What *is* information security?
Eugene Howard Spafford · ACM SIGCSE Bulletin · 2004
Recent events have increasingly focused public attention on issues of information privacy, computer and network security, cybercrime and cyber terrorism. Yet despite all of this attention, there is some confusion about what is actually encompassed by those terms. There are some obvious components, such as cryptography and access control. However, the list of undisputed topics is not long or well-developed, and many questions arise as to whether a typical computer science department can offer all of the topics involved. That there are only a few universities that teach a comprehensive curriculum in these topics serves to illustrate the imprecise nature of the field. Many professionals have taken to describing it as "information security" or "information assurance" to distinguish that the focus is not on computers and networks, but on the information they hold and process.This talk will present a more comprehensive view of the area than simply within the confines of CS/CE. The speaker has been teaching information security for nearly 20 years and has developed a view that spans many traditional disciplines. The talk will present some of the reasons for that breadth of view, illustrated with examples taken from the recent CRA Grand Challenges Conference on Information Security. One conclusion from this talk is that getting good information security education widely implemented may not be simple, given current constraints and traditions within academia.