DIS – Assignment 1
Data and Information Security
Assignment – 1
Submission Date: 05.08.2026
Q1. Critical Characteristics of Information
Information is the most valuable asset of any organization, and its value depends on certain characteristics. These
characteristics determine the quality, usability, and security of information. According to information security principles,
information has seven critical characteristics, listed below.
1. Availability
Availability ensures that information is accessible and usable by authorized users whenever it is needed, without interference
or obstruction, and delivered in the required format.
2. Accuracy
Accuracy means information is free from mistakes or errors and has the value the user expects. If information has been
modified, intentionally or accidentally, it is no longer accurate.
3. Authenticity
Authenticity is the quality of information being genuine and original, rather than fabricated or copied. Authentic information
is in the same state it was created, placed, stored, or transferred.
4. Confidentiality
Confidentiality ensures that only authorized individuals, entities, or processes can access sensitive information, protecting it
from unauthorized disclosure. This is enforced using access controls, encryption, and classification of data.
5. Integrity
Integrity means information remains whole, complete, and uncorrupted. It is compromised when data is exposed to
corruption, damage, destruction, or unauthorized modification, whether accidental or malicious.
6. Utility
Utility is the value or usefulness of information for a specific purpose or use. If information is available but not in a format
meaningful to the user (e.g. unprocessed census data), it has low utility.
7. Possession
Possession is the ownership or control of information. A loss of possession, such as through theft, can occur even without a
loss of confidentiality — for example, an encrypted backup tape that is stolen but cannot be read.
Characteristic Core Idea
Availability Accessible to authorized users when needed
Accuracy Free of errors, matches expected value
Authenticity Genuine, in original/unaltered state
Confidentiality Protected from unauthorized disclosure
Integrity Whole, complete, uncorrupted
Utility Has value/usefulness for a purpose
Possession Ownership/control of the information
Page 1
DIS – Assignment 1
Q2. NSTISSC Security Model
The NSTISSC (National Security Telecommunications and Information Systems Security Committee) Security Model, also
known as the McCumber Cube, was developed by John McCumber in 1991. It provides a comprehensive, systematic view of
information security by representing it as a three-dimensional cube. Each of the cube's 27 cells represents an area that must
be addressed to secure information systems.
The three dimensions of the cube are as follows.
Dimension 1: Information States
This dimension describes the state information can be in at any given time.
• Storage – information at rest, e.g. on a hard disk or database
• Processing – information being used or transformed, e.g. by an application
• Transmission – information being transferred, e.g. over a network
Dimension 2: Security Properties (Critical Characteristics)
This dimension covers the core security goals that must be achieved.
• Confidentiality – preventing unauthorized disclosure of information
• Integrity – ensuring information is not improperly modified
• Availability – ensuring information is accessible when required
Dimension 3: Security Measures (Safeguards)
This dimension describes the measures used to protect information.
• Policy and Practices: administrative rules, procedures, and organizational policies
• Education, Training and Awareness: programs that build user knowledge and secure behaviour
• Technology: software and hardware controls such as firewalls, encryption, and access control systems
Significance of the Model
By combining these three dimensions (3 × 3 × 3), the model produces 27 cells, each representing a unique combination that a
security professional must consider — for example, ensuring the confidentiality of information during transmission using
technology-based controls. This makes the model useful for designing and auditing comprehensive security programs, since
it prevents any single aspect of information security from being overlooked.
Q3. System Development Life Cycle (SDLC)
The System Development Life Cycle (SDLC) is a structured, methodical approach used by organizations to plan, create, test,
and deploy information systems. It ensures that systems are developed in a controlled and organized manner, minimizing risk
and maximizing quality. The traditional SDLC consists of the following phases.
1. Investigation
The process begins with an examination of the event or plan that initiates the process. Objectives, constraints, and scope of
the project are specified, and a preliminary cost-benefit analysis is conducted to determine feasibility.
2. Analysis
Existing documentation is studied, and further analysis of the problem is performed, including how the current system works
and what the new system should accomplish. This phase produces the requirements for the new system.
3. Logical Design
Based on the analysis, the team creates a blueprint of the proposed solution, focusing on business requirements rather than
specific technologies. Alternative solutions are discussed, and one approach is selected for further analysis.
Page 2
DIS – Assignment 1
4. Physical Design
Specific technologies are selected to support the solution identified in the logical design. The chosen components are
evaluated to determine feasibility, and a final design is agreed upon.
5. Implementation
The components of the system are created or purchased, and the necessary hardware and software are installed and tested.
The system undergoes testing, and users are trained before it is put into operation.
6. Maintenance and Change
This is the longest and most expensive phase. The system is monitored, updated, and modified as needed to meet changing
requirements or correct issues, ensuring it continues to meet organizational objectives until it is retired or replaced.
Phase Key Output
Investigation Objectives, scope, feasibility study
Analysis Requirements of the new system
Logical Design Technology-independent blueprint
Physical Design Selected technologies and final design
Implementation Working, tested, deployed system
Maintenance & Change Ongoing support and system updates
Note: Security SDLC (SecSDLC)
A parallel methodology, the Security SDLC, mirrors these same phases but focuses specifically on identifying threats,
vulnerabilities, and risks, and on designing and implementing security controls to protect the information system throughout
its lifecycle.
Page 3