For people responsible for the security of computer systems the main goal should be to ensure safety
of data stored in those systems.
Previous policies assume that we can protect data and secure computers even if the computers are far
from the source of the data.
For instance if you have the database server that is connected to 400 computers you cannot guarantee
its security by setting up a firewall on each of the machines.
In the real world nobody would protect information like that.
For example nobody would try to secure a very expensive painting.
Say the Mona Lisa by setting up barbed wire entanglements half a mile before the painting the protection
is focused on the painting itself.
We should employ a similar model of thinking with regards to data security
previously we have defined data security with regards to several categories.
The first one was the level of access which unauthorized users have to confidential data.
It is represented on the slide by the arrow pointing out of the operating system which shows datalink
How can you control data confidentiality
file access control is the most obvious solution.
This means to grant access permission to read or write files and folders and other solution is data
encryption this solution is more reliable because it works independently of external mechanisms.
If a piece of data is encrypted it stays encrypted even while the system shuts down.
This is not so with file access control lists.
Which provide protection only until shutdown.
It is problematic to strike a balance between the right amount of security and wide availability of
data.
The more effective the security the harder it is to read the data.
More effective measures of security require the user to confirm their identity by frequent and complicated
identity verification procedures.
Confidential data security always comes at the price and the price is usually data availability.
The protection of data integrity usually entails more than just purely technological solutions.
File signatures do not guarantee that the file will not be modified.
Here again security policy which we will discuss in detail later on is essential.
As is the case with data confidentiality integrity protection affects data availability.
The more we try to secure data integrity the harder it is not only to modify it but also read the data
data availability is the third aspect of data security.
It is represented on the chart by the no entry sign.
One of the goals of data security is to provide the highest level of data availability possible.
We have already mentioned that availability can be achieved by professional technologies such as high
availability clusters or data replication strategies.
Of course one 100 percent availability is by definition unachievable.