Information security

It has been suggested that Information assurance be merged into this article. (Discuss) Proposed since November 2024.

Information security is the practice of protecting information by mitigating information risks. It is part of information risk management.^[1] It typically involves preventing or reducing the probability of unauthorized or inappropriate access to data or the unlawful use, disclosure, disruption, deletion, corruption, modification, inspection, recording, or devaluation of information. It also involves actions intended to reduce the adverse impacts of such incidents. Protected information may take any form, e.g., electronic or physical, tangible (e.g., paperwork), or intangible (e.g., knowledge).^[2][3] Information security's primary focus is the balanced protection of data confidentiality, integrity, and availability (also known as the 'CIA' triad)^[4] while maintaining a focus on efficient policy implementation, all without hampering organization productivity.^[5] This is largely achieved through a structured risk management process.^[6]

To standardize this discipline, academics and professionals collaborate to offer guidance, policies, and industry standards on passwords, antivirus software, firewalls, encryption software, legal liability, security awareness and training, and so forth.^[7] This standardization may be further driven by a wide variety of laws and regulations that affect how data is accessed, processed, stored, transferred, and destroyed.^[8]

While paper-based business operations are still prevalent, requiring their own set of information security practices, enterprise digital initiatives are increasingly being emphasized,^[9][10] with information assurance now typically being dealt with by information technology (IT) security specialists. These specialists apply information security to technology (most often some form of computer system).

IT security specialists are almost always found in any major enterprise/establishment due to the nature and value of the data within larger businesses.^[11] They are responsible for keeping all of the technology within the company secure from malicious attacks that often attempt to acquire critical private information or gain control of the internal systems.^[12][13]

There are many specialist roles in Information Security including securing networks and allied infrastructure, securing applications and databases, security testing, information systems auditing, business continuity planning, electronic record discovery, and digital forensics.^[14]