Editing Information security (section)

== Security Goals ==

=== CIA triad ===
The "CIA triad" of '''''c'''onfidentiality, '''i'''ntegrity, and '''a'''vailability'' is at the heart of information security.<ref>{{cite web|last=Perrin|first=Chad|title=The CIA Triad|date=30 June 2008 |url=http://www.techrepublic.com/blog/security/the-cia-triad/488|access-date=31 May 2012}}</ref> The concept was introduced in the Anderson Report in 1972 and later repeated in ''[[The Protection of Information in Computer Systems]].'' The abbreviation was coined by Steve Lipner around 1986.<ref>{{Cite journal |last=Ham |first=Jeroen Van Der |date=2021-06-08 |title=Toward a Better Understanding of "Cybersecurity" |url=http://dx.doi.org/10.1145/3442445 |journal=Digital Threats: Research and Practice |volume=2 |issue=3 |pages=1–3 |doi=10.1145/3442445 |issn=2692-1626}}</ref> 

Debate continues about whether or not this triad is sufficient to address rapidly changing technology and business requirements, with recommendations to consider expanding on the intersections between availability and confidentiality, as well as the relationship between security and privacy.<ref name="SamonasTheCIA14" /> Other principles such as "accountability" have sometimes been proposed; it has been pointed out that issues such as [[non-repudiation]] do not fit well within the three core concepts.<ref name="NIST">{{cite web |title=Engineering Principles for Information Technology Security |year=2004 |url=http://csrc.nist.gov/publications/nistpubs/800-27A/SP800-27-RevA.pdf |publisher=csrc.nist.gov |doi=10.6028/NIST.SP.800-27rA |last1=Stoneburner |first1=G. |last2=Hayden |first2=C. |last3=Feringa |first3=A. |access-date=2011-08-28 |archive-date=2011-08-15 |archive-url=https://web.archive.org/web/20110815124528/http://csrc.nist.gov/publications/nistpubs/800-27A/SP800-27-RevA.pdf |url-status=dead }}</ref>

==== Confidentiality ====
In information security, [[confidentiality]] "is the property, that information is not made available or disclosed to unauthorized individuals, entities, or processes."<ref name="BeckersPattern15">{{cite book |author=Beckers, K. |url=https://books.google.com/books?id=DvdICAAAQBAJ&pg=PA100 |title=Pattern and Security Requirements: Engineering-Based Establishment of Security Standards |publisher=Springer |year=2015 |isbn=9783319166643 |page=100}}</ref> While similar to "privacy", the two words are not interchangeable. Rather, confidentiality is a component of privacy that implements to protect our data from unauthorized viewers.<ref>{{Citation |last1=Fienberg |first1=Stephen E. |title=International Encyclopedia of Statistical Science |date=2011 |pages=342–345 |chapter=Data Privacy and Confidentiality |doi=10.1007/978-3-642-04898-2_202 |isbn=978-3-642-04897-5 |last2=Slavković |first2=Aleksandra B.}}</ref> Examples of confidentiality of electronic data being compromised include laptop theft, password theft, or sensitive emails being sent to the incorrect individuals.<ref name="AndressTheBasics14">{{cite book |author=Andress, J. |url=https://books.google.com/books?id=9NI0AwAAQBAJ&pg=PA6 |title=The Basics of Information Security: Understanding the Fundamentals of InfoSec in Theory and Practice |publisher=Syngress |year=2014 |isbn=9780128008126 |pages=240}}</ref>

