Information Security

Introduction

Information is one of the most valuable assets in the modern digital world.
Individuals, schools, businesses, governments, hospitals, financial institutions,
and technology companies all depend on information to operate.

Every day, people create, collect, store, process, transmit, and share information.
This information may include names, passwords, financial records, customer details,
student records, business documents, source code, photographs, emails, databases,
and confidential company information.

Because information has value, it must be protected. This is the foundation of
Information Security.

What Is Information Security?

Information Security, commonly called InfoSec,
is the practice of protecting information and information systems from unauthorized
access, use, disclosure, disruption, modification, destruction, or loss.

In simple terms:

Information security means protecting information so that the right people
can access and use it in the right way while preventing unauthorized people or
processes from gaining access or causing harm.

Information security is not limited to computers. It applies to information
regardless of how that information is stored, processed, communicated, or presented.

What Is Information?

Information is data that has been organized, interpreted, processed, or given meaning.

For example, a collection of numbers may simply be data:

85
72
91
68

When those numbers are identified as examination scores for students, they become
meaningful information.

Information can take many forms, including:

• Student records
• Customer information
• Passwords
• Banking information
• Medical records
• Business documents
• Emails
• Photographs
• Videos
• Source code
• Database records
• Contracts
• Research documents
• Government records

Information Assets

An information asset is information or a resource that has value
to an individual or organization and therefore needs protection.

Examples include:

• Customer databases
• Student registration records
• Employee records
• Passwords
• Financial information
• Website databases
• Source code
• Company documents
• Business strategies
• Research data
• Email accounts
• Cloud storage accounts

Information security professionals first need to understand what information an
organization possesses before they can properly protect it.

Why Is Information Security Important?

Information security is important because information can be stolen, altered,
destroyed, exposed, or made unavailable.

A security failure can affect individuals and organizations in many ways.

1. Financial Loss

Stolen financial information, fraudulent transactions, ransomware, and business
disruption can result in significant financial losses.

2. Privacy Violations

Personal information may be exposed to people who do not have permission to access it.

3. Reputation Damage

An organization that repeatedly loses customer information may lose the trust of
its customers and partners.

4. Operational Disruption

If critical information becomes unavailable, an organization may be unable to
continue normal operations.

5. Legal and Regulatory Problems

Organizations may have legal or regulatory responsibilities concerning how certain
types of information are collected, stored, processed, and protected.

The CIA Triad

One of the most important concepts in information security is the
CIA Triad.

CIA stands for:

• Confidentiality
• Integrity
• Availability

These three principles provide a basic framework for protecting information.

Confidentiality

Confidentiality means ensuring that information is only accessible
to authorized people, systems, or processes.

For example, a student’s examination result should not be accessible to every
student in a school.

Only authorized personnel should have access to confidential examination records.

Common confidentiality controls include:

• Passwords
• Access permissions
• Encryption
• Multi-factor authentication
• User roles
• Physical access controls

Integrity

Integrity means ensuring that information remains accurate,
complete, trustworthy, and protected from unauthorized modification.

For example, if a student’s score is changed from 85 to 25 without authorization,
the integrity of the information has been compromised.

Integrity can be protected through:

• Access controls
• File permissions
• Checksums
• Digital signatures
• Audit logs
• Database controls
• Version control

Availability

Availability means ensuring that authorized users can access
information and systems when they need them.

For example, if an online learning platform is unavailable during an examination,
students may not be able to access the required information.

Availability can be supported through:

• Backups
• Redundant systems
• Disaster recovery
• System monitoring
• Reliable infrastructure
• Power protection
• Business continuity planning

Information Security and Cyber Security

Information security and cyber security are closely related, but they are not
exactly the same thing.

Information security has a broad focus on protecting information
in different forms.

Cyber security focuses primarily on protecting digital systems,
networks, devices, applications, and data from cyber threats.

For example, protecting a printed confidential document is an information security
activity even though it is not necessarily a cyber security activity.

