Confidentiality in Shared Centralized Data Processing Environments

Introduction

Information security relates to information assurance and refers to the preservation of three significant factors that fall under the CIA acronym: Confidentiality, Integrity, and Availability. Essentially, confidentiality means prevention of the unlawful release of information. Integrity means securing assets so that only authorized parties may modify data through authorized means. Availability denotes that critical data and services are accessible as needed to meet an organization's requirements.

ISO/IEC 17799 explains that "information security is the protection of information from a wide range of threats in order to ensure business continuity, minimize business risk, and maximize return on investments and business opportunities" (Ishandbook.bsewall.com, 2014).

Information is an indispensable asset for any organization or business. It takes numerous forms and plays a significant role in keeping data secure and safe from unauthorized parties. The primary concern of information security and information assurance is to safeguard information from countless threats and vulnerabilities. Organizations and businesses can achieve this through the implementation of an appropriate set of controls. To ensure proper management and handling of security issues in fulfilling business requirements and objectives, organizations must establish such controls effectively. Careful planning and comprehensive understanding are essential to recognizing and selecting the right controls.

Organizations and businesses need information security. This approach allows businesses to comply with state and federal laws while preventing damage to their reputations. In recent times, the use of personal computers and tablets in business has greatly increased. Various companies maintain and store their business information digitally on computers and online, using networks to establish communication and to share data with suppliers, customers, and other business associates.

Working within a tiered process, not all available information should be accessible for public viewing. Although the public appreciates a certain level of transparency in business operations, a lack of privacy creates problems for both companies and their customers. Hence, there is a need to maintain the confidentiality of business information. Implementation of appropriate information security policies and controls provides businesses with confidentiality and data protection.

The problem discussed in this work deals with balancing the many qualities that accompany processing data in a centralized and managed environment. These qualities include integrity, confidentiality, and availability.

The aim of this thesis is to examine the possibilities of designing a secure multi-partition, role-based centralized data processing environment. Shared centralized processing is a key component of modern data processing, as it provides an environment that multiple companies can utilize remotely to process large quantities of data in short periods.

Shared Centralized Data Processing Environment

The study addresses the following questions: How can information assurance assist businesses in data management? Why do businesses need protection of data and confidentiality? What existing theoretical frameworks provide suitable information assurance controls?

One of the major concerns of information assurance is consistency of security and reliability, as information must be kept confidential for each individual company. It is a significant challenge to design an information security scheme that safeguards individual companies' data.

For any security framework to achieve effectiveness, businesses must implement a risk assessment procedure. The overall process of addressing risk is a multi-step process. The Operational Risk Framework described below allows for further clarification of business continuity development, information security, and other functioning risk processes involving the identification and ranking of risk as well as the maintenance of a control environment. The framework has the following constituents:

Goal: The primary goal of Operational Risk is the protection of an organization's information and other critical assets. Objectives: To achieve this goal, organizations must ensure the Confidentiality, Integrity, and Availability of these assets. Resources: These objectives are reached through the utilization of people, processes, and technology. Method: These resources are organized and guided by a four-step process of continuous improvement consisting of assessing risks to the business, implementing controls to mitigate those risks, and monitoring the performance of these controls.

The limitations of such a study exist in the scarcity of information on these kinds of frameworks. Most related studies are in the healthcare domain. Furthermore, information assurance must tackle multiple aspects of security and a limitless number of threats. It is often difficult to fully implement an effective theoretical framework without constant updates and evaluations.

Centralizing data processing environments is challenging to undertake. It involves many complex processes. The continual necessity for updates and patches makes it a difficult task that is not only tedious but also involves multiple steps and methods. This is especially true in role-based environments.

Pal et al. (2013) discussed a foundation for runtime assessment in their research. Starting with metrics to observe and measure, their project developed a foundation for runtime assessment and tradeoff, including an assessment scheme, an innovative distributed tradeoff algorithm, and usability support. They instantiated the assessment and tradeoff framework within a security architecture, which underwent a final demonstration and evaluation phase in December 2012 (Pal et al., 2013).