==== Integrity ====
In IT security, [[data integrity]] means maintaining and assuring the accuracy and completeness of data over its entire lifecycle.<ref>{{cite journal |last=Boritz |first=J. Efrim |year=2005 |title=IS Practitioners' Views on Core Concepts of Information Integrity |journal=International Journal of Accounting Information Systems |publisher=Elsevier |volume=6 |issue=4 |pages=260–279 |doi=10.1016/j.accinf.2005.07.001}}</ref> This means that data cannot be modified in an unauthorized or undetected manner.<ref>{{Cite journal |last=Hryshko |first=I. |date=2020 |title=Unauthorized Occupation of Land and Unauthorized Construction: Concepts and Types of Tactical Means of Investigation |journal=International Humanitarian University Herald. Jurisprudence |issue=43 |pages=180–184 |doi=10.32841/2307-1745.2020.43.40 |issn=2307-1745 |doi-access=free}}</ref> This is not the same thing as [[referential integrity]] in [[databases]], although it can be viewed as a special case of consistency as understood in the classic [[ACID]] model of [[transaction processing]].<ref>{{Citation |last=Kim |first=Bonn-Oh |title=Referential Integrity for Database Design |date=2000-09-21 |work=High-Performance Web Databases |pages=427–434 |url=http://dx.doi.org/10.1201/9781420031560-34 |access-date=2021-05-29 |publisher=Auerbach Publications |doi=10.1201/9781420031560-34 |isbn=978-0-429-11600-1|url-access=subscription }}</ref> Information security systems typically incorporate controls to ensure their own integrity, in particular protecting the kernel or core functions against both deliberate and accidental threats.<ref>{{Cite journal |last=Pevnev |first=V. |date=2018 |title=Model Threats and Ensure the Integrity of Information |journal=Systems and Technologies |volume=2 |issue=56 |pages=80–95 |doi=10.32836/2521-6643-2018.2-56.6 |issn=2521-6643 |doi-access=free}}</ref> Multi-purpose and multi-user computer systems aim to compartmentalize the data and processing such that no user or process can adversely impact another: the controls may not succeed however, as we see in incidents such as malware infections, hacks, data theft, fraud, and privacy breaches.<ref>{{Cite journal |last1=Fan |first1=Lejun |last2=Wang |first2=Yuanzhuo |last3=Cheng |first3=Xueqi |last4=Li |first4=Jinming |last5=Jin |first5=Shuyuan |date=2013-02-26 |title=Privacy theft malware multi-process collaboration analysis |journal=Security and Communication Networks |volume=8 |issue=1 |pages=51–67 |doi=10.1002/sec.705 |issn=1939-0114 |doi-access=free}}</ref>

More broadly, integrity is an information security principle that involves human/social, process, and commercial integrity, as well as data integrity. As such it touches on aspects such as credibility, consistency, truthfulness, completeness, accuracy, timeliness, and assurance.<ref>{{Cite book |title=Measuring Data Quality for Ongoing Improvement |date=2013 |publisher=Elsevier |isbn=978-0-12-397033-6 |series=MK Series on Business Intelligence |pages=e11–e19 |chapter=Completeness, Consistency, and Integrity of the Data Model |doi=10.1016/b978-0-12-397033-6.00030-4 |access-date=2021-05-29 |chapter-url=http://dx.doi.org/10.1016/b978-0-12-397033-6.00030-4}}</ref>

==== Availability ====
For any information system to serve its purpose, the information must be [[availability|available]] when it is needed.<ref>{{Cite video |url=http://dx.doi.org/10.1117/12.2266326.5459349132001 |title=Video from SPIE - the International Society for Optics and Photonics |access-date=2021-05-29 |doi=10.1117/12.2266326.5459349132001}}</ref> This means the computing systems used to store and process the information, the [[security controls]] used to protect it, and the communication channels used to access it must be functioning correctly.<ref>{{Cite journal |date=2005 |title=Communication Skills Used by Information Systems Graduates |journal=Issues in Information Systems |doi=10.48009/1_iis_2005_311-317 |issn=1529-7314 |doi-access=free}}</ref> [[High availability]] systems aim to remain available at all times, preventing service disruptions due to power outages, hardware failures, and system upgrades.<ref>{{Cite report |url=https://www.osti.gov/biblio/5083196/ |title=Outages of electric power supply resulting from cable failures Boston Edison Company system |date=1980-07-01 |doi=10.2172/5083196 |osti=5083196 |access-date=18 January 2022}}</ref> Ensuring availability also involves preventing [[denial-of-service attack]]s, such as a flood of incoming messages to the target system, essentially forcing it to shut down.<ref>{{Cite journal |last1=Loukas |first1=G. |last2=Oke |first2=G. |date=September 2010 |title=Protection Against Denial of Service Attacks: A Survey |url=http://staffweb.cms.gre.ac.uk/~lg47/publications/LoukasOke-DoSSurveyComputerJournal.pdf |url-status=dead |journal=[[The Computer Journal|Comput. J.]] |volume=53 |issue=7 |pages=1020–1037 |doi=10.1093/comjnl/bxp078 |archive-url=https://web.archive.org/web/20120324115835/http://staffweb.cms.gre.ac.uk/~lg47/publications/LoukasOke-DoSSurveyComputerJournal.pdf |archive-date=2012-03-24 |access-date=2015-08-28 |orig-year=August 2009}}</ref>

