Title: CNSS Security Model
Course: IN 2001 Principle of Information Assurance > Section: Module 1: Chapter One

CNSS Security Model

The security model, as represented in Figure 1-4 of you text, shows the three dimensions.  If you extrapolate the three dimensions of each axis, you end up with a 3 × 3 × 3 cube with 27 cells representing areas that must be addressed to secure the information systems of today.  Your primary responsibility is to make sure that each of the 27 cells is properly addressed during the security process.

Components of an Information System

To fully understand the importance of information security, it is necessary to briefly review the elements of an information system.  An information system (IS) is much more than computer hardware; it is the entire set of software, hardware, data, people, procedures and networks necessary to use information as a resource in the organization.

Software

Explain that software is the operating systems, applications and assorted utilities of an information system.

Hardware

Define hardware as the physical assets that run the applications that manipulate the data of an information system.  As hardware has become more portable, the threat posed by hardware loss has become a more prominent problem.

Data

Explain that the lifeblood of an organization is the information needed to strategically execute on business opportunities and the data processed by information systems are critical to today’s business strategy.

People

Note that people are often the weakest link in an information system, since they give the orders, design the systems, develop the systems and ultimately use and game the systems that run today’s business world.

Procedures

Explain that procedures are the written instructions for accomplishing a task, which may include the use of technology or information systems, but not necessarily.  These are the rules that we are supposed to follow and the foundation for the technical controls that security systems must be designed to implement.

Networks

Emphasize that the modern information processing system is extremely complex and relies on many hundreds of connections, both internal and external.  From the LAN to the MAN and ultimately the WAN or Internet, networks are the highway over which information systems pass data and users complete their tasks.

Explain that proper control over all traffic in every network in an organization is vital to properly managing the information flow and security of that organization.

Balancing Information Security and Access

When considering information security, it is important to realize that it is impossible to obtain perfect security. Security is not an absolute; it is a process and not a goal.  Security should be considered a balance between protection and availability.  To achieve balance, the level of security must allow reasonable access, yet protect against threats.

Approaches to Information Security Implementation

Security can begin as a grassroots effort when systems administrators attempt to improve the security of their systems.  This is referred to as the bottom-up approach.

The key advantage of the bottom-up approach is the technical expertise of the individual administrators. Unfortunately, this approach seldom works, as it lacks a number of critical features, such as participant support and organizational staying power.

An alternative approach, which has a higher probability of success, is called the top-down approach.  The project is initiated by upper management who issue policy, procedures and processes, dictate the goals and expected outcomes of the project and determine who is accountable for each of the required actions.

The top-down approach has strong upper-management support, a dedicated champion, dedicated funding, clear planning and the opportunity to influence organizational culture.

The most successful top-down approach also involves a formal development strategy referred to as a systems development life cycle.