What Is Information Security?

Information security, cybersecurity and IT security

Information security is the protection of information and the systems that hold it against unauthorized access, use, disclosure, change, disruption or destruction. The word that matters is information: a customer list is just as sensitive printed on a desk, spoken aloud on a train or remembered by a former employee as it is in a database.

Three terms are used side by side, often loosely:

In job titles and news articles the three are often treated as synonyms, and that is fine in daily use. The distinction matters when you decide what is in scope: a security program that covers only networked computers forgets paper archives, phone calls and the people who know things.

Security exists to support the organization, not for its own sake. A hospital needs patient records to be correct and available at the bedside; a web shop needs its payment process to keep running. Good security starts from that question — what must keep working and what must stay secret — and only then picks technology.

The CIA triad

The CIA triad is the model that describes what security protects: confidentiality, integrity and availability. (It has nothing to do with the intelligence agency.) Every security control you will meet serves at least one of the three, and every incident damages at least one of them.

Confidentiality

Confidentiality means that information is disclosed only to people, processes and systems that are authorized to see it. Everyday example: a doctor discusses your diagnosis in a closed room, not in the waiting area. IT examples: file permissions, encryption of a laptop disk, Transport Layer Security (TLS) on a website, and need-to-know access to the salary database.

Confidentiality breaks through a leak (also called disclosure): an email with a spreadsheet of customer data sent to the wrong person, a storage bucket left open to the internet, a stolen unencrypted laptop, or someone reading over your shoulder.

Integrity

Integrity means that information is accurate and complete, and is changed only by authorized parties in authorized ways — and that unauthorized changes can be detected. Everyday example: a sealed envelope shows whether anyone opened it. IT examples: hashes that reveal a modified file, digital signatures on software updates, database constraints, change management and write permissions that only a few accounts have.

Integrity breaks through tampering (deliberate change) or corruption (accidental change): an attacker changing the bank account number on an invoice, malware altering a software update, or a disk error flipping bits in a backup.

A hash function turns any text into a short fingerprint; change one character and the fingerprint is completely different. This is how a system can tell that something changed, even if it cannot tell what (see Cryptography Basics):

import hashlib

original = "Pay EUR 1,250.00 to NL00 BANK 0123 4567 89"
received = "Pay EUR 7,250.00 to NL00 BANK 0123 4567 89"

def fingerprint(text):
    return hashlib.sha256(text.encode("utf-8")).hexdigest()

stored = fingerprint(original)
print("Stored:  ", stored[:16], "...")
print("Received:", fingerprint(received)[:16], "...")
print("Unchanged?", fingerprint(received) == stored)

Stored:   c7f1090296750aff ...
Received: fd32dd6eacebacf5 ...
Unchanged? False

A plain hash only helps if the attacker cannot replace the stored fingerprint too. That is why real systems protect it with a secret key or a digital signature.

Availability

Availability means that information and systems are accessible and usable by authorized people when they need them. Everyday example: a cash machine that works on a Saturday night. IT examples: redundant power and network links, backups that can actually be restored (see Backup and Recovery), capacity planning and protection against denial-of-service attacks.

Availability breaks through an outage: ransomware that encrypts the file server, a flooded server room, a denial-of-service attack, an expired certificate, or simply a failed update. Note that many outages have no attacker at all — which is why availability is a security goal and not only an operations concern.

Authentication, authorization and accounting

AAA — authentication, authorization and accounting — describes how a system controls who does what. It is usually preceded by identification: claiming an identity, for example by typing a user name.

The order matters. Authorization without authentication would trust anyone who types a name; authentication without authorization would give every logged-in user every right; and without accounting nobody can investigate an incident afterward or prove that rules were followed. Authentication is covered in Passwords and Authentication, authorization in Access Control, and how cloud platforms combine the two in Identity and Access Management.

AAA also applies to devices and services, not only to people. A network switch can ask a central server (using protocols such as Remote Authentication Dial-In User Service, RADIUS, or Terminal Access Controller Access-Control System Plus, TACACS+) whether an administrator may log in and, with TACACS+, which individual commands they may run, and then log them.

Non-repudiation

Non-repudiation is the assurance that someone cannot credibly deny having done something, such as sending a message or approving a payment. On paper, a signature witnessed by a notary provides it. In IT it comes from a digital signature made with a private key that only the signer holds, combined with trustworthy logs and timestamps.

Why a shared secret is not enough: if two parties share the same password or key, either of them could have produced the message, so neither can be held to it. Non-repudiation needs something that only one party controls. This is also why sharing accounts — one "admin" login for the whole team — destroys accountability: the logs show what happened, but not who did it. The details are in Cryptography Basics and PKI and Certificates.

Defense in depth

Defense in depth is the practice of protecting assets with several independent layers of controls, so that when one layer fails — and eventually every layer does — the next one still stops, slows or reveals the attacker. Think of a castle: moat, wall, gate, guards, a locked keep. No single defense has to be perfect.

Each layer is treated in more detail elsewhere on this site:

The layers must be independent to add real protection. Five controls that all rely on the same administrator password are really one control: steal the password and all five fall at once.

Security controls

A security control (also called a safeguard or countermeasure) is any measure that reduces a security risk: a technology, a rule, a routine or a physical barrier. Controls are described along two independent axes: their category (how they are implemented) and their function (what they do).

Categories: how a control is implemented

CompTIA Security+ uses these four categories. ISC2 and many older texts use three — technical, administrative and physical — and count operational routines under administrative.

Functions: what a control does

One control can have several functions. A camera is physical, detective (you review the footage) and deterrent (people see it). Ask "what does this stop, notice or repair?" to place it. A balanced set covers all of them: prevention alone fails silently, and detection without correction only tells you how bad it is.

Security is everyone's job: people, process and technology

Security rests on three legs. Technology — the firewalls and encryption — is the visible part. Process decides whether that technology is used well: who approves new accounts, how quickly patches go in, what happens when someone leaves. People carry out the processes and are the target of most attacks, because tricking a person is often easier than breaking encryption.

That makes security part of every IT role, not only of the security team:

• A help desk employee verifies a caller before resetting a password, and reports a suspicious request.
• A system administrator patches on time, uses a separate admin account and does not leave a test account with a default password.
• An operations engineer in a plant or utility notices that a remote-access tool appeared on a control-room PC and asks why.
• Every employee locks their screen, reports phishing and keeps passwords to themselves.

Reporting is the most valuable habit. A security team cannot respond to what nobody tells them, and an early "this looks odd" from a colleague is often the first sign of an attack. A good security culture thanks people for reports — including false alarms and their own mistakes — rather than blaming them.

Balancing security with usability

Security that gets in the way of work will be worked around. Passwords that must change every month end up on sticky notes; a blocked file-transfer service drives people to private email; an approval process that takes a week leads to shared accounts. The result is less security than a sensible, lighter control.

Good security design reduces friction where it can:

• Match the control to the risk. A public lunch menu needs no MFA; the payroll system does.
• Make the secure way the easy way. Single sign-on and a password manager are both safer and more convenient than dozens of passwords.
• Explain why. People accept a rule they understand; unexplained rules invite workarounds.
• Listen to workarounds. When people bypass a control, it often signals that the control or the process needs fixing, not only that people need reminding.

How much risk is acceptable is a business decision, explained in Threats, Vulnerabilities and Risk.