On the other hand, protecting a web server against malicious attacks is both an
information security and cyber security concern.

Information Security Applies to Physical Information

Information does not always exist on a computer.

Consider a company that stores sensitive customer information in printed files.
The company must still protect those documents.

Physical information security controls may include:

• Locked filing cabinets
• Restricted office access
• Visitor controls
• Document shredding
• Security guards
• Secure storage rooms
• Document classification

Information Security Applies to Verbal Information

Information can also be communicated verbally.

For example, an employee discussing confidential company information in a crowded
public location may accidentally expose sensitive information.

Security awareness therefore applies to conversations as well as computers and
documents.

Information Classification

Organizations can classify information according to its sensitivity and importance.

A simple classification system may include:

• Public: Information that can be freely shared.
• Internal: Information intended mainly for members of an organization.
• Confidential: Information that should only be accessed by authorized people.
• Highly Confidential: Extremely sensitive information requiring strong protection.

The exact classification names used by organizations may differ, but the purpose
is the same: to help determine how information should be handled and protected.

Example of Information Classification

Imagine Dwallnet operates an online learning platform.

Classification helps an organization determine which security controls should
be applied to each type of information.

Common Information Security Threats

Information can be exposed to many different threats.

Unauthorized Access

An unauthorized person gains access to information without permission.

Data Theft

Sensitive information is stolen and used or distributed without authorization.

Data Modification

Information is changed without proper authorization.

Data Destruction

Information is deliberately or accidentally destroyed.

Data Leakage

Sensitive information is accidentally or intentionally exposed.

Malware

Malicious software can steal, modify, encrypt, or destroy information.

Human Error

Employees or users can accidentally expose information by sending documents to
the wrong person, using weak passwords, or mishandling sensitive files.

People, Processes, and Technology

Information security depends on three major components:

• People
• Processes
• Technology

People

People include employees, students, administrators, customers, security
professionals, managers, and other users.

Even advanced security technology can fail if users do not understand basic
security practices.

Processes

Processes are the rules, procedures, policies, and methods used to manage
information securely.

Examples include:

• Password policies
• Backup procedures
• Incident response procedures
• Access approval procedures
• Data retention policies

Technology

Technology includes tools and systems used to protect information.

Examples include:

• Firewalls
• Antivirus software
• Encryption
• Access control systems
• Intrusion detection systems
• Backup systems
• Security monitoring tools

Security Controls

A security control is a safeguard or measure designed to reduce
security risk.

Security controls can take different forms.

Administrative Controls

These include policies, procedures, training, standards, and organizational rules.

Technical Controls

These include firewalls, encryption, authentication systems, access control,
antivirus software, and monitoring tools.

Physical Controls

These include locks, security guards, CCTV systems, access cards, gates, and
secure rooms.

Preventive, Detective, and Corrective Controls

Security controls can also be grouped according to what they are designed to do.

Preventive Controls

Preventive controls attempt to stop a security problem before it occurs.

Examples include:

• Strong passwords
• Multi-factor authentication
• Firewalls
• Access restrictions

Detective Controls

Detective controls help identify security events that have already occurred or
are currently occurring.

Examples include:

• Security logs
• Intrusion detection systems
• Security monitoring
• Audit systems

Corrective Controls

Corrective controls help restore systems or information after a security event.

Examples include:

• Restoring backups
• Removing malware
• Resetting compromised passwords
• Repairing affected systems

Risk and Information Security

Information security is closely connected to risk management.

Risk exists when a threat can exploit a weakness and cause harm to an asset.

For example:

• Asset: Student database
• Threat: Unauthorized attacker
• Vulnerability: Weak administrator password
• Impact: Student information may be exposed
• Control: Strong authentication and access restrictions

This simple example shows how security professionals think about protecting
information.

Information Security Lifecycle

Information security is not a one-time activity.