In the realm of information security, availability can often be viewed as one of the most important parts of a successful information security program.{{Citation needed|date=June 2021}} Ultimately end-users need to be able to perform job functions; by ensuring availability an organization is able to perform to the standards that an organization's stakeholders expect.<ref>{{Citation |title=Be Able To Perform a Clinical Activity |date=2020-02-02 |work=Definitions |publisher=Qeios |doi=10.32388/dine5x |s2cid=241238722|doi-access=free }}</ref> This can involve topics such as proxy configurations, outside web access, the ability to access shared drives and the ability to send emails.<ref>{{Cite book |last1=Ohta |first1=Mai |title=2011 IEEE International Symposium on Dynamic Spectrum Access Networks (DySPAN) |last2=Fujii |first2=Takeo |date=May 2011 |publisher=IEEE |isbn=978-1-4577-0177-1 |pages=623–627 |chapter=Iterative cooperative sensing on shared primary spectrum for improving sensing ability |doi=10.1109/dyspan.2011.5936257 |chapter-url=http://dx.doi.org/10.1109/dyspan.2011.5936257 |s2cid=15119653}}</ref> Executives oftentimes do not understand the technical side of information security and look at availability as an easy fix, but this often requires collaboration from many different organizational teams, such as network operations, development operations, incident response, and policy/change management.<ref>{{Citation |title=Information technology. Information security incident management |url=http://dx.doi.org/10.3403/30387743 |access-date=2021-05-29 |publisher=BSI British Standards |doi=10.3403/30387743|url-access=subscription }}</ref> A successful information security team involves many different key roles to mesh and align for the "CIA" triad to be provided effectively.<ref>{{Citation |last=Blum |first=Dan |title=Identify and Align Security-Related Roles |date=2020 |work=Rational Cybersecurity for Business |pages=31–60 |place=Berkeley, CA |publisher=Apress |doi=10.1007/978-1-4842-5952-8_2 |isbn=978-1-4842-5951-1 |s2cid=226626983|doi-access=free }}</ref>

=== Additional security goals ===
In addition to the classic CIA triad of security goals, some organisations may want to include security goals like authenticity, accountability, non-repudiation, and reliability. 

==== Non-repudiation ====
In law, [[non-repudiation]] implies one's intention to fulfill their obligations to a contract. It also implies that one party of a transaction cannot deny having received a transaction, nor can the other party deny having sent a transaction.<ref name="BidgoliHandbook06">{{cite book |author=McCarthy, C. |title=Handbook of Information Security, Threats, Vulnerabilities, Prevention, Detection, and Management |publisher=John Wiley & Sons |year=2006 |isbn=9780470051214 |editor=Bidgoli, H. |volume=3 |pages=49–76 |chapter=Digital Libraries: Security and Preservation Considerations |chapter-url=https://books.google.com/books?id=0RfANAwOUdIC&pg=PA65}}</ref>

