The 3 Pillars of Information Security

Information security is dynamic and complex to the point that it's easy to get overwhelmed by the details and lose track of the real issues. I find it valuable to periodically relate whatever task I'm working on back to the three pillars of information security: confidentiality, integrity, and availability. (Actually, there's a fourth pillar, but Windows IT security professionals currently don't deal with it much. See the Web-exclusive sidebar "The Fourth Pillar of Nonrepudiation," http://www .windowsitpro.com/windowssecurity, InstantDoc ID 46251.) Every requirement you try to meet ultimately boils down to one of these three pillars, and every threat you try to address ultimately threatens one of them. Such sanity checks help keep my efforts on track and help me avoid missing crucial details. Each detail is important because, in security, you're only as strong as the weakest link in the chain. Let's look at how confidentiality, integrity, and availability relate to a typical Windows-centric network in a small-to-midsized business (SMB). . . .