Information Risk Management, 2nd Edition

2 REVIEW OF INFORMATION SECURITY FUNDAMENTALS

Let us now take a brief look back at the fundamental concepts of information security, as it is these that will form the basis of the risk assessment process itself.

We shall then examine the means by which information is classified and labelled, and how the Plan-Do-Check-Act methodology may be used as a high-level process for information risk management.

It is a widely held belief that the three main pillars of information security are confidentiality, integrity and availability, often referred to simply as ‘CIA’. While this is essentially true, other factors also contribute to the overall scheme of things. Accountability, authenticity, non-repudiation and reliability are all contributing factors, ...