The (Social) Construction of Information Security

Abstract

While the philosophical foundations of information security have been unexamined, there is an implicit philosophy of what protection of information is. This philosophy is based on the notion of containment, taken from analogies with things that offer physical security (e.g., buildings, safes, fences). I argue that this implicit philosophy is unsatisfactory in the current age of increased connectivity, and provide an alternative foundation. I do so from a constructionist point of view, where the coevolution of social and technical mechanisms is seen as the source of the security of an information system, rather than rational design choices only. I employ the concept of causal insulation from system theory in order to give an account of the fundamental characteristics of information security research. This generates definitions that can be used for philosophically informed discussions on the protection of information in new systems.A growing proportion of computer science research is now devoted to what is called information security. In this subdiscipline the focus is on how to protect information systems from malicious users. This is quite different from research in other areas of computer science such as programming paradigms or software engineering methods, primarily because security is concerned with what systems should not do rather than what they should do. The philosophical basis of this research, however, has not received much attention until now. Although security-related societal implications of information systems, especially in the area of privacy (see, e.g., Nissenbaum 1998; Floridi 2005; Gutwirth and De Hert 2008), have been discussed extensively, the philosophical foundations of the scientific endeavour have been left largely unexamined. This oversight is not only problematic philosophically; it also makes it impossible to connect high-level privacy discussions with the possibilities the technology now offers.When computer scientists speak of privacy, they mean a special kind of information security, namely, confidentiality of personal information. But the repertoire of information security is much broader, as it covers integrity and availability of information next to confidentiality, and business, military, and government information next to personal information. For the computer scientist it does not matter what kind of information needs to be secured. However, for the policymaker, it does. Therefore, the technical solutions never speak of privacy as it is used at policy level, and policymakers never speak of information security as it is used in the technical domain.While the philosophical foundations of information security have been unexamined, there is an implicit philosophy 1 of protection of information based on the notion of containment, taken from analogies with things that offer physical security (e.g., buildings, safes, fences). Correspondingly, in such a philosophy, the asset to be protected needs to be separated from the environment by security boundaries such as a firewall. This fort...

Applying a Contingency Framework to Digital Forensic Processes in Cloud Based Acquisitions

“…Contingency theory also affects the initiation and adoption of change in organizations (Battilana & Casciaro, 2012). In information security, both external and internal forces shape what threatens and how to protect information systems (Pieters, 2011). Intertwined in the threat and protection landscape of information systems are people.…”

The Order Machine – The Ontology of Information Security

“…Nonetheless, despite those studies that focus on CIA as the objective of information security and on how they are achieved in practice, information security in and of itself -the question of what it is ontologically -has remained largely unexamined (cf. Pieters, 2011). In this paper, we examine the ontology of information security to depict what information security is and what it does or, rather, to depict what it is through what it does.…”

Reducing normative conflicts in information security

“…This can be seen as a process of alignment of security policies with organisational norms [11], in which the friction between norms and policies is minimised. In general, security requires minimisation of certain frictions and maximisation of others [14,31], of which policy alignment is a typical instance.…”