Information and Information Security Concepts
This domain sets out the vocabulary every later EXIN Information Security Essentials domain assumes: what information and information assets are, the CIA triad, and how abstract properties become concrete requirements. Questions typically give a short scenario and ask which property is affected, or ask you to separate data from information and information security from IT security.
Core definitions
- Data is a raw, uninterpreted record - a number, a log entry, a scanned page. Information is data that has been processed, organised or interpreted so it has meaning for a recipient. Knowledge is information combined with experience and judgement inside a person.
- An information asset is anything of value to the organisation that stores, processes, transmits or represents information: databases, contracts, source code, paper files, laptops, and staff know-how.
- Information security preserves confidentiality, integrity and availability (CIA).
- Confidentiality: information is not disclosed to unauthorised people, systems or processes.
- Integrity: information is accurate, complete and not altered without authorisation.
- Availability: information and the systems delivering it are accessible to authorised users when required.
- ISO/IEC 27000 adds supporting properties: authenticity, accountability, non-repudiation and reliability.
Distinctions the exam likes
- Information security covers paper, people and conversation; IT security covers only technology; cybersecurity covers networked technology and attackers.
- Security is a continuous risk-management process, not a product installed once.
- The same requirement can be met at physical, technical or organisational level; a strong answer considers all three.
Worked example
A hospital's electronic patient-record system is encrypted by ransomware and unavailable for four hours. The primary CIA property breached is availability, because authorised clinicians cannot reach records when they need them. If restored records turn out to have been edited, integrity is also breached. If attackers copied records before encrypting them, confidentiality is breached. In the exam, answer with the property the scenario describes - cannot reach the system is availability - and add the others only where the scenario states them.
Traps that cost marks
- Ticking confidentiality for any wording containing breach; unavailability is availability.
- Treating data and information as synonyms: information has meaning and value.
- Assuming information security is only about computers, so people and paper are ignored.
- Forgetting that integrity includes completeness, not only accuracy.