The Committee on National Security Systems (CNSS) defines information security as the
protection of information and its critical elements, including the systems and hardware that
use, store, and transmit that information.12 Figure 1-3 shows that information security
includes the broad areas of information security management, computer and data security,
and network security. The CNSS model of information security evolved from a concept developed by the computer security industry called the C.I.A. triangle. The C.I.A. triangle has been
the industry standard for computer security since the development of the mainframe. It is
based on the three characteristics of information that give it value to organizations: confidentiality, integrity, and availability. The security of these three characteristics of information is as
important today as it has always been, but the C.I.A. triangle model no longer adequately
addresses the constantly changing environment. The threats to the confidentiality, integrity,
and availability of information have evolved into a vast collection of events, including accidental or intentional damage, destruction, theft, unintended or unauthorized modification, or
other misuse from human or nonhuman threats. This new environment of many constantly
evolving threats has prompted the development of a more robust model that addresses
the complexities of the current information security environment. The expanded model consists of a list of critical characteristics of information, which are described in the next