Information assurance: Difference between revisions
imported>Howard C. Berkowitz No edit summary |
imported>Howard C. Berkowitz No edit summary |
||
| Line 1: | Line 1: | ||
{{subpages}} | {{subpages}} | ||
{{TOC|right}} | |||
{{seealso | cryptography}} | {{seealso | cryptography}} | ||
{{seealso | communications security}} | {{seealso | communications security}} | ||
| Line 5: | Line 6: | ||
==Access and audit== | ==Access and audit== | ||
Among the most fundamental foundations of information security is to establish policies, and, where appropriate, detailed rules, for the allowed uses of resources, by users authorized and whose authorizations are authenticated, to resources whose integrity also may need to be autheticated. In principle, all user-resource | Among the most fundamental foundations of information security is to establish policies, and, where appropriate, detailed rules, for the allowed uses of resources, by users authorized and whose authorizations are authenticated, to resources whose integrity also may need to be autheticated. In principle, all user-resource interactions need to be logged and available for audit. | ||
==Computer security== | ==Computer security== | ||
Revision as of 09:34, 27 February 2010
- See also: cryptography
- See also: communications security
Information assurance, or sometimes information security, is a broad term that includes both communications security and computer security, along with the appropriate administrative infrastructure for personnel and physical security. Information assurance is meaningless without a security policy defining threats, management approach to protection, staff responsibilities, and actions to be taken against attacks and failures.
Access and audit
Among the most fundamental foundations of information security is to establish policies, and, where appropriate, detailed rules, for the allowed uses of resources, by users authorized and whose authorizations are authenticated, to resources whose integrity also may need to be autheticated. In principle, all user-resource interactions need to be logged and available for audit.
Computer security
- See also: Computer security
Properly, computer security deals with the policies, procedures and technologies used to protect end computer systems, rather than the networks interconnecting to them, although the two are often grouped together. Complicating the definition is that many components of networks, such as routers and firewalls, are themselves computers and need stringent computer security practices.
Communications security
- See also: Internet Protocol security architecture
Also called telecommunications security, this subject addresses both non-computer and computer security, although the boundaries are blurring. A World War II radio would have to connect to an external encryption device, while modern radios, such as the Joint Tactical Radio System, are apt to be computer-controlled and have integrated encryption.