Information Assurance Technical Framework and End User Information Ownership: A Critical Analysis

This paper reviews the recent history of the Information Assurance (IA) movement and examines the Information Assurance Technical Framework (IATF) proposed by the United States Government’s National Information Assurance Partnership (NIAP) in the height of the potential terrorist attacks on the cyberspace that draw no geographical or temporal boundaries. Under the heightened alert, all organizations scramble to plug the security holes of their information infrastructure to assure safe end user access to the mission-critical information. This paper argues that the focus of IATF is based on the enforcement of a top-down information infrastructure without specifying the impact to the end users or “information consumers. “ Furthermore, a complete IA defensive strategy built on a Defence-in-Depth Strategy dictates only what people executing operations through the use of technology can achieve. The IATF addresses the technology portion of this strategy to defend against five classes of attacks: Passive, Active, Insider, Close-in, and Distribution. This is accomplished through four overlapping approaches and layers of protection, referred to collectively as Defence-in-Depth technology areas. The paper concludes by highlighting the implications and impact of the IATF and related issues to all citizens in the end user community, particularly the possible gains and sacrifices that end users are facing, particularly the key issue of assurance of information ownership.