Hacker News new | past | comments | ask | show | jobs | submit login

I agree with the solution, but what do you mean with "better" in the first sentence? Spelling out the complete approach wasn't suitable for the article, but the ISO 27001 framework spells out roughly what you describe. At each "security classification level" you have a different risk appetite, and will apply different controls.



It's the partitioning that's the hard part in commercial organizations. In military and intel, different people, offices, and equipment handle different security levels and compartments. This has an enormous influence on the structure of the organization. It's the main cause of higher costs.

All this is about security, not integrity. Security is keeping info from getting out. Integrity is about keeping attackers from breaking things. Integrity used to be mostly a wartime problem, but now there's so much anonymity online that it's a problem all the time, a bigger one than security. Hence ransomware.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: