What Is Information Assurance?

The "Information Assurance" (IA) concept was first proposed by the US Department of Defense in the 1990s, and has been modified and improved many times, and has been widely recognized worldwide.

Information security

Right!

The "Information Assurance" (IA) concept was first proposed by the US Department of Defense in the 1990s, and has been modified and improved many times, and has been widely recognized worldwide.

Chinese name

Information security

Foreign name

informationassurance, IA

In its essence, information assurance is a protective act that guarantees the safe operation of information and information systems, and is a new development of information security in the information age. The object of information assurance is information and information systems that process, manage, store, and transmit information; the purpose is to adopt comprehensive methods such as technology and management to ensure that information and information systems have confidentiality, integrity, availability, certifiability, and undeniable And recoverability after an attack.

As human society enters the information age, information has become an important strategic resource. Information and information system security has become a key factor in national security, especially military security, in the 21st century. The U.S. military recognizes that while its military system is becoming more networked and more information-intensive, and it has produced huge military benefits, it must be accompanied by "negative effects" such as increased risk and loopholes. It has been reported that the US Department of Defense's annual losses due to external attacks on computer network systems and various information systems built on them can reach tens of millions or even hundreds of millions of dollars. What is more serious is that the US Department of Defense believes that external attacks on its computer systems have caused a large amount of important military information to be destroyed, stolen, and tampered with, and its trend is increasingly intensifying, posing a huge threat to its military security Threat. In order to respond to these threats and risks, and to improve its information and information system's ability to defend against various attacks and sabotage, in the early 1990s, the US military proposed "

Information security issues have always evolved along with the development of information technology, and have gone through three stages of early "communication security" (COMSEC), "information system security" (1NFOSEC), and the current "information security". Each stage is different in terms of the needs it meets, the goals it cares about, and the technology it develops, but the fundamental starting point is to protect the information and make it work for itself.

In the 1940s and 1950s, information security took communication confidentiality as the main body, and required the confidentiality of information. The information security requirements of this period basically came from the "communication confidentiality" requirements of the military and political command system. The main purpose was to make the information unavailable to the enemy even if it was intercepted. Therefore, its technology is mainly reflected in encryption and decryption equipment.

In the 1960s and 1970s, with the emergence of simple network systems composed of small-scale computers, the issues of confidentiality, integrity, and availability of multipoint transmission, processing, and storage in the network became the focus of attention; information interaction between computers requires People must take measures to protect information and information systems from being illegally accessed or modified during information storage, processing, and transmission. At the same time, they cannot refuse service requests from legitimate users. Their technological development is mainly reflected in access control. At this time, people started to "

In general, the scope of the information assurance concept is much broader than previous concepts of information security. From a conceptual point of view, information security previously emphasized "avoiding risks", that is, preventing and providing protection, and irreparable damage when damage occurred; while information security emphasized "risk management", that is, the comprehensive use of protection, detection, response and recovery Various measures, such as information, can ensure a certain level of availability, integrity, authenticity, confidentiality, and non-repudiation after an attack breaks through a certain layer of defense, and the damage can be repaired in time. Furthermore, the previous information security was usually a simple accumulation of single or multiple technical means, while information assurance was a comprehensive application of encryption, access control, firewall, secure routing and other technologies, with more emphasis on intrusion detection and disaster recovery technologies.

Information Assurance is Information Operations in Defense

Information warfare is an essential combat style for joint operations in the information age. The main purpose of U.S. military information operations is to protect the U.S. military's information and information systems, interfere with and destroy the enemy's information and information systems, so as to obtain and maintain information superiority, and effectively transform it into decision-making superiority, and ultimately provide joint forces with competitive advantages . In the 2006 edition of the US Army's "Joint Information Operations Doctrine," information operations include five major "

In the past 20 years, the high-tech development with information technology as the core has developed at an alarming rate, which has triggered a series of profound changes in the military field. The form of war has changed from mechanization to informatization. The military's combat methods and methods have also shown brand new face. In May 1997, the U.S. military formally established the idea of "transition" in the official documents for the first time, and proposed to "transform the U.S. forces for the future." It began to build a "flexible, network-centric, "Knowledge" of the army. As one of the main pillars of this transformation, information security has shown the following three significant characteristics while exerting its effectiveness.

