Security properties for information assets Sample Clauses

Security properties for information assets. Security properties for information assets are typically derived from the information security domain. A well-known and renowned set of standards for Information Security Management is the ISO/IEC 27000 series. The first standard of this series, ISO/IEC 27000:2014 [4], provides the set of definitions and terms. Information security is defined as: Information security – preservation of confidentiality, integrity and availability of information. Note: In addition, other properties, such as authenticity, accountability, non-repudiation, and reliability can also be involved. Here confidentiality, integrity and availability are defined as follows: Confidentiality – property that information is not made available or disclosed to unauthorized individuals, entities, or processes. Integrity – property of accuracy and completeness. Availability – property of being accessible and usable upon demand by an authorized entity. The property availability is applicable to information as well as to a (information processing) function, process or system. In the context of Smart Grids, availability is often regarded as the most important property [5]. Ensuring availability of the power supply is indeed very important. The availability of information or of an information processing function is not necessarily more important than the integrity of the information to ensure the availability of power supply. Confidentiality can easily be applied within the context of Smart Grids, although the property is often regarded as less important for this domain (see for instance section 6 of [5]). Note that confidentiality of security function data (such as symmetric encryption keys) is important. Integrity is the more difficult, and much debated, property of the three. The definition for integrity from ISO/IEC 27000 is not easy to apply. A more traditional definition for data integrity that was first defined in ISO 7498-2:1989 [6] is: Data integrity – property that data has not been altered or destroyed in an unauthorized manner. A common debate on data integrity is whether it also means that the data is correct. Therefore, correctness integrity is sometimes included as an additional property. Moreover, the authenticity of the origin of information is also not included in the definition above. Data origin integrity or authenticity is commonly addressed as a separate property. Authenticity is defined in ISO/IEC 27000 as follows: Authenticity – property that an entity is what it is claiming ...