Information security, commonly abbreviated as InfoSec, is the discipline of protecting information and information systems against unauthorised access, use, disclosure, disruption, modification or destruction. Its central concern is the security of information regardless of the medium in which that information exists. Information can be digital, printed, handwritten, spoken, photographed or stored in another physical or logical form, so information security is broader than cybersecurity, which concentrates more specifically on digital and networked environments.
The traditional foundation of information security is the CIA triad: confidentiality, integrity and availability. Confidentiality means information is accessible only to authorised people or systems; integrity means information remains accurate, complete and protected from unauthorised alteration; and availability means authorised users can obtain information and services when required. Other properties, including authenticity, accountability, non-repudiation and privacy, may also be important depending on the system and threat model. Information security therefore combines technology with policies, procedures, physical safeguards, personnel controls, governance and risk management.
Confidentiality is maintained through mechanisms such as access control, encryption, authentication, classification and appropriate handling procedures. Integrity can be supported through hashes, message authentication codes, digital signatures, version controls, change-management processes and audit trails. Availability can depend on redundancy, resilient architecture, backups, disaster recovery, capacity management, fault tolerance and protection against denial-of-service conditions. These properties are interconnected rather than completely independent.
For example, a system that is highly confidential but permanently unavailable may fail its operational purpose, while a system that is available but allows unauthorised modification cannot reliably provide trustworthy information. Information security therefore seeks an appropriate balance based on the information's value, sensitivity, operational requirements and risk. Controls are often selected after identifying information assets, assessing threats and vulnerabilities and determining the consequences of compromise. The appropriate level of protection for a public document can differ substantially from that required for confidential financial records, authentication credentials, intellectual property or safety-critical information.
Information security includes administrative, technical and physical controls. Administrative controls include security policies, risk assessments, security governance, employee screening where appropriate, acceptable-use rules, information-classification policies, supplier requirements and incident-response procedures. Technical controls include authentication systems, encryption, firewalls, endpoint security, logging, access-control mechanisms, vulnerability management and data-loss prevention. Physical controls include locks, access badges, secure storage, surveillance, environmental controls and protection against theft or damage. The three categories can overlap because a single security objective often requires multiple types of control.
For example, protecting confidential paper records may require a policy defining their classification, locked storage limiting physical access and procedures determining how records are securely destroyed. Protecting a cloud database may similarly require organisational policies, identity controls, encryption, logging and contractual requirements for the cloud provider. Information security is therefore best understood as a system of complementary controls rather than as a purely technological function.
Risk management is central to information security because no organisation can protect every information asset against every conceivable threat with unlimited resources. A typical risk-management process identifies assets and their owners, considers threats and vulnerabilities, evaluates likelihood and potential impact, examines existing controls and determines whether additional treatment is justified. Risk can arise from malicious activity, accidents, technical failures, natural disasters, supplier failures, process weaknesses and human error.
Information classification helps organisations prioritise protection by identifying categories such as public, internal, confidential or highly restricted information, although exact classifications vary between organisations. Data retention and disposal are also important because information that no longer has a legitimate purpose can create unnecessary exposure. Business continuity and disaster recovery address the consequences of incidents affecting information availability. Security governance then establishes who is responsible for decisions, how policies are enforced, how exceptions are handled and how security performance is evaluated.
Information security has a long history predating modern computers. Organisations have always needed to control access to sensitive records, protect communications, maintain trustworthy records and preserve important documents. The arrival of computers introduced new risks involving automated processing, databases, removable media and electronic communication. Network connectivity subsequently expanded the threat landscape by making systems accessible across larger and more complex environments.
The development of formal security standards and management frameworks helped organisations structure information-security programmes around risk, governance and continuous improvement. International standards such as the ISO/IEC 27001 family provide widely used approaches for information-security management systems, while other frameworks address specific sectors or security objectives. The terminology has also evolved as cybersecurity became a prominent field. Contemporary organisations commonly use both InfoSec and cybersecurity teams, sometimes with overlapping responsibilities. The distinction is conceptual rather than absolute, with information security generally covering the broader protection of information and cybersecurity focusing more narrowly on digital threats and connected systems.
Information security differs from privacy, although the two disciplines frequently overlap. Security asks whether information and systems are adequately protected against unauthorised access, modification, loss and disruption. Privacy concerns how information about identifiable or identifiable people is collected, processed, used, shared, retained and otherwise handled in accordance with applicable rights and requirements. Strong security can help protect privacy, but an organisation could securely process personal information in a way that is still inappropriate under a privacy regime.
Conversely, privacy requirements can influence security architecture by requiring appropriate safeguards for personal information. Information security also differs from data security in emphasis. Data security concentrates on protecting data itself, whereas information security commonly encompasses data plus the people, processes, systems and physical environments that support information handling. Cybersecurity overlaps substantially with information security but usually focuses more specifically on digital and network-connected threats. Understanding these distinctions helps organisations assign responsibilities and avoid assuming that a single security programme automatically addresses every privacy, governance or compliance obligation.
Common information-security controls include least privilege, separation of duties, authentication, authorisation, encryption, secure backups, audit logging, change management and security monitoring. Least privilege limits users and processes to the permissions necessary for their legitimate functions, reducing the consequences of compromised accounts. Separation of duties prevents one individual from having excessive control over sensitive processes by distributing responsibilities. Authentication verifies identity, while authorisation determines what an authenticated entity may access or perform.
Logging creates records that can support detection, investigation and accountability, although logs themselves require appropriate protection. Backups support availability and recovery, but they must also be protected because attackers increasingly target backup systems during extortion incidents. Security testing, vulnerability assessments and audits can identify weaknesses, but passing an audit does not necessarily mean that an organisation is immune to attacks. Effective information security therefore requires continuous evaluation of whether controls operate as intended under realistic conditions.
The significance of information security extends beyond preventing data breaches. Reliable information is essential for business operations, financial transactions, healthcare, public administration, scientific research and many other activities. If information is manipulated, decision-makers may act on false records; if information becomes unavailable, critical processes may stop; if confidential information is disclosed, individuals or organisations may suffer harm. Information security consequently supports trust in information systems and organisational processes.
It also contributes to resilience by ensuring that important information can be recovered after incidents and that critical operations can continue under adverse conditions. Security responsibilities may be distributed among executives, security specialists, system administrators, developers, employees, suppliers and third-party service providers. Modern programmes increasingly incorporate secure development, cloud-security governance, supply-chain risk management and continuous monitoring because information frequently crosses organisational boundaries. The fundamental principle remains that information should be protected according to its value, sensitivity, required integrity and availability, using proportionate controls based on identified risks rather than relying on a single security technology.
