What is information security

Information security protects information (and facilities and systems which store, use and transmit it) from a broad range of threats, in order to preserve the value of it to an organization.

The definition stated above of information security is adapted from that of American National Security Telecommunications and Information Systems Security Committee (NSTISSC).

There are two significant characteristics of information which determine its value to an organization:

•The scarcity of information outside the organization;

•The shareability of information within the organization.

Simplifying, these characteristics state that information is valuable if it provides advantage those who have it, compared with those who do not.Therefore the value of any piece of information relates to the levels of shareability and scarcity. The goal of information security is to preserve the value of information by ensuring that these levels are correctly identified and preserved.

Threats to information influence the organization’s ability to share it within, or to preserve its scarcity outside. Furthermore, threats that are carried out can cost millions in compensation and reputation, and can jeopardize an institution’s ability to survive. Here are some of the examples in which the making available of information that should have been kept scarce or the restricting of information that should have been shareable has damaged an organization.