Security services [provide] capabilities and mechanisms
to protect sensitive information and treatments in the information system.
The appropriate level of protection is determined based upon the value of
the information to the application end-users and the perception of threats
to it. These services include the following:
- ? Identification/authentication service confirms the identities of requesters
for use of information system resources. In addition, authentication can
apply to providers of data. The authentication service may occur at the
initiation of a session or during a session.
- Access control
service prevents the unauthorized use of information system resources. This
service also prevents the use of a resource in an unauthorized way. This
service may be applied to various aspects of access to a resource (e.g.,
access to communications to the resource, the reading, writing, or deletion
of an information/data resource, the execution of a processing resource)
or to all accesses to a resource.
- Data integrity service ensures that
data is not altered or destroyed in an unauthorized manner. This service
applies to data in permanent data stores and to data in communications messages.
- Data confidentiality service ensures that data is not made available or
disclosed to unauthorized individuals or computer processes. This service
will be applied to devices that permit human interaction with the information
system. In addition, this service will ensure that observation of usage
patterns of communications resources will not be possible.
- Non-repudiation
service ensures that entities engaging in an information exchange cannot
deny being involved in it. This service may take one or both of two forms.
First, the recipient of data is provided with proof of the origin of the
data. This protects against any attempt by the sender to falsely deny sending
the data or its contents. Second, the sender of data is provided with proof
of delivery of data. This protects against any subsequent attempt by the
recipient to falsely deny receiving the data or its contents.