Lesson 1: Foundations of Information Assurance and Security

Information assurance and security is the discipline of protecting information and the systems that store, process, and transmit it. In BSIT, this is not just a "special topic." It is part of responsible system design, network administration, systems analysis, database work, web development, and IT operations.

When we say information assurance, we are talking about keeping information trustworthy, available, and properly handled throughout its life cycle. When we say information security, we focus on protecting information and systems from unauthorized access, misuse, disruption, modification, or destruction.

A practical way to remember the heart of the subject is the CIA triad:

• Confidentiality means information is seen only by authorized people.
• Integrity means information remains accurate, complete, and unaltered unless a valid change is made.
• Availability means information and services are accessible when needed.

A registrar database is a good local example. Student grades should not be readable by random users, so confidentiality matters. Grades must not change without proper authorization, so integrity matters. During enrollment, the system should stay online and usable, so availability matters.

Modern organizations also care about these supporting ideas:

• Authenticity — proving that a user, message, or system is genuine.
• Accountability — making actions traceable to a user or process.
• Non-repudiation — preventing a sender or actor from denying an action they actually performed.
• Privacy — protecting personal and sensitive information from improper collection, use, or disclosure.

Security is not only about stopping hackers. It also addresses careless behavior, weak passwords, missing backups, poor network design, unpatched software, and weak policies. In other words, many security failures start with ordinary IT mistakes.

Before you can protect anything, you must know what is being protected and what can go wrong.

An asset is anything valuable to an organization. In IT, assets usually include:

• Data such as grades, payroll records, customer information, and source code
• Hardware such as servers, routers, laptops, and backup drives
• Software such as databases, ERP systems, web apps, and operating systems
• Services such as internet connectivity, email, cloud storage, and online enrollment
• People, processes, and reputation

A threat is a possible cause of harm. A vulnerability is a weakness that a threat can exploit. An attack is the actual attempt to exploit that weakness.

Here is a simple chain:

This leads to risk. In basic terms, risk is the chance that a threat will exploit a vulnerability and cause harm to an asset. Security work is therefore about reducing risk to an acceptable level, not magically removing all risk.

A useful class reminder is this:

No vulnerability, no exploit. No valuable asset, no meaningful loss. Security analysis connects both.

Organizations do not apply security controls randomly. They usually protect systems for business and mission reasons.

Common organizational security goals include:

• Protecting confidential records
• Maintaining continuous operations
• Complying with laws and regulations
• Preventing fraud and abuse
• Preserving customer trust and institutional reputation
• Recovering quickly from incidents

In a Philippine setting, think of a small hospital information system. It must protect patient data, prevent unauthorized edits, keep records available to doctors, and recover from brownouts, ransomware, or accidental deletion. Security is therefore both a technical and management concern.

Security also works best when it is proportional. A public school website announcing events does not need the same protection level as a payment gateway or student health record system. Good security means using the right controls for the right assets.