Adopted a "defense in depth" strategy

In 1995, the United States Department of Defense discovered that its computer network system had been subjected to more than 7.25 million external attacks. At that time, the Department of Defense believed that its computer system defense capability was quite low, the detection probability of the attack was only 12%, and the response rate was less than 1%. This urgent situation caused the US military to attach great importance. In November 1996, an evaluation report on the defense capability of the Information Warfare Commission of the United States once again pointed out that there are many loopholes and weaknesses in the Department of Defense network and information system, and it will face more severe challenges in the future. Take special action to increase the Department's ability to respond to existing and emerging threats. " For this reason, in 1996, in the "Joint Vision 2010", the US military formally identified "information security" as an important component of information superiority capabilities. Under this guidance, the US Department of Defense has proposed the "Information Security Strategic Plan", which aims to build a dynamic, sustainable, and comprehensive information security mechanism. After that, the US Department of Defense proposed a "DefenseinDeplh" strategy based on a comprehensive consideration of technical feasibility, cost-effectiveness, and organizational mechanisms. The basic idea of "defense in depth" is to layer the information environment between the attacker and the target, and then "build" each layer a "barrier" composed of comprehensive measures such as technical means and management to form a continuous The multi-layered, multi-layer defense mechanism guarantees the security of user information and information systems, and eliminates the "gap" provided for attempts to attack the network.

The "defense in depth" strategy includes three categories, namely people, technology and operations. Among them, people refer to managers, operators, and users. The United States Department of Defense requires training and education to cultivate a sense of information security and ensure effective management. Technology refers to the technical framework and specific technical means and standards. Including technology certification and evaluation; operation refers to the monitoring and evaluation, detection, warning and recovery of information and information systems. In the "defense in depth" strategy, network infrastructure, computing environment, enclave borders, and supporting facilities are the four key protection levels identified by the US military. Enclave refers to the physical environment controlled by a single security mechanism, including user equipment, servers, routers, and the local area network formed by it. The boundary is connected through the local area network, adopts a single security policy, and does not consider physical location. Local Computing Equipment.

The U.S. military's information support capacity building was in a state of disorder for a time, and it was implemented independently by various services and departments, which could not be integrated and was inefficient. As early as 1992, the US Department of Defense had discussed the issue of strengthening information security construction at the Department of Defense level in the "21st Century Conception-Defense Information System Security Plan." With the information security situation becoming increasingly severe, in November 1997, the assistant defense minister in charge of C31 pointed out in the analysis report of the Management Process of the Information Defense Project of the Department of Defense that in view of the increasing complexity of the Department of Defense network system, the more difficult the information management In the future, only a small part of the current information security work is effective, and the priority development plan for information security must be determined as soon as possible to address the security threats facing the Department of Defense information systems and networks. At this point, the US Department of Defense has begun unified planning for information assurance capacity building across the entire defense field. On January 30, 1998, the then Assistant Secretary of Defense of C31 officially issued the "Information Defense Project Plan for Defense" (DIAP), and in February 1999 formulated a specific implementation plan and identified key construction tasks. With the continuous advancement of the US military's transformation, the US military's legal system on information security has also gradually been established and improved. After the "Information Security" directive (8500.1) was issued in October 2002 and the "Information Security" directive c8500.2 was issued in February 2003), the US Department of Defense consolidated all information security related directives into 8500 series directives as a guide to information security. Top-level documents for capacity building. At this point, the information security of the US military has begun to develop in a more standardized and consistent direction.

Attach great importance to implementation

In the process of implementing military transformation, the US military attaches great importance to the construction of an information security system with information security as its main body. In April 2003, the US Department of Defense released the "Transformation Planning Guide", which identified ensuring information and information system security as one of the six key operational goals. In 2004, the U.S. Department of Defense's Information Security Strategic Plan also clearly stated that the strategic mission of the U.S. military's information security construction is to "fully, deeply and dynamically protect the information and information systems of the Ministry of Defense so that it can be sustained and reliable Support the transformation of the Department of Defense ... ". The Army, Air Force and Air Force also identified information assurance as an important factor in developing transformation capabilities in their transformation roadmap, and implemented it in various areas of their transformation to support their successful achievement of expected goals. In 2006, the U.S. Department of Defense issued a new edition of the "Quarterly Defense Review", which once again clearly emphasized: "Information assurance" aimed at improving information and network security defense capabilities is closely integrated with transformational capacity building.