Goals of Information Security

The goals of information security are very straightforward. These goals set a framework for developing and maintaining a security plan. They are easy to express, but they hard to carry out. These goals are as follows:

Prevention Prevention refers to preventing computer or information violations from occurring. Security breaches are also referred to as incidents. When an incident occurs, it may the result of a breakdown in security procedures. Incidents come in all shapes and sizes. Simple incidents include things such as losing a password or leaving a terminal logged on overnight. They can also be quite involved and result in the involvement of local or federal law enforcement personnel. If a group of hackers were to attack and deface your website, you would consider this a major incident. Ideally, your security procedures and policies would make you invulnerable to an attack. Unfortunately, this is not usually the case. The better your prevention policies, the lower the likelihood of a successful attack occurring.

Detection Detection refers to identifying events when they occur. Detection is a very difficult problem in many situations. An attack on your system may occur over a long period before it is successful. Incident detection involves identifying the assets under attack, how they occurred, and by whom. The detection process may involve a variety of complicated tools or a simple examination of the system log files. Detection activities should be ongoing and part of your information security policies and procedures.

Response Response refers to developing strategies and techniques to deal with an attack or loss. Developing an appropriate response to an incident involves several factors. If the incident was a probe, the attacker may be gathering intelligence about your network or systems. These types of attacks may be random or targeted. They usually cause little damage. Invariably, though, an attack will be successful. When that happens, it will be helpful to have a well thought-out and tested plan to respond, restore operation, and neutralize the threat. It is always better to have a set of procedures and methods in place to recover from an incident than it is to try to "create" one on the fly.

These goals are an important part of setting benchmarks for an organization. You cannot allow these policies or goals to become insignificant. If you do, you and your organization are setting yourselves up for a surprise. Unfortunately, the surprise will not be a pleasant one, and it may be very costly to correct.