What is Security

What Security Is

At first glance, what security means may seem pretty obvious to you. However, I can say that for me personally, the idea of what security means in a company has altered and changed over time. So I think it's helpful for us to understand what security is and what it isn't before we get too in-depth into talking about all of these security principles. We'll define what security is, take a look at the security triad, which gives us a view into what affects security and how we define security, then talk about some threat examples of what can threaten the security of the company, and then talk about what impacts a lack of security can have on your company.

In many big businesses, there's a department that's dedicated to security. It's a security department, and their job is to make sure that the business is secure. But many small companies don't have the resources to dedicate a whole department to security, so a lot of times security will fall into the IT department or one of the technical departments. When it does that, we often think of security as being specific to just electronics and IT and infrastructure, but it does expand beyond those realms.

When we look up the definition of security on Google -- we just do a Google search for it -- it says free from danger or threat. There are a lot of things outside this technical realm that can affect the company as well, that put the company at risk, that put the company at danger or threat. So there needs to be a really broad look at security. Yes, we're looking at our networks and making sure our equipment is hardened, and making sure that when we are developing code, our code goes out functioning correctly. But it goes beyond that. Even competitors to the business are a threat to the business, and that also needs to be looked at. It may not fall necessarily to the IT department to look at some of those aspects, but a company does need to take the big picture with it.

Cyber Security as a Subset

Then we have this term cyber security, and that's probably the term you immediately jumped to when I initially said security: how to lock down your networks, how to protect networks, devices and data from unauthorized access or criminal use. That is definitely important and should definitely be a big key to what we're doing. But I just want to impress upon you that we also have security from the overall perspective. If this is talking about the data in electronic form, we need to make sure we're also thinking about when we get rid of data that's not in electronic form, that is in paper form. There are other aspects to security as well.

We also see it defined as the practice of ensuring confidentiality, integrity and availability of information. So this is a bigger scope than what we may traditionally think of as security. We're going to talk in depth about cyber security, but every once in a while we may also take that broader scope of security, and what security in general has when it comes to implementing security.

The Security Triad

Within the security community, we have this thing called the security triad. The security triad is a way to view what the responsibility of the security department, or of whoever is responsible for security within the company, is. It comes in three parts, hence the word triad: confidentiality, availability and integrity.

Let's think about it from a customer perspective. Let's say you're a company whose customers access some sort of web page or website. Availability would mean that it's up and running and they are able to get to that website. It can be really problematic if you are selling things online but that site goes down and you can no longer sell things online. That has an impact on the bottom line -- you can't sell things anymore, and some of those customers are lost forever. Some of those customers will come back, but some of the customers will never come back and buy your product. So availability is very important to the company, making sure that your networks are available and your resources are available.

The next thing we'll talk about is integrity. Integrity is that nothing is altered. Getting back to the website example, let's say a hacker compromises your website and they redirect your customers to another website, and now they're purchasing from somebody else. They may even think that they're purchasing from you, but now they're purchasing something from somebody else. That's the integrity of this site -- making sure the data doesn't change. In my example with the website, that the website doesn't change and hackers are not putting up the wrong information on your website. That data has an integrity to it.

Then there's confidentiality. Maybe your customers are getting online and they're purchasing something from your website, and now you have a breach, and the credit card information that users were entering into your site is now in the outside world. That's a breach of confidentiality. You had customer data and then it was exposed to the outside world when it wasn't supposed to be.

So within confidentiality, availability and integrity, we need to think about how we can create secure networks so we don't have a breach of confidentiality, we don't have a breach of availability, and we don't have a breach of integrity.

Threats to the Triad

So what could threaten confidentiality, availability and integrity? Many of us probably think of a hacker, which of course is true, because a hacker will try to affect each one of these depending on what type of hacker it is. That is problematic, but there are other threats to this as well.

An example of another threat is a fire in your data center. That could definitely affect the availability of that data, the availability of the website, the availability of whatever resource that you have. A fire, or an earthquake, or some sort of electrical issue could definitely affect this security triad.

Another thing is changes that happen on your network. Quite often, a lot more often, it's not a hacker that's breaking into my network -- it's that one of my employees has made a change on the network and it's changed the way things operate. That could definitely affect availability, and it can definitely affect confidentiality if there's some sort of security breach because of the change.

When we talk about security, we're also talking about a lot of processes that happen in the back end to make sure you have availability, confidentiality and integrity. One of those processes is an incident response plan. What are you going to do if there's an incident? Let's say availability has gone down -- our website has gone down. How do we respond to that? How do we get the necessary players that are going to fix the issue on board and start fixing the issue? An incident response plan won't stop a loss of availability. It won't make your systems more available in the sense that they can't go down, but once they do go down, it makes sure that that is short-lived and you get up and running very quickly. So those are some examples of how it really is all-encompassing, and there's a lot that goes into a full security program.

Impact of a Security Incident

When there is a security incident that causes a loss of availability, a loss of confidentiality or a loss of integrity, it can really impact your business, and it can impact it in many different ways. I'm going to list a few examples here, but these are just examples and the list is much longer than this.

One of the things it can do is impact your brand. Your company has a certain reputation out there, and if it's a good reputation and there's a security incident, it really can swing the other way, and you can have a lot of dissatisfied customers and really impact how they feel about your company.

You could have a loss of customers from that. They could say, "I'm not going to do business with you ever again," or they could write reviews that are negative, which other people will read, and then they're not going to be a customer of yours either. So it can be very impactful from that perspective.

If some sort of data got into the hands of a competitor, maybe you have a loss of a competitive advantage that you had. Maybe you had some sort of competitive advantage over other competitors, and then that information got out and now they start taking your ideas and utilizing them to promote their own businesses, and now you lose that competitive advantage.

There could be a loss of revenue from all of this. There could be costly legal actions, litigation that you have to go through to resolve the issue -- and that, I can tell you, is not fun at all.

And then there's also just the cost of notifying your customers. If there's some sort of breach of confidentiality, then you have to notify your customers of what got stolen, or where the breach was and what the breach looked like, and that can be very costly. So certainly a security breach of any kind is not a good thing and can cause a lot of headaches.