Security Terminology

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Security can be considered as the problem of achieving a goal, given an adversary.

There are three ‘classical’ goals of security: confidentiality, integrity, availability. Today, perhaps authenticity can be considered the most important.

A principal is an entity that participates in a security system, say a subject, a person, a role, or a piece of equipment.

Identity is a correspondence between the names of two principal: ‘Bob doing the dishes’ and ‘Bob mowing the lawn’.

Trust is meaningful only in the context of a given security model: a trusted entity is one which, were it to fail, would break the security model.

Secrecy is the effect of a mechanism that limits the number of principals with access to information.

Confidentiality is an obligation to protect others’ secrets.

Privacy is the ability, and/or right, to protect one’s own personal secrets. Privacy concerns individuals and families, rather than legal entities like corporations. In other words privacy is secrecy for the benefit of the individual, while confidentiality is secrecy for the benefit of an organization.

Integrity is no change of state.

Authenticity has an academic definition ‘integrity plus freshness’, as well as a military definition: ‘identity of principals and the orders they give’.