This not only provides an interesting starting point for the development of a theoretical framework, but it also offers a clearer perspective on how things should be managed within a centralized data processing environment. When developing and implementing an effective Operational Risk program that safeguards information and other assets, the framework must allow for assurance of CIA (confidentiality, integrity, and availability) through the utilization of technology, processes, and people structured within a cycle of continuous improvement.

Risk management is essential for creating a functional environment that attempts to meet the strategic aims of the plan. Risk management plans provide a framework of operation that allows for the vetting of inherent dangers and errors within the system itself. The Operational Risk Management Process is such a tool, and it develops in a tiered process. The method existing within the outer ring of this process is the basis for managing operational risk and is founded on two basic principles.

First, risk management represents a sequential method with a strong foundation in managing what can be measured. This means that implementation, monitoring, and reporting of controls should continue until risks are properly identified. Security events cannot be effectively managed unless there is a clear and comprehensive understanding of the problem and its nature. Second, the framework exists as an ongoing process of improvement. Controls often fail, and no amount of preparation stops an inevitable security breach. In that case, minimizing immediate losses from a compromised event and learning from mistakes for future development are key to preventing an increase in such occurrences.

Confidentiality, Integrity, and Availability Triad

The main components for designing a role-based centralized data processing environment involve portal access and provisioning. Businesses wishing to implement a role-based platform to ensure information assurance within a centralized architecture must first implement a methodology that integrates identity management and safeguards sensitive information assets while augmenting overall business performance. Identity management suites are an effective way to integrate data from portals by granting businesses a sophisticated solution for access provisioning, management, and role management. Businesses need four key components: implementation and use of a provisioning platform, inclusion of a role management platform, creation of an access management platform, and, most importantly, a portal.

In a contemporary business environment, shared centralized data processing has become a critical requirement for modern data management. The centralized shared processing environment allows multiple companies to process large quantities of data remotely within a short period. In other words, the centralized data processing system is a strategy of performing data processing operations using a single computer or cluster of coupled computers through which all operations are performed via a central computer system. Klausm et al. (2007) argue that centralized processing operations began in the 1950s. Beginning in the 1960s, many companies used centralized computer systems to connect their headquarters and branch offices. Between the 1980s and 1990s, proliferation of local area networks (LANs) and personal computers enabled organizations to share data with employees within a physical location.

Rapid development of information technology has since led to the generation of high volumes of data, giving business agents the opportunity to process their data in real time and access shared repositories of information. Business organizations with similar services have taken advantage of the Internet and developments in information technology to implement centralized shared data processing. Transaction processing systems that have benefited from centralized shared data processing include hotel reservation, credit verification and authorization, electronic fund transfer, communication transaction routing, and loan payment processing.

One of the benefits of the centralized shared data processing system is its ability to provide data processing solutions for many organizations. The complexity of information requirements in a contemporary business environment drives an increasing number of organizations to implement shared and centralized data processing. In the centralized data processing environment, one machine controls access to files and updates, while the central system responds to organizational needs with reference to programs and data. In a purely centralized data processing model, all organizational data reside in a centralized data center, including shared files, domain authentication services, applications, and email. The benefits include lower operational costs, reduced administrative overhead, and less backup complexity.

Despite these benefits, a major concern is security. Achieving the CIA triad within a shared centralized data processing environment is increasingly challenging. Dongarra (2012) notes that a centralized shared computer system is a high-performing machine with shared-memory systems having multiple central processing units (CPUs). Choi, Chun, Kim et al. (2013) argue that data forgery is the major security concern of centralized shared data processing. Since all data exists in digital form, it can be created, manipulated, and modified in many ways. A sophisticated hacker can easily modify and forge data in transit, posing serious threats to data processing operations. Ernst & Young (2014) support this view by pointing out that a centralized shared data processing approach provides both opportunities and risks: while it can provide greater processing efficiency at lower costs, organizations face the risk of losing data if effective security is not implemented. Olivier (2010) further argues that implementing effective data privacy is one of the major challenges within a shared centralized data processing environment, and that an effective security system can be achieved by balancing privacy with confidentiality, integrity, and availability.

