Information security encompasses three core principles: confidentiality, integrity, and availability. Within software contexts, these concepts apply specifically to protecting software components and applications.
The Three Pillars
Confidentiality defines who accesses information and how it can be used. Systems should enforce rules preventing unauthorized data access unless explicitly permitted by users.
Integrity ensures data accuracy across time. Systems naturally have brief periods of inconsistency during transactions, but frequent or large accuracy issues undermine user trust.
Availability means the system performs its intended functions when needed—not necessarily 24/7, but reliably during expected usage periods.
Sources of Weakness
Applications become vulnerable through two mechanisms: architectural flaws and software bugs. Architectural weaknesses (like improper database protection) pervade the entire product, while bugs stem from coding errors.
Risk Management
Vulnerabilities represent system weaknesses. Organizations handle identified risks through four approaches: remediation (fixing issues), mitigation (adding protective workarounds), risk transfer, or acceptance. Controls can be preventative, detective, or corrective.
Post-Deployment Responsibilities
Security extends beyond deployment through logging, monitoring, disaster recovery, and incident response protocols—essential for maintaining application security throughout its lifecycle.