Chapter 2 — What information security is
Lesson map
Lesson 02 published. Map, example, EX004.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Three objectives"]
N2["2.2 Applying them"]
N3["2.3 Beyond the triad"]
N4["2.4 Security and goals"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX004"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Three objectives"]
N2["2.2 Applying them"]
N3["2.3 Beyond the triad"]
N4["2.4 Security and goals"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX004"]
[Learning outcomes]
|
v
[2.1 Three objectives]
|
v
[2.2 Applying them]
|
v
[2.3 Beyond the triad]
|
v
[2.4 Security and goals]
|
v
[Worked example] --> [Exercise EX004]
Learning outcomes
You will (1) define confidentiality, integrity and availability; (2) apply them to examples; (3) explain why security supports organisational goals.
2.1 Three objectives
Aisha learns the three objectives that define information security. FIPS 199, a United States federal standard, defines confidentiality as preserving authorised restrictions on access and disclosure, integrity as guarding against improper modification or destruction, and availability as ensuring timely and reliable access to and use of information. ISO/IEC 27000:2026 describes information security in the same three terms. Dr. Carrow notes that these objectives are widely used because they cover most ways information can be harmed. Aisha copies the three definitions into her journal and writes an Ashfield example beside each one.
2.2 Applying them
Aisha applies the objectives to Ashfield. Members' identity documents need confidentiality, because exposure could enable fraud. Account balances need integrity, because an altered balance would mean someone loses money. The online banking service needs availability, because members expect to see their money when they want. She notes that each piece of information usually needs all three to some degree, but one often matters most, which helps decide where effort goes. She records the most important objective for each item in a simple table, which she will reuse when the course reaches risk assessment in the second year.
2.3 Beyond the triad
Dr. Carrow introduces related properties. Authenticity means confirming that information or a person is genuine; accountability means actions can be traced to whoever performed them; non-repudiation means someone cannot credibly deny an action they took. At Ashfield, a loan approval must be traceable to the officer who approved it. Aisha learns that these properties extend the three objectives and often depend on good identity management and record keeping. She adds the three properties to her journal table, noting for each Ashfield record whether accountability or authenticity matters as much as the original three objectives.
2.4 Security and goals
Security exists to support Ashfield's purpose, not as an end in itself. A control that blocks members from accessing savings may protect confidentiality but damages availability and trust. Aisha learns that good security balances protection with usability and cost. Dr. Carrow asks her to remember that security professionals help organisations take sensible risks, not avoid all risk, because a credit union that refuses all risk could not lend money at all. Aisha writes a short paragraph in her journal describing a control at her own bank that she finds annoying, and asks whether its protection justifies the inconvenience.
Worked example
Aisha defines the three objectives from FIPS 199, applies them to Ashfield's information, adds authenticity and accountability and links security to Ashfield's goals.
Synthetic case. Examples are synthetic.
Errors and limits
Maximising one objective can damage the others.
Exercises
- EX004 — Availability definition. How does FIPS 199 define availability? Rubric: 3 = timely and reliable access and use;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX005 — Balance objective. Which objective matters most for balances? Rubric: 3 = integrity;; 2 = partly correct;; 1 = other;; 0 = none.
- EX006 — Loan traceability. Which property makes loan approvals traceable? Rubric: 3 = accountability;; 2 = partly correct;; 1 = other;; 0 = none.
Continue studying — lesson 02 (chapter 02 of 40)
← Chapter 01 · Course chapter index · Chapter 03 →
Continue to the next authored lesson.