What "computer security" actually says

The definition has two halves, and most answers only give one

The standard definition of computer security — the one in NISTIR 7298, the US glossary of key information security terms — says that computer security is the protection given to an automated information system's resources in order to preserve the integrity, availability and confidentiality of those resources.

Read that twice, because it is two claims joined by in order to, and an exam answer that gives only the second half has given away half the marks. The second half is the famous part: the CIA triad, the three objectives. The first half is the resources clause, and it enumerates what is in scope: hardware, software, firmware, information and data, and telecommunications. Security is not a property of data alone. A switch's firmware, a fibre run between two buildings and a licensed grading application are all resources, all in scope, and all attackable.

So when the paper says define computer security, the answer has a shape: name the resources, then name the three objectives, then say what a loss of each one is.

• Loss of confidentiality is unauthorized disclosure.
• Loss of integrity is unauthorized modification or destruction.
• Loss of availability is disruption of access to, or use of, a system or its information.

Each objective has an internal split, and the splits are examinable

Confidentiality is two things wearing one name.

• Data confidentiality — private or confidential information is not made available or disclosed to unauthorized individuals.
• Privacy — individuals control or influence what information about them is collected and stored, and by whom and to whom it may be disclosed.

The difference is whose decision it is. Data confidentiality is a property of the system's behaviour: the file did not leak. Privacy is a property of the arrangement between the institution and the person: they were told what would be collected, and they had a say in who sees it. A system can be perfect at the first and still fail the second, and a great deal of privacy law exists precisely because those two came apart.

Integrity is also two things.

• Data integrity — information and programs are changed only in a specified and authorized manner.
• System integrity — the system performs its intended function unimpaired, free from deliberate or inadvertent unauthorized manipulation.

Again the difference is what is being talked about. Data integrity is about the bytes; system integrity is about the machine's behaviour. This is the split people forget, and forgetting it makes a whole class of incidents unclassifiable — the ones where nothing in the database is wrong but the system has quietly acquired a function nobody authorised.

Availability is the simple one: the system works promptly, and service is not denied to authorized users.

Worked example — Northreach Open University, clause by clause

Northreach Open University is an online institution. Its student records system holds enrolments, assessment marks and final transcripts for forty thousand distance learners. Walk the definition across it.

The resources clause first. What is in scope?

• Hardware — the two database servers in the campus machine room, and the backup appliance they replicate to overnight.
• Software — the records application, the reporting service the registrar uses at term end, and the database engine underneath both.
• Firmware — the boot firmware of those servers and of the top-of-rack switch. Not glamorous, and not patchable on the same cycle as the application, which is exactly why it is named separately.
• Information and data — the enrolment rows, the marks, the transcripts, and the audit log that records who read what.
• Telecommunications — the link from the machine room to the campus edge, and the encrypted tunnel over which markers submit grades from home.

Now the three objectives, against those resources.

Confidentiality. A transcript must reach the student who owns it and nobody else. That is data confidentiality. Separately, Northreach publishes what it collects about applicants, retains it for a stated period, and lets an applicant see and correct their own record. That is privacy. Two different obligations, two different failure modes: a misconfigured export leaks transcripts (data confidentiality); silently selling the applicant list to a recruiter breaks the second while the first stays perfectly intact.

Integrity. A mark posted by a marker must appear in the transcript exactly as entered, once. That is data integrity. And the grading service must do only what grading services do — so when a maintenance account is used to install a scheduled job that copies the marks table to an external host every Sunday, system integrity has been lost even if every mark in the table is still correct. Nothing was modified; the system acquired a function.

Availability. At 23:50 on submission night, forty thousand learners want the upload endpoint to answer. A four-hour outage that morning would have been an inconvenience; the same four hours across the deadline is a different event entirely. Note that availability is the objective whose impact is most obviously a function of when.

Now do it yourself. Take the university's payroll system and name its resources clause — the hardware, software, firmware, data and telecommunications it must protect — before you look at anything else. Then write the whole definition, both halves, from memory.