As I describe myself in terms of my information security background, I notice that I have been using the terms information security and information assurance interchangeably. This became even more evident to me this morning as I sat in an information assurance meeting where I again began to see how information assurance truly is a separate entity apart from information security. (Maybe I should have been aware of this fact but I’m sure there are others out there that have had the “wool pulled over their eyes” for quite some time. Plus, the differentiation and/or definitions may be determined by the workplace/company culture.)
This is my attempt at uncovering this “mystery”. Throughout my Google research, I see that there have been plenty of attempts to extrapolate the differences. I’m not going to write a long detailed dissertation on the subject –I just want to point out the differences and get opinions so that we can all gain awareness and adjust the terminology if necessary!
Wikipedia defines “Information Security” as:
…protecting information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction.
My definition is that information security is the method of protecting data while ensuring confidentiality, integrity, and availability are in place. Of course there are administrative and physical methods, but I believe that a larger portion is TECHNICAL.
A great definition that I found of “Information Assurance” is from the IT Unified Compliance Framework (UCF). Their definition of Information Assurance is the following:
Information assurance is about defining rules for maintaining information privacy, protecting information soundness, and ensuring information accessibility by mandating that someone (or multiple people) are held accountable that organizational policies, standards, and procedures are created to match the mandatory regulatory controls, and are properly paired to the information systems within the organization.
For me, information assurance is ensuring that systems are in compliance to established governing POLICY. That’s it, plain and simple.
Based on those definitions, it appears that basically it comes down to TECHNICAL SECURITY (information security) versus GOVERNING SECURITY POLICY (information assurance).
What do you think?
