Information Security

Information security deals with several different "trust" aspects of information. Another common term is information assurance. Information security is not confined to computer systems, nor to information in an electronic or machine-readable form. It applies to all aspects of safeguarding or protecting information or data, in whatever form.

Most definitions of information security tend to focus, sometimes exclusively, on specific usages and, or, particular media; e.g., "protect electronic data from unauthorized use". In fact it is a common misconception, or misunderstanding, that information security is synonymous with computer security in any of its guises: computer and network security, information technology (IT) security, information systems security, information and communications technology (ICT) security. Each of these has a different emphasis, but the common concern is the security of information in some form (electronic in these cases): hence, all are subsets of information security. Conversely, information security covers not just information but all infrastructures that facilitate its use processes, systems, services, technology, etc., including computers, voice and data networks, etc.

The U.S. National Information Systems Security Glossary defines Information systems security (INFOSEC) as: the protection of information systems against unauthorized access to or modification of information, whether in storage, processing or transit, and against the denial of service to authorized users or the provision of service to unauthorized users, including those measures necessary to detect, document, and counter such threats.

It is an important point that information security is, inherently and necessarily, neither hermetic nor watertight nor perfectible. No one can ever eradicate all risk of improper or capricious use of any information. The level of information security sought in any particular situation should be commensurate with the value of the information and the loss, financial or otherwise, that might accrue from improper use disclosure, degradation, denial, or whatever. Bruce Schneier makes this point in Secrets and Lies: information security is about risk management.