Part A: Foundations and frameworks
Overview of information systems security
Key takeaways
- Security practice is organised around the CIA triad, confidentiality, integrity and availability, with authenticity and non-repudiation extending it.
- Name the objective a scenario breaches from what happened to the information: read without authority is confidentiality, altered without authority is integrity, made inaccessible is availability.
- Information assets are identified and classified, typically as public, internal, confidential or restricted, before they are protected, so controls match what each asset is worth.
- Risk arises only where a threat meets a vulnerability, and its size depends on likelihood and impact together.
- IS security has technical, physical, human, third-party and legal scope, and is managed with metrics such as mean time to detect, mean time to respond and patch compliance.
Information systems security is the practice of protecting an organisation's information and the systems that process it against unauthorised access, use, disclosure, disruption, modification or destruction. This opening chapter fixes why that matters, what is actually being protected, and how well it is working, before the rest of the paper builds out the specific standards, controls and processes that deliver it.
Security objectives
Security practice is organised around the CIA triad, three properties that between them cover almost everything a security control is trying to achieve. A control that cannot be traced to one of the three is not really a security control at all.
Two further objectives extend the triad in modern practice: authenticity (the information genuinely comes from the source it claims to) and non-repudiation (a party cannot later deny having sent a message or performed an action, the property digital signatures exist to provide).
Naming the objective a scenario breaches
A payroll clerk's login is used, from an unfamiliar device, to change three
employees' bank account details the night before a salary run. No data is
read or copied.
Objective breached: integrity, not confidentiality. Nothing was disclosed;
the payroll records were altered without proper authorisation. If the same
access had instead been used only to view salary figures, that would be a
confidentiality breach. If the payroll system had instead been taken
offline so the run could not happen at all, that would be an availability
breach. The exam question is almost always this naming exercise, done from
what actually happened, not from how serious it sounds.
Information assets and classification
An information asset is anything of value to the organisation that holds or conveys information, data itself, the hardware and software that process it, and the people and documentation around it. Assets must be identified and classified before they can be protected, since a blanket 'protect everything equally' policy wastes resources on low-value assets while under-protecting genuinely critical ones.
A typical four-tier asset classification scheme
| Classification | Meaning | Example |
|---|---|---|
| Public | Disclosure causes no harm | A published marketing brochure |
| Internal | Disclosure causes limited harm, not intended for outside release | An internal staff directory |
| Confidential | Disclosure causes real harm to the organisation or a person | Customer personal data, commercial contract terms |
| Restricted / Secret | Disclosure causes severe harm | Cryptographic keys, board-level merger discussions |
Classification drives everything downstream: which controls apply (see the chapter on security controls), who may access the asset, and how long it must be retained and how it must eventually be disposed of. A classification scheme is worthless unless every asset is actually labelled and the label is honoured by the systems that store and transmit it.
Threats, vulnerabilities and risks
The relationship is multiplicative in the way it is normally taught: risk arises only where a threat and a vulnerability meet, and its size depends on both likelihood and impact together, the same likelihood-times-impact logic that underlies any risk register (revisited for security risk specifically under management controls, in the chapter on security controls).
Scope of security
- Technical scope: networks, endpoints, applications, databases and the cloud services an organisation uses (see the chapter on network and computer security)
- Physical scope: data centres, server rooms, and the physical access controls protecting them
- Human scope: staff awareness, insider threat, and the social engineering that targets people rather than systems
- Third-party scope: vendors, contractors and cloud providers who hold or process the organisation's data on its behalf
- Legal and regulatory scope: the laws and contractual obligations the organisation must meet (see the chapter on standards and frameworks)
IS security is therefore never purely a technical function. A firewall correctly configured to the last rule still fails the organisation if a staff member is persuaded by a phone call to read out a password, which is why the human and third-party scope above are given equal weight to the technical scope in a mature security programme.
Security metrics
Security cannot be managed on faith; it is measured, the same discipline as any other organisational function. A metrics programme gives management an evidence base for the questions security controls and incident response exist to answer: is the organisation getting more or less secure over time, and where should the next investment go.
- Mean time to detect (MTTD): the average time between an incident occurring and the organisation becoming aware of it
- Mean time to respond/resolve (MTTR): the average time from detection to full resolution
- Number of security incidents over a period, and the trend against prior periods
- Patch compliance rate: the percentage of systems patched within the organisation's own target window
- Percentage of staff completing security awareness training
- Number of vulnerabilities identified by severity, and the percentage remediated within target timeframes
Exam tip
The CIA-triad naming exercise (which objective a described scenario breaches) is the single most frequently tested idea in this chapter and recurs in disguise throughout the paper, always ask first what actually happened to the information, was it read, altered, or made unavailable, before reaching for a more complicated answer.
Self-check
(a) Define the three objectives of the CIA triad. (3 marks)
(b) A competitor obtains a copy of an organisation's unreleased product design through a leaked email attachment. State which CIA objective was breached and why. (2 marks)
(c) Distinguish a threat from a vulnerability, and explain why risk requires both to be present. (4 marks)
(d) State three components of the scope of IS security in an organisation, beyond the purely technical. (3 marks)
(e) State two IS security metrics an organisation might track, and what each tells management. (4 marks)
Show worked answer
(a) Confidentiality: information is disclosed only to those authorised to see it. Integrity: information is accurate and has not been altered without authorisation. Availability: information and systems are accessible to authorised users when needed.
(b) Confidentiality, since the design information was disclosed to a party not authorised to see it; nothing about the information was altered or made unavailable.
(c) A threat is a potential cause of an unwanted incident, existing independently of the organisation. A vulnerability is a weakness in the organisation's own environment that a threat can exploit. Risk requires both because a threat with no exploitable vulnerability, or a vulnerability no threat can reach, causes no actual harm; risk arises only where the two meet.
(d) Any three of: physical scope (data centres, access control); human scope (staff awareness, insider threat, social engineering); third-party scope (vendors, contractors, cloud providers); legal and regulatory scope.
(e) Any two of: mean time to detect (how quickly incidents are noticed); mean time to respond/resolve (how quickly they are closed out); number of incidents over a period (whether the security posture is improving or worsening); patch compliance rate (whether known vulnerabilities are being closed on schedule); percentage of staff completing awareness training (whether the human scope is being addressed).