Several reasons motivated an evaluation of strategies for achieving confidentiality, integrity, and availability within a shared centralized data processing environment. First, the research results will enhance the current body of knowledge among business managers across the United States and globally. In the contemporary business environment, organizations increasingly face security threats, causing many to lose data worth billions of dollars. The findings will assist business managers in understanding the inherent security risks associated with centralized shared data processing systems and the strategies they can employ to enhance the CIA triad within their data centers. The research will also enhance governments' understanding of strategies to achieve confidentiality, integrity, and availability within centralized data processing environments, as an increasing number of government agencies use centralized data processing centers to share data. Additionally, the research will contribute to the academic community's understanding of the strategies business organizations can employ. In the United States, an increasing number of companies are using centralized data processing centers to lower IT investment costs. Despite the recognized benefits, there remains a scarcity of literature addressing strategies to achieve the CIA triad within shared centralized data processing environments. This study attempts to fill that gap.

Information security refers to the protection of significant organizational information assets. Confidentiality, integrity, and availability are the most crucial aspects of information security. Andress (2011) argues that the CIA triad is one of the oldest methods of information security and is used to achieve information assurance (IA). The CIA concepts are fundamental security objectives for centralized shared data processing systems and are designed to assist organizations in enhancing information assurance. It is important to understand that loss of the CIA triad can have both moderate and high impacts on business organizations. For example, loss of CIA can lead to loss of data, which can seriously impact organizational operations and assets. An adverse effect may include significant degradation of an organization's vision and mission, damage to organizational assets, and loss of major financial assets. Stallings (2011) supports this argument by pointing out that confidentiality, integrity, and availability form the heart of computer security.

Confidentiality encompasses the necessary steps taken by an organization to prevent the unlawful release of information assets and is synonymous with privacy. Haughn and Gibilisco (2014) define confidentiality as a set of rules that limits people's access to information. In the contemporary business environment, organizations take concrete measures to ensure that sensitive information does not reach the wrong people, while the right information reaches the right people. Ballad, Ballad, and Banks (2010) describe confidentiality as the strategy whereby information may only be copied by individuals who have the right to copy and access it. However, "a confidentiality breach occurs when an unauthorized individual gains access to sensitive information" (Ballad, Ballad, & Banks, 2010, p. 345). For example, a breach of confidentiality occurs when a laptop containing sensitive information is stolen. Stallings (2011) further includes the concept of privacy within confidentiality, referring to "assurance of an individual's control or influence over what information related to them may be collected and stored, and by whom and to whom that information may be disclosed" (Stallings, 2011, p. 4).

Integrity refers to the assurance that information is accurate and trustworthy, accessible only by authorized people. Andress (2011) describes integrity as the ability to prevent data from being changed in an undesirable or unauthorized manner. A breach of integrity has occurred when there is an unauthorized change or deletion of data. Version control is one integrity measure used to prevent erroneous changes. Organizations are required to safeguard data integrity by preventing unauthorized changes and by having the ability to reverse unauthorized data modifications. Modern operating systems such as Windows and Linux can prevent unauthorized data access, and most database applications can undo or reverse changes that have occurred due to unauthorized access (Andress, 2011).

Safeguarding data confidentiality requires specialized training to enhance understanding of risk factors and protection strategies. Training strategies include understanding strong password practices, and employees should be educated about social engineering threats that could lead them to divulge sensitive information to unauthorized individuals. Data encryption is another method of enhancing data confidentiality. Encryption changes data into unreadable form unless a security key is provided to decode the file, using two-factor authentication to ensure only authorized individuals with a decryption key can read transmitted information. Infosec Institute (2014) argues that encryption is an accepted strategy to protect data in transit. In 2007, 71% of all businesses in the United States used encryption to protect data in transit, while 53% used encryption to protect data at rest. Physical data protection requires storing data in locked cabinets and safeguarding them through cameras, access controls, and security guards (Ballad, Ballad, & Banks, 2010).

Availability is the final component of the CIA triad. Organizations must keep all hardware available for data storage and access through constant maintenance and system upgrades. Data backup — involving continuous copying of all data and storage in a remote or geographically isolated location — is one key strategy for enhancing availability. Organizations are also required to develop a comprehensive disaster recovery plan (DRP) (Haughn & Gibilisco, 2014). Using firewalls to block unauthorized access into the organizational network system is another availability strategy (Wadhwa, Hussain, & Rizvi, 2013).