What is information security? Attacks, CIA and how security is achieved

What information security means

To be secure is to be free from danger or threat. Information security applies that idea to information: it is the practice of preventing unauthorised access, use, disclosure, disruption, modification, inspection, recording or destruction of information, whether it is stored on a disk, sent across a network or printed on paper.

An attack is any action that compromises the security of information an organisation owns. Attacks fall into two broad groups.

Active and passive attacks

The key security concepts (CIA)

• Confidentiality: only authorised people can read sensitive information. Achieved with usernames and passwords, access control lists (ACLs) and encryption.
• Integrity: information stays accurate and complete, exactly as its creator intended. Achieved with hashing, digital signatures and change controls.
• Availability: information and resources are there when authorised users need them. Achieved with hardware maintenance, patching, redundancy and network optimisation.

Encryption

Encryption converts readable plaintext into unreadable ciphertext using an algorithm (the mathematical method) and a key. Only someone with the right key can turn it back.

• Symmetric encryption: one shared secret key both encrypts and decrypts. Fast, so it protects bulk data (AES).
• Asymmetric (public-key) encryption: a key pair. What one key locks, only the other can unlock. Used to exchange keys and to sign (RSA, elliptic curve).

Digital signatures

A digital signature does for electronic documents what a handwritten signature does for paper, but far more reliably: it proves who signed and that nothing changed afterwards. It is used in e-commerce, software updates, financial transactions and anywhere forgery or tampering must be detected.

Access control

Access control limits who can use a system or a physical or virtual resource, and what they may do with it. The simplest form is a username and password; stronger forms add multi-factor authentication, role-based permissions and regular access reviews. Physical access control (badges, locks, guarded doors) applies the same idea to buildings and server rooms.

Real-world example: a passive and an active attack in one week

A small accountancy firm saw both kinds of attack in the same week. In the passive case, a junior accountant logged in to an old supplier portal from a coffee shop's open Wi-Fi. The portal used plain HTTP, so anyone on that network capturing traffic could have read the password without changing anything. The firm stopped using the portal until the supplier enabled HTTPS, and told staff to use the company VPN on public Wi-Fi.

In the active case, a client received an email that appeared to come from the firm, with an invoice whose bank details had been changed. That attack targeted integrity: the message had been altered. The firm now signs outgoing emails digitally, and tells clients that bank details will never change by email and must always be confirmed by phone on a known number.