Security Concepts

What is Information Security?

Information security (InfoSec) protects data and systems from unauthorized access, attacks, theft, and damage. Data is vulnerable during storage, transfer, and processing — so security covers networks, applications, servers, devices, users, and communication channels.

Cybersecurity vs Information Security:

Information Security
│
├── Policies
├── Physical Security
├── Data Protection
└── Cybersecurity
      ├── Networks
      ├── Systems
      ├── Applications
      └── Digital Threats

CIA Triad

The foundation of cybersecurity. See also: CIA Triad

Authenticity

Assurance that a message or transaction originates from a verified, trustworthy source. Requires proof of identity through authentication mechanisms.

• Ensures the source of information is genuine
• Critical for establishing trust in digital communication

Non-Repudiation

Assurance that a party cannot deny having performed an action or sent a message.

• Provides proof of origin and data integrity
• Prevents denial of actions after the fact
• Achieved through: digital signatures, audit logs, certificates

Due Care and Due Diligence

Two complementary concepts that together cover responsible security management.

Due Care — *doing the right thing*

Taking reasonable actions to prevent security incidents and reduce damage. Based on the prudent man rule: act in good faith, in the organization's best interest.

Examples: deploying firewalls, security awareness training, applying patches, enforcing policies.

Failure to exercise due care = gross negligence.

Due Diligence — *knowing the risks before acting*

Continuously identifying, understanding, and evaluating risks in the business, technical, and social environment.

Examples: audits, background checks, penetration testing, risk assessments, testing backup plans.

Relationship: due diligence comes first (understand risks) → due care follows (act on them).

NIST Cybersecurity Framework

Five functions covering the full security lifecycle:

Identify → Protect → Detect → Respond → Recover

Detect/Respond findings feed back into improving Identify and Protect.

IAM — Identity and Access Management

Controls who can access what and tracks what they do.

IAM
├── Identification  → claiming an identity (username)
├── Authentication  → proving the identity (password, MFA)
├── Authorization   → determining what actions are allowed
└── Accounting      → logging and tracking all actions

Authorization Models

Gap Analysis

Comparing current security posture against a required framework or standard.

Current State ---------> Desired State
       \                     /
        \                   /
         \----- GAP --------/

Steps: choose framework → assess current controls → identify missing controls → measure risk → recommend fixes → set remediation timeline.