From Wikipedia, the free encyclopedia

Information Assurance (IA) is the science of managing the risks to information assets. More specifically, IA practitioners seek to protect the confidentiality, integrity, and availability of data and their delivery systems, whether the data are in storage, processing, or transit, and whether threatened by malice or accident.

Information Assurance is closely related to information security and the terms are sometimes used interchangeably; however, IA’s broader connotation also includes reliability and emphasizes strategic risk management over tools and tactics. In addition to defending against malicious hackers and viruses, IA includes other corporate governance issues such as privacy, compliance, audits, business continuity, and disaster recovery. Further, while information security draws primarily from computer science, IA is interdisciplinary and draws from fraud examination, forensic science, military science, management science, systems engineering, security engineering, and criminology in addition to computer science. Therefore, IA is best thought of as a superset of information security.

The U.S. Government's National Information Assurance Glossary defines IA as:

Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and nonrepudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities.

Contents 1 Information Assurance process 2 IT assets 2.1 IA products 2.2 IA-enabled products 2.3 Other IT assets 3 See also 4 External links 4.1 Documentation 4.2 Organizations 4.3 Education and Certifications

The IA process typically begins with the enumeration and classification of the information technology (IT) assets to be protected. Next, the IA practitioner will perform a risk assessment. This assessment considers both the probability and impact of the undesired events. The probability component is subdivided into threats and vulnerabilities, and may be measured in terms of annualized rate of occurrence (ARO). The impact component is usually measured in terms of cost, specifically, single loss expectancy (SLE). The product of these values is the total risk, often measured in terms of annualized loss expectancy (ALE).

This can be expressed as:

Based on the risk assessment, the IA practitioner will develop a risk management plan. This plan proposes countermeasures that involve mitigating, eliminating, accepting, or transferring the risks, and considers prevention, detection, and response. A framework, such as ISO 17799, is typically utilized in designing this plan. Countermeasures may include tools such as firewalls and anti-virus software, policies and procedures such as regular backups and configuration hardening, training such as security awareness education, or restructuring such as forming an computer security incident response team (CSIRT) or computer emergency response team (CERT). The return on investment (ROI) of each countermeasure is carefully considered. Thus, the IA practitioner does not seek to eliminate all risks, were that possible, but to manage them in the most cost-effective way.

After the risk management plan is implemented, it is tested and evaluated, perhaps by means of formal audits. The IA process is cyclical; the risk assessment and risk management plan are continuously revised and improved based on data gleaned from evaluation.

Product or technology whose primary purpose is to provide the IA services of confidentiality, authentication, integrity, access control, non-repudiation of data; to correct known vulnerabilities; and/or provide layered defense against various categories of non-authorized or malicious penetrations of information systems or networks. Examples include such products as data/network encryptors, firewalls, and intrusion detection devices.

Product or technology whose primary role is not security, but which provides IA services as an associated feature of its intended operating capabilities. Examples include such products as security-enabled web browsers, screening routers, trusted operating systems, and security-enabled messaging systems.

All the other assets which include all elements of software and hardware that are found in the business environment.

• CIA triad
• ISO 17799

• IA References

• National Information Assurance Partnership (US)
• Information Assurance Advisory Council (UK)
• Information Assurance Technical Framework Forum (US)
• Information Assurance Technology Analysis Center, IATAC (US)

• US Centers of Academic Excellence in Information Assurance
• The SANS Institute’s Global Information Assurance Certification Program
• CERT: Survivability and Information Assurance Curriculum
• Book: Managing Information Assurance in Financial Services