Defining Information Security

Area of Science:

• Information Security
• Cybersecurity
• Organizational Behavior

Background:

• The traditional Confidentiality, Integrity, and Availability (CIA) definition of information security faces limitations.
• The CIA triad struggles to encompass 'soft issues' like human factors, organizational culture, and legal aspects.
• A need exists for a more inclusive definition applicable to diverse information security perspectives.

Purpose of the Study:

• To propose a novel definition of information security termed 'Appropriate Access'.
• To develop a definition that integrates both technical and 'soft' aspects of information security.
• To offer a versatile definition suitable for various analytical purposes, including breach analysis and organizational conflict studies.

Main Methods:

• Conceptual analysis and critique of existing information security definitions.
• Development of the 'Appropriate Access' definition based on identified shortcomings.
• Demonstration of the definition's applicability across different information security contexts.

Main Results:

• The 'Appropriate Access' definition provides clear demarcation and meaning for security states.
• It effectively bridges the gap between technical security issues and human/organizational ('soft') issues.
• The definition is shown to be superior to the CIA triad in handling contextual and normative security aspects.

Conclusions:

• The 'Appropriate Access' definition offers a more comprehensive and adaptable framework for information security.
• This new definition enhances the analysis of security breaches and conflicting organizational security attitudes.
• It provides a unified perspective for understanding information security in both technical and human-centric dimensions.