Lecture: 01
Information Security Foundations
1. Introduction
In today’s digital world, information is one of the most valuable assets for individuals,
organizations, and governments.
Computers, mobile devices, and networks store and transmit large amounts of sensitive
data such as financial records, personal information,
and business secrets. Protecting this information from unauthorized access, damage, or loss
is called information security.
Information security ensures that data remains protected whether it is stored, processed, or
transmitted.
2. Definition of Information Security
Information Security (InfoSec) is the practice of protecting information and information
systems from unauthorized access, use, disclosure, disruption, modification, or destruction.
3. Importance of Information Security
Information security is important because it protects:
• Personal Information – identity data, bank accounts, medical records
• Business Information – financial records, customer data, trade secrets
• Government Information – national security data, citizen databases
Without proper security, organizations can suffer financial losses, reputational damage, and
legal consequences.
4. Foundations of Information Security (CIA Triad)
The foundation of information security is based on three main principles known as the CIA
Triad:
Confidentiality – Information should only be accessible to authorized individuals.
Examples: Password protection, encryption, access control.
Integrity – Information must remain accurate and unchanged unless modified by authorized
users.
Examples: Hash functions, digital signatures, file permissions.
Availability – Authorized users must be able to access information when needed.
Examples: Backup systems, redundant servers, disaster recovery systems.
5. Key Concepts Supporting Information Security
Authentication – Verifying the identity of a user (username/password, biometrics).
Authorization – Determining what an authenticated user is allowed to do.
Non-Repudiation – Ensuring that a person cannot deny performing an action, often
implemented using digital signatures.
6. Common Threats to Information Security
Malware – Malicious software such as viruses, worms, and ransomware.
Phishing – Fake emails or messages used to steal personal information.
Insider Threats – Employees misusing their authorized access.
Denial of Service (DoS) – Attacks that make systems unavailable to users.
7. Information Security Controls
Technical Controls – Firewalls, encryption, and antivirus software.
Administrative Controls – Security policies, training programs, and risk management.
Physical Controls – Security cameras, locked server rooms, access cards.
8. Real-World Example
Online banking systems use multiple security measures such as encryption, authentication,
firewalls, and backup systems to ensure that customer information remains confidential,
accurate, and available.
9. Summary
Information security protects sensitive information from threats and unauthorized access.
The CIA triad—Confidentiality, Integrity, and Availability—forms the foundation of
information security systems.