Week 1: Lecture 1: Information

* Information * Information is things that are or can be known about a topic. It is also known as communicable knowledge, which is something you can impart to someone else. It is an unambiguous abstraction of data. Now in the digital sense, the smallest unit of information is a single bit; is the bit on or is the bit off? Now if we go back to the days of landline telephone service, you would call information which would give you a phone number for a subscriber if you describe enough detail who the describer might be. The difference between data and information is that information is knowledge that you get or abstract through processing of data. What I do with those 1’s and 0’s, and how I would apply application software to it, transitions data and turns it into knowledge. * The other thing about information is that information depends on the context around it. For example, lets take numbers….10 digits, well 10 digits by themselves can just be 10 digits, but if I put a semicolon in between them (:), it can now be assumed that it is a time or a duration or a track record. Now if I would put a $ in front of those numbers, it could be the price of something or the amount of money in my wallet. Now if I add another meaning to those numbers lets say, I make the first 3 digits an area or a region assignment, the next 2 digits a group and the last 4 a serial number….I will then have the coding for a social security number. Now they are just digits but it is how I interpret those digits’ in the context that are around them. * Information Security * So, information security is the protection of information, i.e. the protection of the contents of the information. But why do we need to protect it in an enterprise? Well, we should protect it because: * Intellectual property is at stake. Intellectual property are patents, production methods, manufacturing-the new and old car model * For example, if I have a better way to manage a widget, that gives you can Intellectual property stake in the widget. * Financial result- you do not like or want financial results to leak prematurely. You also do not want competitors to know that you are doing worse than they are or that they are doing better than you. * Personnel Data- It wouldn’t be good if it got out that an employee was out on sick leave because they had a mental breakdown * Salary data is another thing that we would not wan to leak. There is no better way to discourage employees then for them to be able to tell who makes what. * Healthcare information, if this was leaked people would be able to see who has what health care policy, who met their deductable, who is seeing which doctor and so on. * Information Classification * Why do we have to categorize information or classifying information? Well, because different information needs different protection. It is also very hard to protect everything with the same level of protection. If someone did that, it would be very expensive. So, there are different categories of information that require different protections. * Merger and acquisition information (who is buying out who) * Proprietary Information * Executive private information (who is getting a bonus) * Personnel Information (hiring and firing) * Health care information (who is pregnant who is not) * Characterization of Classified Information * Classified information is a categorization applied to information that a government claims is sensitive information. Which means that the government restricts it by law to a group of people or groups of people and you have to be cleared for that information with a formal security clearance. A formal security clearance is often required to handle classified documents or access to classified data. Now the purpose of classification is to protect information that can be used to endanger or damage national security. * For example, releasing the plans for an atomic bomb * Classification defines a state secret and gives you a level of protection that is based on the expected damage that the information could cause in the wrong hands. * For example, if a spy is outed in a foreign country that could cause harm. * Government classification * Top-Secret * Can cause grave national damage. This is the highest level of classification. * Secret * Would cause serious damage * Confidential * Would cause damage or prejudicial * “wiki leaks” scandal * Restricted * Would cause undesirable effects. * Implication and Sample Classifications * Implication * The implications of classification are a function of governance activity. How I enforce rules in an enterprise. Each enterprise classifies information differently just like every system in the US government has a classification guide. That classification guide will tell you what is top secret, secret, confidential and restricted. Well, in an enterprise there is very little documented about how information is actually classified or if there is a classification guide its not widely known. * Sample Classifications that you will see in an enterprise * Proprietary * Cost proposal data * Executive private * Personnel Information * Classifications * Directed Classification * Other classifications that you have can be DIRECTED classifications, classifications that are passed down by regulatory authority. Things like the use of social security or identification numbers for employees. HIPAA information, healthcare information privacy accountability act, in which the person knows that their information will not be shared with people who do not have a NEED for that information. Personal privileged information, criminal history information, mistakes that we made in the past stay in the past, and fiduciary data. * Classification * Now the thing about information classification is that it is very subjective and it has to be done. The reason you have to do it is because different directed classifications have different handling requirements. Those handling requirements will dictate how you process that information in an IT system. The other thing is that you can’t protect all of the information equally. If you protect all information equally, very little information will actually be shared. But not only that, it will end up costing you a small fortune because securing everything equally means that you are literally locking up everything as well as keeping track of every piece of data. * Implications for Security * The implications for security are actually very simple. Information classification categorization is the foundation for enterprise security. You have to know what to protect and what you are protecting it from. Once you do that, you can identify what you are actually protecting it from. So lets say if it is healthcare information, you are worried about disclosure and modification. Disclosure transfer into confidentiality (keeping something secret), modification makes something an integrity risk (example, if a medical test result is changed so that it comes back positive instead of negative, that is an integrity issue), and access the availability of information. So basically you want to identify what you are protecting information from because that helps you figure out best how to protect it.