22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

changed for a interest-fee loan (note the lack of a time limit). In the business<br />

world, where the data on a Web site is increasingly taken to be the same as<br />

printed works on paper (as in a newspaper or trade periodical), this could require<br />

the company to offer such a thing or face stiff penalties.<br />

1.3 Computer security services<br />

Now that an overview of information classification has been offered, as well as a<br />

definition of sensitive information, it is possible to define the services that enable<br />

this information to be protected.<br />

The following definitions, which are used throughout this redbook, can be best<br />

explained using the <strong>IBM</strong> Security Architecture, which is based on the ISO<br />

Security Framework (7498-2).<br />

The <strong>IBM</strong> Security Architecture is a model for integrating security services,<br />

mechanisms, objects, and management functions across multiple hardware and<br />

software platforms and networks. The architecture supports the strategy for<br />

providing end-to-end protection of applications and information within an<br />

organization.<br />

The descriptions of these security services are drawn from the “Enterprise-Wide<br />

Security Architecture and Solutions Presentation Guide” (SG24-4579), which is<br />

available online by referencing the <strong>IBM</strong> redbook site. A PDF version can be<br />

downloaded via the following URL:<br />

http://publib-b.boulder.ibm.com/<strong>Redbooks</strong>.nsf/RedbookAbstracts/sg244579.html<br />

The computer security services can be categorized by their ability to provide:<br />

► Data integrity (preventing information tampering)<br />

► Confidentiality (keeping things secret)<br />

► Identification and authentication (knowing who you are dealing with)<br />

► Access control (controlling who can access and do things to information)<br />

► Non-repudiation (preventing people from disavowing things they have said or<br />

written)<br />

Keep in mind that the categories are not exclusive; for example, you cannot<br />

implement access control without also addressing questions of authentication<br />

and data integrity.<br />

Chapter 1. Fundamentals of IT security 17

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!