can name what a system must protect and what threatens it.
Key words
| Word | What it means |
|---|---|
| Asset | something worth protecting |
| Confidentiality | only the right people can read it |
| Integrity | it is correct, and changes only with permission |
| Availability | it works when people need it |
| Threat | something that could cause harm |
| Vulnerability | a weakness that a threat can use |
The cells students fill in are left blank in this preview.
A system protects three things
Security people use three words for what a system must protect.
Confidentiality means only the right people can read the data. Integrity means the data is correct and changes only when someone is allowed to change it. Availability means the system and its data work when people need them.
Together they are called the CIA triad. A harm to any one of them is a security incident.
Worked example: which one was harmed?
| What happened | What was harmed | Why |
|---|---|---|
| A customer list is posted online | Confidentiality | People read what they should not |
| A stranger changes a price in the shop database | Integrity | The data is no longer correct |
| The website is down all day of a sale | Availability | Customers cannot use it |
| Ransomware locks every file until a fee is paid | Availability | The owner cannot open their own data |
The cells students fill in are left blank in this preview.
Who can read the stored passwords?
stat -c "%a %U %G" /etc/shadowShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Who can change the list of accounts?
stat -c "%a %U %G" /etc/passwdShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The two files protect different things
The first Run prints 640 root shadow. The file holds the scrambled passwords, so it is not open to everybody. That protects confidentiality.
The second prints 644 root root. Everybody may read the list of accounts, but only root may change it. That protects integrity.
Who may run the backup script?
stat -c "%a %U" /usr/local/bin/backup.shShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A threat uses a weakness to harm
An asset is anything worth protecting: customer data, a website, a shared folder. A threat is something that could harm it. A vulnerability is a weakness the threat can use.
A threat with no weakness to use does little harm. A weakness with no threat near it waits. When a threat uses a weakness, that is an attack, or an incident.
Worked example: where threats come from
| Source | Example | Weakness it uses |
|---|---|---|
| Outsider | A stranger guesses a password | A weak password |
| Insider | A worker opens files for fun | Too many rights |
| Mistake | An administrator deletes the wrong folder | No backup to restore from |
| Failure | A disk stops working | One copy of the data |
The cells students fill in are left blank in this preview.
A common mistake
Warning
Many people think security only means stopping hackers. Most harm comes from mistakes and failures. A deleted folder or a full disk can destroy integrity and availability with no attacker at all. List the quiet threats as well as the clever ones.
Going further
Think of a school's timetable system. List three assets, one threat for each, and the vulnerability the threat would use.
Then say which of the three goals each one harms. Notice that one incident can harm more than one goal at the same time.