Information Security
Protect the information, not just the box
Information security rests on the CIA triad: confidentiality (only authorized people see it), integrity (it is accurate and unaltered), and availability (it is there when needed). Every control you recommend should map to one of the three.
Concepts
- Classification drives everything: public, internal, confidential, restricted. Label, then control.
- Access models - discretionary (owner decides), mandatory (system labels decide), role-based (job function), attribute-based (context). Least privilege and need-to-know sit underneath all of them.
- Authentication vs authorization. Authentication proves who you are (something you know, have, or are - MFA combines them); authorization decides what you may do.
- Cryptography. Symmetric encryption is fast, asymmetric solves key exchange, hashing verifies integrity and is not reversible. Encrypt data at rest and in transit; they are different problems.
- Network basics - firewalls filter, IDS detects, IPS blocks, segmentation limits blast radius, VPNs protect remote traffic.
- Incident response - prepare, detect, contain, eradicate, recover, lessons learned.
- Privacy and disposal - know your retention obligations, and destroy media so data cannot be recovered.
Traps
- Confusing authentication with authorization, or IDS with IPS.
- Saying hashing "encrypts" data.
- Assuming the cloud provider secures your data - responsibility is shared, and your data is yours.
Worked example
A laptop is lost at an airport. First question: was full-disk encryption enabled and keys escrowed? If yes, the incident is a hardware loss with low breach risk. If no, you move to containment: revoke credentials, force password resets, monitor for anomalous access, and assess notification duties.
Rule of thumb: classify, label, control, monitor, dispose - and write the incident plan before you need it.