It’s safe to say that Coca-Cola would never share its secret recipe with anyone other than the chosen few. Facebook, too, are unlikely to share the information they have on their users with those that would advertise. Keeping that information secret keeps the value that it has inside their companies. Some information needs to be kept confidential.
Of course, if confidentiality was paramount, we could simply lock the recipe up in a safe and throw away the key. Even more drastic, we could just burn every last copy of it. But that would mean that Coca-Cola’s shareholders would lose interest in investing as the source of its ability to make money would have disappeared. So information has to be available when needed.
Moreover, when it is needed, it must be correct otherwise, when you come to use it, you won’t end up with Coca-Cola. The information contained in it needs integrity – in the sense that it should be whole and undivided, i.e. correct.
There is sometimes a difficult balance to be made between the Confidentiality, Integrity and Availability – the CIA triad – of information. Information security is the art and science of getting that balance right.
Choose a piece of information whose value is critical for your organisation.
We chose Open University assessment material, which contains information to the mission of The Open University in allowing us to validate a student’s study. Thus, it is critical to get the CIA triad correct.
The process of authoring and checking the exam paper could take many months, and in that time it might need to be shared by many people, both inside and outside of the University. I know that email isn’t really confidential, so I’m going to stop the exam paper being attached to an email, unless it is password protected. Internal post isn’t secure, so I’ll ask that people walk to collect the exam paper whenever necessary. However, there are now paid for secure services that I might also look into.
To keep it confidential while they’re on their way to the exam centre, the exam paper will be in a tamper-proof box, so that the courier – who won’t work for The Open University – doesn’t need to be trusted.
Given that you chose different information assets, your analysis will be different. However, perhaps you asked the same questions: who could you trust? What services can be used? Who does what? If not, have another go and try to answer those questions too.
OpenLearn - Information security Except for third party materials and otherwise, this content is made available under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 Licence, full copyright detail can be found in the acknowledgements section. Please see full copyright statement for details.