What is Information Security?
Information security is the practice of safeguarding information and computer systems from unauthorized access, disclosure, use, disruption, modification, or destruction. This is achieved through a set of measures and protocols that aim to protect the confidentiality, integrity, and availability of sensitive information and the technology systems that process, store, and transmit it.
Confidentiality in information security means ensuring that sensitive information is kept private and protected from unauthorized access, use, or disclosure. Integrity, on the other hand, refers to the trustworthiness and reliability of the information. It means that data is accurate, complete, and consistent and that it has not been modified or altered unauthorizedly. Availability refers to the accessibility of information to authorized users when they need it.
What is a Security Model?
A security model is a framework or systematic approach that defines how various security mechanisms should be implemented to protect a system or an organization from unauthorized access, modification, or destruction. A security model provides a structured and consistent way to design, implement, and manage security controls such as access control, encryption, firewalls, intrusion detection systems, and other security mechanisms. It typically includes a set of rules, policies, and procedures that define an organization's security goals, objectives, and requirements.
Security Model in Information Security
A security model in information security is a framework or a systematic approach that describes how various security mechanisms should be implemented to protect information systems and data from unauthorized access, modification, or destruction. A security model typically includes a set of rules, policies, and procedures that define an organization's security goals, objectives, and requirements. It gives a structured and systematic approach to designing, implementing, and managing security controls, including access controls, firewalls, encryption, intrusion detection systems, and other security mechanisms. There are various security models in use, including:
●
Bell-LaPadula model: This concept emphasizes confidentiality and access control and is
widely utilized in military and government settings. Three rules primarily
govern this model:
1.
Simple confidentiality rule: According to this rule, the
subject can only read files on the same and lower layers of secrecy, but not
the upper layer of confidentiality.
2.
Star confidentiality rule: According to this rule, the
subject can only write files on the same layer of secrecy and the higher layer
of confidentiality but not the lower layer.
3. Strong star confidentiality rule: This rule states that the subject can only read and write files on the same layer of secrecy, not the upper or lower layers of confidentiality.
●
Biba model: This model emphasizes data integrity and is often used in financial institutions
and other organizations where data accuracy is critical. It has three rules.
1.
Simple
integrity rule
2.
Star
integrity rule
3. Strong star integrity rule
●
Clark-Wilson model: This model focuses on data integrity and separation of duties and is
commonly used in commercial environments. It includes the following entities:
1.
Subject
2.
Constrained
data items
3. Unconstrained data items
● Non-Interference model: This model focuses on maintaining the secrecy of sensitive data and is often used in high-security environments.
CISSP with InfosecTrain
The security model is essential to the CISSP (Certified Information Systems Security Professional) certification because it provides a framework for designing and implementing security controls that protect information and information assets. Security models define the principles, concepts, and guidelines to ensure information confidentiality, integrity, and availability. They provide a structured approach to designing security controls and help ensure security measures align with business objectives. Check out InfosecTrain's CISSP certification training course to learn more about the security model.
