Which information security objective(s) could be put at risk if the alternative safeguards recommended by the FGDC guidelines are applied? Explain how the objective(s) is put at risk by the mitigation(s).
Reader Interactions
Comments
Leave a Reply
You must be logged in to post a comment.
To begin, the FISMA defines three security objectives for information and information systems as the following:
Confidentiality = “Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information…” [44 U.S.C., Sec. 3542]
A loss of confidentiality is the unauthorized disclosure of information.
Integrity = “Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity…” [44 U.S.C., Sec. 3542]
A loss of integrity is the unauthorized modification or destruction of information.
Availability = “Ensuring timely and reliable access to and use of information…” [44 U.S.C., SEC. 3542
A loss of availability is the disruption of access to or use of information or an information system.
Unfortunately, there are concerns that are not addressed by the FGDC guidelines regarding safeguard recommendations outlined in the “Guidelines for Providing Appropriate Access to Geospatial Data in Response to Security Concerns” reading. I would argue that all the security objectives (CIA) can be put at risk by the mitigations. To start with confidentiality, sharing sensitive information to downstream users without regulated restrictions other than hoping they respect the guidelines can be problematic because the other party may not treat PII with as much care since they are not bound by any responsibility. Also, I see the potential of compromising integrity in Step 10 (Change these data) because applying changes and/or removing valuable information from a document may result in loss of authenticity for the sake of security; for this reason, I believe in the importance of tracking the changes made to the document. Lastly, review of decisions made about the sensitivity of geospatial data can put availability at risk because it can lead to altering the access of such data that affects both the originating organization and downstream ones.
Elizabeth,
The guidelines provide a method for balancing security risks and the benefits of geospatial data dissemination. If safeguarding is justified, the guidelines help organizations select appropriate risk-based safeguards that provide access to geospatial data and still protect sensitive information content. I do see your point on how the all three security objectives can be applied.
Information security objectives that could be put at risk if the alternative mitigations are applied are:
INTEGRITY
“Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity…” [44 U.S.C., Sec. 3542]
A loss of integrity is the unauthorized modification or destruction of information.
According to the FGDC guidelines “Change of Data” relates closely to the Integrity of data and could put the risk level at high. For example, Incidents caused by undetected errors or vulnerabilities as a result of change (e.g. unforeseen effects of a change or a poorly managed change due to a lack of testing or improper change management practices) to e.g. software, IT systems and data.
AVAILABILITY
“Ensuring timely and reliable access to and use of information…” [44 U.S.C., SEC. 3542]
A loss of availability is the disruption of access to or use of information or an information system.
According to the FGDC guidelines “Restrict the Data” relates closely to the availability of the data and can put the risk level at high. For example, A lack of data can result in an inability to scale the service to meet business needs, system interruptions, degradation or the public might not have access to geospatial data.
Hi Shubham,
I agree with you that integrity and availability are both at risk if alternative mitigations are applied. I wonder though, how can an organization change information that needs to be safeguarded and maintain the data’s integrity and usefulness? As for availability, access to information and knowledge is viewed as a right in America and is attributed to the country’s success. I think it is important to find the right balance between what risk might be acceptable and safeguarding information that if misused — could have negative consequences.
Hi Shubhan,
I agree what you said. As for intergrity, I think that the modification of the information will damage the accuracy and authenticity of the information. Data changes that have not been tested lead to higher risks. Also, I think that restrictions on permissions will cause the loss of usability dramas and interruption of access.
Hey Shubham,
You make an interesting point. I agree that integrity and availability could be put at risk for these reasons, but I was curious why you don’t feel the same way for confidentiality?
The modification of the information may cause the destruction of the information or the authenticity of the information. For sensitive information, it is doubtful how this information can be found by private or public organizations. I think these private information should be protected before it is discovered. The government department’s information availability, that is, the level of information access authority should be reset instead of being easily obtained. Restricting permissions may lead to a higher level of risk.
Which information security objective(s) could be put at risk if the alternative safeguards recommended by the FGDC guidelines are applied? Explain how the objective(s) is put at risk by the mitigation(s).
I would say that all of the security objectives could be put at risk if the alternative safeguards are applied. The 3 objectives, confidentiality, integrity, and availability, are defined as followed.
Confidentiality = “Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information…” [44 U.S.C., Sec. 3542]
A loss of confidentiality is the unauthorized disclosure of information.
Integrity = “Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity…” [44 U.S.C., Sec. 3542]
A loss of integrity is the unauthorized modification or destruction of information.
Availability = “Ensuring timely and reliable access to and use of information…” [44 U.S.C., SEC. 3542
A loss of availability is the disruption of access to or use of information or an information system.
All 3 objectives are prone to human error. For example, An employee may disclose information about the organization, intentionally or unintentionally, which would be a loss of confidentiality. An employee may also destroy data, which would be the loss of integrity, Finally, an employee may damage software, which would be the loss of availability. Thus, all the objectives are at risk simply due to human nature.