♪ music ♪
STEVE PUTNAM: Hello everybody, my name is Steve Putnam. I've been asked to talk a little bit about "What is Security?"
When we start entering in to discussions about
what security is, that falls in to three primary categories
If you take all of our course work, and all of the things we put together and all the things
that we're trying to develop for students to learn how to do and be proficient in
it boils down to three things. Data or information security falls in to trying to protect
your information in three ways.
and no, we're not going to make you members
of the CIA but that is a good acronym to remember the things that you need
to keep in mind when you're talking about information security
and that is that the first thing that you have to be cautious of, or aware of is that you're protecting
your information from the standpoint of "Is your information confidential?"
You hear a lot today about the confidentiality. This is one of the things
that the press picks up on very quickly when one of our favorite retailers
or one of our, you know, information providers has a
lapse in security and all of our confidential information spills out all over the internet.
That is big news. Sells a lot of things
on internet websites and sells a lot of newspapers, but it's a tragic headache for us
who get caught up in this. And so the first thing that companies have to do
so that they won't have an extinction level event in their company is to make sure that whatever data
they're collecting about the public maintains confidential
They no only have a moral responsibility to keep your data confidential, they have
in our country at least, a legal responsibility in almost every
environment. So, we explore that in our curriculum as well because it's now not just
the right thing to do. Sometimes, it's the thing that you must be able to prove in court
that you've maintained a reasonable attempt
to make sure that information is kept confidential or else you're held liable
The second thing that we have here is integrity.
When you think of security and you think of data, a lot of what we do in our security course
and a lot of what we'll do in our curriculum and just about every course is
the data that is being kept, is it maintained in such a way that you can trust
that data over time. This is something that has to be taken in to account
over time. If you're collecting data today, is it going to be
kept in such a way that when you access that data that has been archived
or it has been maintained in a certain way, is that data going to remain the same
today, tomorrow, a year from now, two years from now, ten years from now
whenever it needs to be accessed. So, is that data going to remain
exactly the way that it was kept and be able to be reproduced
in exactly the way that it was originally designed.
That can become a challenge as computer platforms change over time as well.
So, it's one of the things that has to be considered by companies that are going to keep data
over a long period of time. Am I going to be able to look at this blueprint drawing
ten years from now with whatever software is being provided at that time
and that blueprint drawing still reproduce, accurately, what I
created ten years ago. That's something that you didn't used to have to worry about
when you printed this all out on paper. You open the book ten years from now
it's going to look exactly the same as it did except maybe a little yellowing on the paper
ten years prior. But, if you try to open up any file that you've created on any computer system
ten years ago on your system today, what kind of trouble are you going to run in to.
with that and that's something that you have to keep in mind when you're talking about data integrity.
The last thing is closely related to that, and that is availability
The data has to be available. If it's not available at the time
that it's needed, then collecting the data was useless at the point of collection
So, if you have information that you've stored. If you have information
that you need to make available, is it available when it's needed?
This gets in to disaster recovery. It gets in to elements of "What are we going to plan
for in terms of what is the environment going to do to our physical systems?"
What are people going to do to our physical systems? How can they
deny service or access to the things that we've created and the things that we've
established to maintain, hold, and process our data. And are we going to be
able to reach that data when the time comes to need it and the
time comes to be able to do what we need to do with it. So when we're
considering security, we have to first consider confidentiality
We have to consider integrity, and we have to consider availability, and pretty
much everything else that we'll outline or that we will approach from
the policy standpoint or the technical standpoint in all the security
that we try to persue in information systems security will revolve around one
of these three aspects. Is your data confidential? Is you data going to
maintain its integrity over time, and is it going to be available when we need it?
♪ music ♪