Front cover - IBM Redbooks

1.3.2 Confidentiality
Confidentiality can be summed up as the following:
► Assurance that information is not disclosed to unauthorized persons,
processes, or devices. [INFOSEC-99]
► In regard to classified or sensitive information, the degree to which the
information has not been compromised, in that it has not been made available
or disclosed to unauthorized individuals, processes, or other entities
Specific to the IBM architecture, confidentiality can be said to protect sensitive
information from disclosure.
When it is stored locally, sensitive data can be protected by access controls or
encryption mechanisms. For network communication security, sensitive data
should be encrypted as it is transmitted from system to system.
There are specific ISO standards (8730, 8731, and 9564) relating to use of
cryptography for confidentiality and data integrity.
1.3.3 Identification and authentication
Identification and authentication (I&A) facilities verify the identity of individuals.
The basic function uniquely identifies users and programs, verifies these
identities, and assures individual accountability. In other words, identification and
authentication is required to ensure that users are associated with the proper
security attributes (for example, identity, groups, roles, security or integrity
levels).
The unambiguous identification of authorized users and the correct association
of security attributes with users and subjects is critical to the enforcement of the
intended security policies. The security services and facilities in this class deal
with determining and verifying the identity of users, determining their authority to
interact with key components of the IT Infrastructure, key components of the
computer system, or key information handled by software running on the
computer system (for instance, a document in a Notes database), based on the
correct association of security attributes for each authorized user.
These are all dependent upon correct identification and authentication of users in
order to be effective.
Authentication may take many forms, such as:
► Simple authentication, for an individual user of the computer system, which is
generally based on a user ID and a password. This is generally the weakest
form of authentication.
Chapter 1. Fundamentals of IT security 19