Information security

Information security is the practice of protecting information by mitigating information risks. It is part of information risk management.[1] It typically involves preventing or reducing the probability of unauthorized or inappropriate access to data or the unlawful use, disclosure, disruption, deletion, corruption, modification, inspection, recording, or devaluation of information. It also involves actions intended to reduce the adverse impacts of such incidents. Protected information may take any form, e.g., electronic or physical, tangible (e.g., paperwork), or intangible (e.g., knowledge).[2][3] Information security's primary focus is the balanced protection of data confidentiality, integrity, and availability (also known as the "CIA" triad) while maintaining a focus on efficient policy implementation, all without hampering organization productivity.[4] This is largely achieved through a structured risk management process.[5]

To standardize this discipline, academics and professionals collaborate to offer guidance, policies, and industry standards on passwords, antivirus software, firewalls, encryption software, legal liability, security awareness and training, and so forth.[6] This standardization may be further driven by a wide variety of laws and regulations that affect how data is accessed, processed, stored, transferred, and destroyed.[7]

  1. ^ Joshi, Chanchala; Singh, Umesh Kumar (August 2017). "Information security risks management framework – A step towards mitigating security risks in university network". Journal of Information Security and Applications. 35: 128–137. doi:10.1016/j.jisa.2017.06.006. ISSN 2214-2126.
  2. ^ Daniel, Kent; Titman, Sheridan (August 2006). "Market Reactions to Tangible and Intangible Information". The Journal of Finance. 61 (4): 1605–1643. doi:10.1111/j.1540-6261.2006.00884.x. SSRN 414701.
  3. ^ Fink, Kerstin (2004). Knowledge Potential Measurement and Uncertainty. Deutscher Universitätsverlag. ISBN 978-3-322-81240-7. OCLC 851734708.
  4. ^ Keyser, Tobias (April 19, 2018), "Security policy", The Information Governance Toolkit, CRC Press, pp. 57–62, doi:10.1201/9781315385488-13, ISBN 978-1-315-38548-8, retrieved May 28, 2021
  5. ^ Danzig, Richard; National Defense University Washington DC Inst for National Strategic Studies (1995). "The big three: Our greatest security risks and how to address them". DTIC ADA421883.
  6. ^ Lyu, M.R.; Lau, L.K.Y. (2000). "Firewall security: Policies, testing and performance evaluation". Proceedings 24th Annual International Computer Software and Applications Conference. COMPSAC2000. IEEE Comput. Soc. pp. 116–121. doi:10.1109/cmpsac.2000.884700. ISBN 0-7695-0792-1. S2CID 11202223.
  7. ^ "How the Lack of Data Standardization Impedes Data-Driven Healthcare", Data-Driven Healthcare, Hoboken, NJ, US: John Wiley & Sons, Inc., p. 29, October 17, 2015, doi:10.1002/9781119205012.ch3, ISBN 978-1-119-20501-2, retrieved May 28, 2021