HOW TO INCREASE THE INFORMATION ASSURANCE IN THE INFORMATION AGE LTC Artur SOSIN* *Ministry of Defence/Republic of Moldova The competitive world we live in today is characterized by an environment where the advancement of technology has increased the number of complex vulnerabilities and sophisticated attacks. Organizations around the globe are facing now the same challenges of implementing data protection and securing information assurance. The purpose of this paper is to prove that Information Assurance has become one of the most important tools in creating and maintaining a competitive advantage in today’s competitive and global marketplace. This paper also presents the relationship between information assurance and cybersecurity, and their connection with confidentiality, integrity, availability (CIA) triad. Furthermore, assuring information and providing security is a life cycle process which needs a comprehensive understanding, skills, and experience in order to protect today’s risk management challenges. The author concludes the paper with the importance of information assurance policies which are the fundamental guidelines for protecting information assets and fulfilling information assurance objectives of an organization. Key words: Information Assurance, Cybersecurity, Confidentiality, Integrity, Availability, Risk Management, Policies. environment and electronic war give us less 1. INTRODUCTION expected and more unexpected. In short, the transformation from industrial The competitive world we live in today is to information is a test for all of us, and even if characterized by an environment where the we pass it, this does not mean that we have information is progressively interconnected and been well prepared. This is the reason why, at the same time more independent. nowadays, people are more concerned about Globalization has become part of every domain new threats such as data security and in which the world operates such as economic, information assurance. It is difficult sometimes social, and technological infrastructure. Behind to make a distinction between information the globalization is the transformation of security and information assurance. information technology which has become an important part of an organization’s global business strategy. Today’s interconnected 2. INFORMATION ASSURANCE world is full of uncertainty which allows CONCEPTS AND PRINCIPLES transferring the information across the borders through cyberspace. At this moment, we are in a phase of 2.1. What is Information Assurance? transition, a world which is moving from the Industrial Age to the Information Age. In other Information assurance has many words, we are changing from 3D hyper- definitions or interpretations. According to integration technology architecture such as Department of Defense Information Assurance future technology research in computer, Certification and Accreditation Program nanotech and biotech to a 3C (connected, (DIACAP) Information Assurance is defined contested and complex) hyper world. as “measures that protect and defend Unfortunately, today’s sophisticated information and information systems by 45 ensuring their availability, integrity, (technology, policy, and people); and five authentication, confidentiality, and non- basic services (availability, integrity, repudiation. This includes providing for authentication, confidentiality, and restoration of information systems by nonrepudiation), as shown in Fig. 1. [3] incorporating protection, detection, and According to these definitions, information reaction capabilities.” [1] Information assurance has a much broader view than only Assurance Handbook has the following secure the information because encompasses definition; “Information Assurance is the all the components of information security overarching approach for identifying, under the integration of protection information understanding, and managing risk through an based on confidentiality, integrity, availability, organization’s use of information and non-repudiation, and authentication which are information systems.” [2]. The Maconachy- the five main components of information Schou-Ragsdale (MSR) model of information assurance. Furthermore, information assurance assurance characterized three states of includes all information an organization can information (storage, transmission, and transmit, store, and process. processing); three essential countermeasures Fig.1 MSR Model information security, information protection, 2.2. Information Assurance and and cybersecurity. Information security is a Subdomains subdomain of information assurance and focuses on the CIA triad: confidentiality, In addition, there are three main integrity, and availability, as shown in Fig. 2. subdomains of information assurance; 46 social security number, and other types of data if there is no encryption of information. This is why only authorized people who have the equivalent level of secrecy must have access to folders, and permission to access this type of information. Furthermore, in order to protect data and information every organization has to have all the information about the administrators who are in charge of their security control and must be monitored also. Information must always be accessed by the correct users in order to be Fig.2 CIA Triad secure. However, even if the information is well secured but there is no authenticity that In the same context, information security is can create another problem. responsible for all information an organization Another fundamental component of is storing and transmitting, electronic or paper information security is integrity. It is about format. As information assurance, information making sure that data has not been modified or security is responsible for both domains: changed. Authentication comes with “trust” information protection and cybersecurity. because it is very important to trust the person Information protection has the role of with whom you are interacting with. In other protecting the integrity and confidentiality of words, only by joining together integrity and information by using a diversity of means such authentication we will get to the level of as monitoring information classification, authenticity. For example, if a database information categorization, and all the follows rules such data integrity, the database strategies. [4] Moreover, from other point of will increase performance, stability, accuracy, view, information protection has to be in and will not allow entering data in an incorrect charge of sensitive information such as format in database. personal information and information related The last part of the triangle is availability. to person’s health. This part describes the restriction and For example, Central Intelligence Agency limitation of using data, and the access to the (CIA) of the United States is focusing on this device must be available only with the given “triad” when it needs to put into place a new permission by the authorized administrators. security control policy into computer The access to the information must be environment. [5] This triad facilitate the restricted, or available only with the understanding of Information Technology (IT) permission and approval of the authorized Governance to ensure the efficiency and people. These attacks can easily damage the effectiveness of information technology in whole system by shutting down the system. making possible that the organizations achieve This is why security policies must be put into their goals and produce measurable results place in order to remediate these unwanted toward accomplishing their strategies. The attacks before the event happens to help keep Figure 2 shows how CIA is represented by information safe and secure. these three pylons that are the security policy core fundamentals. 2.3. Information Assurance and Every component has its own significance, Cybersecurity because an organization cannot achieve success if one of these is not fully integrated. The twenty-first century has become an Confidentiality is very important nowadays interconnected corporate IT system for because it is very easy for hackers to obtain managing and distributed computing which private data and information such as birth date, provided the possibility to work from anywhere around the globe, and has created a 47 new era of vulnerabilities. [6] This is the test, and should not be accessed by the reason why cyber crimes cannot be controlled receptionist. [10] and the cyber risk is the newest indicator of an For this reason information assurance out of control world. [7] Despite the fact that becomes one of the most important issues and big companies around the globe spend every must be encrypted before transmission from year millions of dollars in order to secure their end-to-end. Today anyone can start a computer information assurance, the next generation of and can access all the files from the hard drive. cyber risk has the potential to have a negative Furthermore, after gaining access many impact on their data base and network systems. attackers will try to escalate the system in The main goal of cybersecurity is to protect order to become the administrator of the electronic information systems and networks computer. For example, in September 2014 from being attacked by threats and Home Depot was one of the targets of such an vulnerabilities. Organizations start paying attack which give the attackers the advantage more attention to cybersecurity domain to discover of 53 million