It is a common discussion during an information security risk assessment exercise at most of the organizations. As a general practice the asset value is derived by weighing the confidentiality ©, Integrity (I) and availability (A) value of an asset. While the assets are categorized into Information, Hardware, Software, Service and People, my argument always has been to say that C-I-A values can be assessed for Information Assets only and for all other it should just be the availability value.
Archive for category Risk Assessment
Assessing C-I-A values.
Dec 23
Parkerian Hexad
Aug 16
The Parkerian hexad is a set of six elements of information security proposed by Donn B. Parker, renowned security consultant and writer. The term was coined by M. E. Kabay. The Parkerian hexad adds three additional attributes to the three classic security attributes of the CIA triad (confidentiality, integrity, availability).
The Parkerian Hexad attributes are the following:
- Confidentiality
- Possession or Control
- Integrity
- Authenticity
- Availability
- Utility
These attributes of information are atomic in that they are not broken down into further constituents; they are non-overlapping in that they refer to unique aspects of information. Any information security breach can be described as affecting one or more of these fundamental attributes of information.
I think I don’t require to provide the explanation of C-I-A here. Let’s look at the other attributes.
CISF Security at Infosys
Jul 31
In the recent news Infosys becomes the first private company to get CISF security. I have also been reading in yet another blog about a organization conducting mocks drills for terrorist’s attacks. It is quite interesting to see that organizations are now taking security as a prime concern. As mentioned in my previous blog about frisking of VIP’s at airports, the exception mentioned there is an age old rule that was implemented when terrorism was a not major concern.
It just came up recently while discussing with one of my friend, the need for capturing service assets as a part of asset inventory which will be used further for risk assessment exercise.
In a normal scenario, everyone uses a template that captures assests under different cateogories, viz
- Information Asset – deals with electronic and paper based data
- Hardware Asset – includes all your hardware, cupboards, safe, etc
- Software Asset – includes all software’s used or implemented in the organization.
- Service Asset – services that a department avails from the organization
- People Asset – talks about people / employees
Now the discussion went like this:
The very first lesson taught to me in my computer classes where “A computer is as smart as you are” and this statement holds good even today. For the computer would do only that a person would want it to do. The only advantage a computer has over human is that of speed and storage capacity.
While looking at various aspects of data loss, the end reason always point to “PEOPLE”. The above statement holds good not only because there are data loss (which is now the high rated security risks), even if you look at any frauds that has happened in the recent past, everything has been manipulated by “HUMAN”. No matters what standards are adopted, what stringent rules are set in an organization, frauds still happen.
