Understanding the new Information risks: The Requirement for a New Information Security Conceptual Framework

Abstract

If one were to ask CIOs about their corporate technology structure, their response would focus on apparent concerns derived from the management of numerous types of servers, network bandwidth, operating system currency, contract lifecycles, personnel cost run rates, the numbers of projects, investments envelopes, and so forth. Managing these issues might create a sense of well-being, that all is under control. However, if you asked questions relating to information structure, the response would be less detailed, and much less specific.

Notes

1. In the context of this article, an infoset is defined as the minimum sets of data required to move up a security classification. In this discussion, some infosets are classified as Public, Internal, Confidential and Highly Sensitive. A bit more discussion about this issue will be found later in the article.

2. http://europa.eu.int/smartapi/cgi/sga_doc?smartapi!celexapi!prod!CELEXnumdoc&lg=en&numdoc=31995L0046&model=guichett

3. Security Assertion Markup Language OASIS, definition 2.