It is important to note that while technology such as cryptographic systems can assist in non-repudiation efforts, the concept is at its core a legal concept transcending the realm of technology.<ref>{{Citation |title=Information technology. Open systems interconnection. Security frameworks for open systems |url=http://dx.doi.org/10.3403/01110206u |access-date=2021-05-29 |publisher=BSI British Standards |doi=10.3403/01110206u|url-access=subscription }}</ref> It is not, for instance, sufficient to show that the message matches a digital signature signed with the sender's private key, and thus only the sender could have sent the message, and nobody else could have altered it in transit ([[data integrity]]).<ref>{{Citation |last=Christofori |first=Ralf |editor-first1=Reinhard |editor-first2=Merz |editor-last1=Hauff |editor-last2=Akademie |title=Thus could it have been |date=2014-01-01 |work=Julio Rondo - O.k., Meta Memory |publisher=Wilhelm Fink Verlag |doi=10.30965/9783846757673 |isbn=978-3-7705-5767-7}}</ref> The alleged sender could in return demonstrate that the digital signature algorithm is vulnerable or flawed, or allege or prove that his signing key has been compromised.<ref>{{Cite journal |last=Atkins |first=D. |date=May 2021 |title=Use of the Walnut Digital Signature Algorithm with CBOR Object Signing and Encryption (COSE) |url=https://www.rfc-editor.org/info/rfc9021 |doi=10.17487/rfc9021 |s2cid=182252627 |access-date=18 January 2022 |doi-access=free |s2cid-access=free |website=RFC Editor|url-access=subscription }}</ref> The fault for these violations may or may not lie with the sender, and such assertions may or may not relieve the sender of liability, but the assertion would invalidate the claim that the signature necessarily proves authenticity and integrity. As such, the sender may repudiate the message (because authenticity and integrity are pre-requisites for non-repudiation).<ref>{{Citation |last=Le May |first=I. |title=Structural Integrity in the Petrochemical Industry |date=2003 |work=Comprehensive Structural Integrity |pages=125–149 |url=http://dx.doi.org/10.1016/b0-08-043749-4/01001-6 |access-date=2021-05-29 |publisher=Elsevier |doi=10.1016/b0-08-043749-4/01001-6 |isbn=978-0-08-043749-1|url-access=subscription }}</ref>

=== Other models ===
In 1992 and revised in 2002, the [[OECD]]'s ''Guidelines for the Security of Information Systems and Networks''<ref>{{cite web|url=http://www.oecd.org/dataoecd/16/22/15582260.pdf |title=oecd.org |access-date=2014-01-17 |url-status=dead |archive-url=https://web.archive.org/web/20110516085505/http://www.oecd.org/dataoecd/16/22/15582260.pdf |archive-date=May 16, 2011 }}</ref> proposed the nine generally accepted principles: [[information security awareness|awareness]], responsibility, response, ethics, democracy, risk assessment, security design and implementation, security management, and reassessment.<ref>{{Cite journal|date=January 1996|title=GSSP (Generally-Accepted system Security Principles): A trip to abilene|url=http://dx.doi.org/10.1016/0167-4048(96)82630-7|journal=Computers & Security|volume=15|issue=5|pages=417|doi=10.1016/0167-4048(96)82630-7|issn=0167-4048|url-access=subscription}}</ref> Building upon those, in 2004 the [[NIST]]'s ''Engineering Principles for Information Technology Security''<ref name="NIST" /> proposed 33 principles. 

In 1998, [[Donn Parker]] proposed an alternative model for the classic "CIA" triad that he called the [[Parkerian Hexad|six atomic elements of information]]. The elements are [[confidentiality]], [[ownership|possession]], [[integrity]], [[authentication|authenticity]], [[availability]], and [[utility]]. The merits of the [[Parkerian Hexad]] are a subject of debate amongst security professionals.<ref>{{cite web|last=Slade|first=Rob|url=http://blog.isc2.org/isc2_blog/2008/12/cia-triad-versus-parkerian-hexad.html|title=(ICS)2 Blog|access-date=November 17, 2017|archive-date=November 17, 2017|archive-url=https://web.archive.org/web/20171117003743/http://blog.isc2.org/isc2_blog/2008/12/cia-triad-versus-parkerian-hexad.html|url-status=dead}}</ref>

In 2011, [[The Open Group]] published the information security management standard [[Open Information Security Maturity Model|O-ISM3]].<ref>{{cite web|last=Aceituno|first=Vicente|title=Open Information Security Maturity Model|url=http://www.ism3.com/node/39|access-date=12 February 2017}}</ref> This standard proposed an [[operational definition]] of the key concepts of security, with elements called "security objectives", related to [[access control]] (9), [[availability]] (3), [[data quality]] (1), compliance, and technical (4).