Information assurance

History

With the growth of telecommunication networks also comes the dependency on networks, which makes communities increasing vulnerable to cyber attacks that could interrupt, degrade or destroy vital services. Starting from the 1950s the role and use of information assurance has grown and evolved. These feedback loop practices were employed while developing Worldwide Military Command and Control System military decision support systems.

In the beginning information assurance involved just the backing up of data. However once the volume of information increased, the act of information assurance began to become automated, reducing the use of operator intervention, allowing for the creation of instant backups. The last main development of information assurance is implementing distributed systems for the processing and storage of data through techniques like SANs and NAS plus using cloud computing.

These three main developments of information assurance parallel the three generations of information technologies, the first used to prevent intrusions, the second to detect intrusion, and the third for survivability.

Pillars

Information assurance is built between five pillars: availability, integrity, authentication, confidentiality and nonrepudiation. These pillars are taken into account to protect systems while still allowing them to efficiently provide services. However, these pillars do not act independently from one another, rather they interfere with the goals of the other pillars. Administrators need to prioritize pillars in order to achieve desired results for their information system, balancing the aspects of service and privacy.

Authentication

Authentication is the verification of the validity of a transmission, originator, or process within an information system. Authentication provides the recipient confidence in the data senders validity as well as the validity of their message. There exists many ways to bolster authentication, mainly breaking down into three main ways, personally identifiable information such as a person's name, address telephone number, access to a key token, or known information, like passwords.

Integrity

Integrity refers to the protection of information from unauthorized alteration. The goal of information integrity is to ensure data is accurate throughout its entire lifespan. User authentication is a critical enabler for information integrity. Information integrity is a function of the number of degrees-of-trust existing between the ends of an information exchange . One way information integrity risk is mitigated is through the use of redundant chip and software designs. A failure of authentication could pose a risk to information integrity as it would allow an unauthorized party to alter content. For example, if a hospital has inadequate password policies, an unauthorized user could gain access to an information systems governing the delivery of medication to patients and risk altering the treatment course to the detriment of a particular patient.

Availability

The pillar of availability refers to the preservation of data to be retrieved or modified from authorized individuals. Higher availability is preserved through an increase in storage system or channel reliability. Breaches in information availability can result from power outages, hardware failures, DDOS, etc. The goal of high availability is to preserve access to information. Availability of information can be bolstered by the use of backup power, spare data channels, off site capabilities and continuous signal.

Confidentiality

Confidentiality is in essence the opposite of Integrity. Confidentiality is a security measure which protects against who is able to access the data, which is done by shielding who has access to the information. This is different from Integrity as integrity is shielding who can change the information. Confidentiality is often ensured with the use of cryptography and steganography of data. Confidentiality can be seen within the classification and information superiority with international operations such as NATO Information assurance confidentiality in the United States need to follow HIPAA and healthcare provider security policy information labeling and need-to-know regulations to ensure nondisclosure of information.

Non-repudiation

Nonrepudiation is the integrity of the data to be true to its origin, which prevents possible denial that an action occurred. Increasing non-repudiation makes it more difficult to deny that the information comes from a certain source. In other words, it making it so that you can not dispute the source/ authenticity of data. Non-repudiation involves the reduction to data integrity while that data is in transit, usually through the use of a man-in-the-middle attack or phishing.

Interactions of pillars

The pillars do not interact independently of one another, with some pillars impeding on the functioning of other pillars or in the opposite case where they boost other pillars. For example, the increasing the availability of information works directly against the goals of three other pillars: integrity, authentication and confidentiality.

Process

The information assurance process typically begins with the enumeration and classification of the information assets to be protected. Next, the IA practitioner will perform a risk assessment for those assets. Vulnerabilities in the information assets are determined in order to enumerate the threats capable of exploiting the assets. The assessment then considers both the probability and impact of a threat exploiting a vulnerability in an asset, with impact usually measured in terms of cost to the asset's stakeholders. The sum of the products of the threats' impact and the probability of their occurring is the total risk to the information asset.

With the risk assessment complete, the IA practitioner then develops a risk management plan. This plan proposes countermeasures that involve mitigating, eliminating, accepting, or transferring the risks, and considers prevention, detection, and response to threats.

A framework published by a standards organization, such as NIST RMF, Risk IT, CobiT, PCI DSS or ISO/IEC 27002, may guide development. Countermeasures may include technical tools such as firewalls and anti-virus software, policies and procedures requiring such controls as regular backups and configuration hardening, employee training in security awareness, or organizing personnel into dedicated computer emergency response team (CERT) or computer security incident response team (CSIRT). The cost and benefit of each countermeasure is carefully considered. Thus, the IA practitioner does not seek to eliminate all risks; but, to manage them in the most cost-effective way.

After the risk management plan is implemented, it is tested and evaluated, often by means of formal audits. The IA process is an iterative one, in that the risk assessment and risk management plan are meant to be periodically revised and improved based on data gathered about their completeness and effectiveness.

There are two meta-techniques with information assurance: audit and risk assessment.

Business risk management

Business risk management breaks down into three main processes: risk assessment, risk mitigation, and evaluation and assessment. Information assurance is one of the methodologies which organizations use to implement business risk management. Additionally, business risk management supports compliance with federal and international laws regarding the release and security of information, such as HIPAA.

Information assurance can be aligned with corporate strategies through training and awareness, senior management involvement and support, and intra-organizational communication allowing for greater internal control and business risk management. Using information assurance in the business model improves reliable management decision-making, customer trust, business continuity and good governance in both public and private sectors.

Standards organizations and standards

There are a number of international and national bodies that issue standards on information assurance practices, policies, and procedures. In the UK, these include the Information Assurance Advisory Council and the Information Assurance Collaboration Group.