The 4 Corners of a Solid Information Assurance Strategy

When Confucius told his students, “Every truth has four corners,” he probably didn’t have the field of information assurance on his mind. However, the need for a stalwart information assurance strategy can require Confucius-like wisdom, because even if you excel at one, without the other three, security is bound to suffer.

Information assurance is important within cyberdefense because it ensures information is exactly where you want it, is accessible whenever you want it, in proper condition and is only accessible to those to approved individuals. Through technical, physical and administrative efforts, information assurance officers keep data and information safe and usable from the smallest company to the federal government, and they accomplish this task through four main lines of defense.

People

The first line of defense in any organization is the people who work within it. While hiring individuals who are ethical should always be a company’s goal, even honest people can make mistakes, creating security risks or breaches, especially if they are untrained or underprepared. Knowing this, information assurance, or IA, requires the following of an organization’s employees:

• Policies, procedures and awareness. When roles and expectations are clearly defined, it helps employees understand how to behave in different situations. Clearly set rules and regulations will help keep information safe.
• Skills and training. While it can seem overwhelming to keep up with changes in IT and IA, doing so will keep your business’s information and data safe. Attend conferences, schedule training, and keep your staff abreast of new threats.
• Incident response. Training employees how to recognize incidents and respond to them will cut down on the time it takes for you to recover from a security breach, and it will also supply you with valuable information regarding how to make things safer in the future.

Network

The network is where you are more noticeably vulnerable — especially if your company utilizes cloud computing. Here your business and its data encounter the virtual world and the threats therein. To keep your IA skills sharp and at-the-ready within your network, employ the following:

• A firewall. A firewall is the part of your IT infrastructure forming a guard between the Internet and your data. It keeps out unwanted outsiders.
• Network topology. Network topology provides for compartmentalization of systems, workstations and applications so if your network is breached, the segmented network will provide some protection.
• Network Intrusion Detection System. Basically your network’s burglar alarm, an NIDS will help keep you informed if security breaches have been attempted or accomplished.

Host

Your computer host is the third line of defense in information assurance, and it includes your routers, workstations, automated control systems and servers. Any security measures here can also keep information protected. Your host’s IA security measures include:

• C3. C3 refers to host capability, capacity and configuration, and when these three are properly employed as security components, they will give your security measures even greater strength.
• Data integrity assurance. Data integrity assurance refers to ensuring all the contents, availability and accessibility of your information is kept without compromise within your host.

Applications

Within every organization are the applications enabling it to conduct its work. From email and payroll to database applications, the security measures in place within each individual application will provide your information with the last line of defense against a cyberattack.

• Design and implementation. Are your applications built to withstand, or at least resist, attack? Choose programs that will aid you in your efforts of information assurance, and stay on top of bug fixes and improvements from third party vendors.
• Integrity assurance capabilities. Each application should have integrity assurance capabilities so if a line of code changes or needs to, the appropriate IT and IA authority within your organization is notified so each application’s security can be ensured.

Information assurance is necessary for your business to thrive in the present and in the future. From a well-trained staff to well-built and maintained applications, the elements making information assurance possible must be regularly maintained. The threat of cyberattack and information loss or breach is always looming. Are your four corners solid?