1 Security Concepts of Information Assurance

Organizations depend on a mix of people, processes, and infrastructure to create value, and cybersecurity exists to protect those elements from disruption. The chapter introduces the basic building blocks of the field by explaining what assets are, why they matter, and how they can be categorized as tangible, intangible, or human. It also distinguishes information systems from information technology and shows that cybersecurity is part of the broader discipline of information security, which protects information in both physical and digital forms.

A major focus of the chapter is the relationship between vulnerabilities, threats, attacks, and threat actors. Vulnerabilities are weaknesses that can be exploited, while threats are the factors that act on those weaknesses to cause harm. The text describes a range of threat actors, from insiders and script kiddies to cybercriminal organizations and nation-state groups, and emphasizes that controls must be chosen based on the asset being protected and the risks it faces. Security controls are grouped into physical, technical, and administrative measures, and together they support resilience and continuity.

The chapter also presents the CIA triad as the core model for understanding information assurance: confidentiality, integrity, and availability. Each principle can be threatened by disclosure, alteration, or denial, and different safeguards help preserve each one, such as encryption for confidentiality, hashing and digital signatures for integrity, and redundancy or backups for availability. Finally, the chapter explains that data classification helps organizations assign appropriate protection based on value and sensitivity, with categories such as public, internal, confidential, and restricted guiding how information should be handled, stored, and secured.

Illustration of the interdependence of the key information security principles of confidentiality, integrity, and availability along with the corresponding threats of disclosure, alteration, and denial.

1. The correct answer is D. Software is not a tangible asset. Unlike hardware, buildings, and machines, which have a physical form and can be touched, software is intangible. It consists of code and data that exist digitally rather than physically.
2. The correct answer is C. Availability is the component of the CIA triad that focuses on ensuring that information is available when it is needed. On the other hand, while Confidentiality and Integrity are part of the CIA, they have different purposes. Authentication is not part of the CIA triad.
3. The correct answer is A. Any factor that has the potential to disrupt an asset by exploiting a vulnerability is known as a threat. Threats can take many forms, including malicious actors such as hackers, computer viruses, or natural disasters such as hurricanes or earthquakes. The remaining options, on the other hand, are not threats because the first two unchecked options represent vulnerabilities, and the last unchecked option emphasizes the need for protective measures on an asset to counter potential threats.
4. The correct answer is C. A threat actor is an individual or entity responsible for launching cyberattacks. The remaining options are incorrect because a software vulnerability is a vulnerability, a phishing email is a threat vector, and a denial-of-service attack is an example of an attack method.
5. The correct answer is B. Personally Identifiable Information (PII) is any information that can be used to identify, distinguish, or trace an individual's identity. A Social Security number is a direct identifier and therefore constitutes PII. The other options contain organizational or aggregated information that does not identify a specific individual.

FAQ