Corporate Security involves prevention, detection, response, monitoring and review measures to reduce perceived risks to acceptable levels. These measures need to be uniform and continuous in domains such as Social/Personal, Computer/Network and Physical.

1. Information domains

Understanding corporate security is about understanding what the key assets in the company are. Today, the key asset is often information. But information alone is not enough, knowledge of how to use valuable information is needed to provide a competitive edge. The value of information may depend on being secret and accurate.

Information can take many forms, hence methods of securing information are various. Instead of dividing information into categories based on content, consider analysing threats to information (and hence its protection) on categories based on methods of processing / storing.

Three "information domains" are defined:

Physical: Traditionally information is "written down", stored somewhere (e.g. a box, safe, diskette, or computer). Classical security concentrates on physical protection: buildings, server rooms, access controls etc. Social/Personal: Successful organisations realise the value of their personnel, the knowledge they hold in their heads and the capabiliy to use that knowledge to corporate advantage. Logical or Network: Information is also stored on computers and accessed via networks. Documents can be stored "somewhere on the net" that users reference through URLs, UNCs or other abstract notions. The actual location of the data is often unknown to the user, she assumes it's on a server "somewhere". The different beween Internet and Intranet may not be obvious to end users. With this abstraction comes also a certain loss of accountability and responsibility.

Domain Interfaces

Each of these domains contains interfaces to the