\[ \newcommand{\ListType}{{\text{List}}} \newcommand{\ListEmpty}{{\left[\right]}} \newcommand{\ListLength}[1]{{\ell\left(#1\right)}} \newcommand{\ListAt}[2]{{{#1}_{#2}}} \]
Home

Information Security

Disclaimer: This book is intended to develop a formal model of information security. At the time of writing, it remains a work in progress; therefore, its current style, organization, and contents may change and should not be considered representative of the final version.

I Introduction

An information system is a system of actors with the goal of processing information , that is create, acquire, store, process, dispose, and disseminate information, according to the information sytem's specification. Actors interact to adjust the system and process information. That specification defines the expected behavior of the information system including its goals and ,most importantly, its constraints. We characterize information security as the discipline of protecting the information system from access, use, disruption, modification, or destruction by actors in ways which are not allowed by its specification.

This book's target audience are specific actors in an information system called information security actor, or SAs for short, which are tasked with three distinct activities:

For now, we assume SAs are considered as benign and try their best to follow the specificationin their actions. Furthermore, we assume the specification is understood by them. Given these assumptions, we want to operationalize the actions (A1), (A2), and (A3) in ways that a potential SA of an information system might get an idea what to expect from his job. The further we operationalize, the further we inevitably specialize for a disctinct categories of information systems. Chapter Chapter II Categories of Information Systems" discusses various categories of information systems before Chapter III "Observe, Enforce, Redefine" discusses SAs in greater detail.

To operationalize, we can, however, add certain meta-requirements to the specification. One popular pick of requirements are the requirements o fconfidentiality, integrity, and availability:

The requirements confidentiality, integrity, and availability are frequently called the CIA-triad.

We can add more requirements. Another popular addition are the requirements of authenticity, accountability, non-repudiation, and reliability:

Some less popular ones are:

We observe that all these requirements are meta-requirements but they provide an idea on what information security is. As an SA entity, we need to materialize requirements of the information system's specification in the information system's implementation.

Chapter IV "Information security Requirements" discusses various requirements of information systems. This is then also the last chapter of the first book. Future books will deal with specific information systems, specific requirements, and specific security actors and their actions.