Organizations continuously need to:

1. Identify information assets.
2. Identify threats and vulnerabilities.
3. Assess risks.
4. Implement security controls.
5. Monitor the environment.
6. Respond to incidents.
7. Recover affected systems.
8. Improve security practices.

This continuous process helps organizations adapt to new threats and changing
technology.

Example: Protecting a Dwallnet LMS

Consider a Dwallnet learning management system containing student accounts,
course records, assignments, examination results, and administrator accounts.

The system contains valuable information that requires protection.

Confidentiality

Student personal information should only be accessible to authorized users.

Integrity

Students should not be able to secretly modify their examination results.

Availability

Authorized students and instructors should be able to access the LMS when needed.

Possible security controls could include:

• Strong authentication
• Role-based access control
• Database backups
• HTTPS
• Security monitoring
• Audit logs
• Regular software updates

Information Security in Web Development

Web developers play an important role in information security.

A developer may be responsible for applications that collect and process sensitive
information.

Developers should therefore consider security during the design and development
process rather than waiting until after an application has been completed.

Important practices include:

• Validating user input
• Using secure authentication
• Protecting passwords
• Using HTTPS
• Controlling database access
• Keeping software updated
• Protecting sensitive configuration information
• Logging important security events

Information Security and the Human Factor

Technology alone cannot guarantee information security.

A user can accidentally disclose a password, click a malicious link, send a
confidential document to the wrong person, or leave a sensitive document
unprotected.

This is why security awareness and responsible behavior are essential.

Every person who interacts with information has some level of responsibility
for protecting it.

Simple Information Security Rules

As a beginner, you can start with these basic rules:

1. Use strong and unique passwords.
2. Enable multi-factor authentication where available.
3. Do not share passwords.
4. Keep software updated.
5. Back up important information.
6. Do not open suspicious attachments or links.
7. Protect confidential documents.
8. Use secure networks when handling sensitive information.
9. Give users only the access they need.
10. Report suspicious security events quickly.

Practical Exercise

Create a simple information security classification table for five types of
information that may exist in a school, company, or training center.

For each item, identify:

1. The information asset.
2. Its classification.
3. Who should have access to it.
4. One possible threat.
5. One security control that could protect it.

Example:

Class Discussion

Discuss the following questions:

1. Why is information considered an asset?
2. What is the difference between information security and cyber security?
3. Why is confidentiality important?
4. How can information lose its integrity?
5. Why is availability important?
6. Can information security exist without technology?
7. How can human behavior affect information security?
8. What security controls would you use to protect a student database?

Key Takeaways

• Information is a valuable asset that must be protected.
• Information security protects information from unauthorized access, modification, disclosure, destruction, and loss.
• Information may exist digitally, physically, or verbally.
• The CIA Triad consists of confidentiality, integrity, and availability.
• Information security includes people, processes, and technology.
• Security controls help reduce information security risks.
• Information classification helps organizations determine how information should be handled.
• Cyber security is an important part of information protection in digital environments.
• Security must be considered throughout the information lifecycle.
• Every user has a role in protecting information.

Code Example

The following PHP example demonstrates how information assets can be classified
according to their sensitivity:

<?php

$information_assets = array(
    'student_records' => 'Confidential',
    'course_content'  => 'Internal',
    'public_website'  => 'Public',
    'admin_password'  => 'Highly Confidential'
);

foreach ( $information_assets as $asset => $classification ) {
    echo $asset . ' : ' . $classification . '<br>';
}

?>

Lesson Summary

Information security is a fundamental part of modern computing and digital
operations. It focuses on protecting information regardless of whether that
information is stored on a computer, printed on paper, transmitted across a
network, or communicated verbally.

The three major principles of information security are confidentiality,
integrity, and availability. These principles help security professionals
understand what needs to be protected and why.

Effective information security combines people, processes, and technology.
Security controls, risk management, security awareness, monitoring, and
continuous improvement all contribute to a stronger security environment.

As you continue through this Cyber Security course, you will learn how these
principles are applied to networks, systems, applications, threats, monitoring,
and ethical security practice.