3.11Security (The Three Elements of Information Security, Threats, Cryptography, Authentication, and Countermeasures)

Working with information systems means grappling with information security. Attack techniques grow more sophisticated every year, and technical countermeasures alone are not enough—each individual user's awareness matters too. This is one of the most frequently tested areas within the Technology field, covering the three elements to protect, representative threats, and the cryptography, authentication, and organizational countermeasures that counter them.

3.11.1The three elements of information security and threats

• Confidentiality keeps information accessible only to authorized people (preventing leaks). Integrity keeps information accurate and unaltered. Availability ensures information and systems can be used whenever needed. These three together are called the three elements of information security (CIA).
• Malware is a general term for malicious software (viruses, ransomware, etc.). Phishing is a technique that impersonates a legitimate organization via a fake email or website to steal IDs and passwords. A targeted attack is an attack that attempts intrusion using a carefully crafted email or similar, aimed at a specific organization or individual. Social engineering steals information by exploiting human psychological gaps rather than technology—impersonation over the phone, shoulder-surfing, and so on.

3.11.2Cryptography, authentication, and organizational countermeasures

• Symmetric-key cryptography uses the same key for encryption and decryption (fast, but key distribution is a challenge). Public-key cryptography uses a separate public key for encryption and private key for decryption (the public key can be shared with anyone, but only the owner holds the private key). A digital signature applies public-key cryptography to prove that the sender is genuine and the data has not been tampered with. PKI (public key infrastructure) is the overall mechanism by which a certificate authority (CA) guarantees, via certificates, that a public key genuinely belongs to its claimed owner.
• Multi-factor authentication verifies identity by combining two or more of "something you know" (password), "something you have" (phone, IC card), and "something you are" (fingerprint, etc.)—safer than a single factor alone. Biometric authentication uses physical characteristics—fingerprint, face, vein pattern—for verification.
• A firewall inspects and blocks unauthorized traffic at a network boundary. Zero trust is the modern idea of verifying every access attempt individually, rather than assuming "it's safe because it's on the internal network." ISMS (information security management system) is an organization-wide mechanism to continuously plan, operate, and review information security. Risk management is the process of identifying and analyzing risk, then responding by accepting, reducing, avoiding, or transferring it.

Consider a mid-sized company's IT department reviewing its security measures. When explaining to management, staff frame "customer data must not leak externally" as confidentiality, "order data must not be altered without authorization" as integrity, and "the core system must be usable throughout business hours" as availability, explaining that information security is achieved only when all three elements are satisfied. Reviewing actual past incidents, they find a phishing email impersonating a business partner sent to accounting staff to lure them toward a fake invoice; a targeted attack email sent only to specific executives with a subject line that looked work-related; and a social engineering attempt where someone posing as IT support called and pressed staff to "share your password." Against these threats, the team first strengthens the firewall inspecting internal and external traffic, and abandons the old assumption that "access from the internal network is safe," instead adopting zero trust, which verifies every access attempt individually. For sending important files, they use symmetric-key cryptography, letting sender and receiver exchange data quickly with a key only they hold, while combining it with public-key cryptography (separate keys for encryption and decryption) for the moment of safely delivering that key itself. Contracts with business partners carry a digital signature proving the document was not tampered with and genuinely came from the claimed sender, and the authenticity of that public key is backed by a certificate issued by a PKI certificate authority. Employee logins now require multi-factor authentication, combining a password (something you know) with a confirmation code from a phone app (something you have), making unauthorized logins harder even if the password alone leaks. Beyond these individual technical measures, the organization as a whole establishes an ISMS to continuously review its security policy, and positions unresolvable risks within a risk management process—transferring some via insurance, for instance.

3.11.3Section summary

• The three elements of information security = confidentiality, integrity, availability. Malware/phishing/targeted attacks/social engineering are threats with distinct techniques
• Symmetric-key = same key for encryption/decryption; public-key = separate keys. Digital signatures and PKI prove sender authenticity and non-tampering
• Multi-factor authentication combines different types of factors. Zero trust verifies every access individually, even from inside. ISMS/risk management provide organizational governance