What is software security?

Software is itself a resource and thus must be afforded appropriate security. Software also contains and controls data and other resources. Therefore, it must be designed and implemented to protect those resources.

Software Security Assurance(SSA) is a process that helps achieve that goal, ensuring that software is designed to operate at a level of security that is consistent with the potential harm that could result from the loss, inaccuracy, alteration, unavailability, or missuse of the data and resources that it uses, controls, and protects.

• This begins by identifying and categorizing the information that is to be contained in, or used by, the software. The information should be categorized according to its sensitivity.
• Once the information is categorized, security requirements can be developed. The security requirements should address access control, including network access and physical access; data management and data access; environmental controls (power, air conditioning, etc.) and off-line storage; human resource security; and audit trails and usage records. kabseung.

All security vulnerabilities in software are the result of Security bugs, or defects, within the software. In most cases, these defects are created by two primary causes:

1. Non-conformance, or a failure to satisfy requirements
2. An error or omission in the software requirements.

http://en.wikipedia.org/wiki/Software_Security_Assurance

What is meant by "physical security"?

Physical security is the protection of personnel, hardware, programs, networks, and data from physical circumstances and events that could cause serious losses or damage to an enterprise, agency, or institution. This includes protection from fire, natural disasters, burglary, theft, vandalism, and terrorism.

Physical security is often overlooked (and its importance underestimated) in favor of more technical and dramatic issues such as hacking, viruses, Trojans, and spyware. However, breaches of physical security can be carried out with little or no technical knowledge on the part of an attacker. Moreover, accidents and natural disasters are a part of everyday life, and in the long term, are inevitable.

The three main components to this physical security are:

1. Obstacles can be placed in the way of potential attackers and sites can be hardened against accidents and environmental disasters. Such measures can include multiple locks, fencing, walls, fireproof safes, and water sprinklers.
2. Surveillance and notification systems can be put in place, such as lighting, heat sensors, smoke detectors, intrusion detectors, alarms, and cameras.
3. Methods can be implemented to apprehend attackers (preferably before any damage has been done) and to recover quickly from accidents, fires, or natural disasters.

http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci1150976,00.html

What is meant by "data privacy"?

Information privacy, or data privacy is the relationship between collection and dissemination of data, technology, the public expectation of privacy, and the legal and political issues surrounding them.

Privacy concerns exist wherever personally identifiable information is collected and stored - in digital form or otherwise. Improper or non-existent disclosure control can be the root cause for privacy issues. Data privacy issues can arise in response to information from a wide range of sources, such as:

• Healthcare records
• Criminal justice investigations and proceedings
• Financial institutions and transactions
• Biological traits, such as genetic material
• Residence and geographic records
• Ethnicity

The challenge in data privacy is to share data while protecting personally identifiable information. The fields of data security and information security design and utilize software, hardware and human resources to address this issue.

http://en.wikipedia.org/wiki/Information_privacy

What is meant by "data integrity"?

Data integrity is a term used in computer science and telecommunications that can mean ensuring data is "whole" or complete, the condition in which data is identically maintained during any operation (such as transfer, storage or retrieval), the preservation of data for their intended use, or, relative to specified operations, the a priori expectation of data quality. Put simply, data integrity is the assurance that data is consistent and correct.
Often such integrity is ensured by use of a number referred to as a Message Integrity Code (MIC) or Message Authentication Code (MAC).
In cryptography and information security in general, integrity refers to the validity of data. Integrity can be compromised through:

1. Malicious altering, such as an attacker altering an account number in a bank transaction, or forgery of an identity document.
2. Accidental altering, such as a transmission error, or a hard disk crash.
3. Programming errors that result in inconsistencies in the data.

http://en.wikipedia.org/wiki/Data_integrity

What is meant by security of data?

The seventh Data Protection Principle requires that precautions should be taken against the physical loss or damage of personal data, and that access to and disclosure of personal data should be restricted.

Here are some recommendations that can be useful just for general guidance only, considering the hundreds of indications for keeping data secure:

Manual data

• When not in use, files containing personal data should be kept in locked stores or cabinets to which only authorised staff have access.
• Procedures for booking files in and out of storage should be developed, so that file movements can be tracked.
• Files should be put away in secure storage at the end of the working day, and should not be left on desks overnight.

Electronic data
Attention is drawn in particular to the following policies, which are directly relevant to the security of personal data and other data, like:

• Covering security of usernames, passwords, shared file areas, etc.
• Covering overall responsibility for IT security.
• Duties of staff responsible for servers.
• Authorised use of hardware and software.
• Authorised use of network connections.

• Care must be taken to ensure that PCs and terminals on which personal data are processed are not visible to unauthorised persons, especially in public places. Screens on which personal data are displayed should not be left unattended.
• Particular care must be taken when transmitting personal data. Appropriate security precautions, such as the use of encryption and digital signatures, should be taken when sending personal data by email. Transmission of personal data by fax should generally be avoided.
  

Taken from http://www.soas.ac.uk/infocomp/dpa/policy/security/

What is data?

• The term data is given to distinct pieces of information, usually formatted in a special way. All software is divided into two general categories: data and programs. Programs are collections of instructions for manipulating data.
• Data can exist in a variety of forms -- as numbers or text on pieces of paper, as bits and bytes stored in electronic memory, or as facts stored in a person's mind.
• The term data is often used to distinguish binary machine-readable information from textual human-readable information. For example, some applications make a distinction between data files (files that contain binary data) and text files (files that contain ASCII data).
• In database management systems, data files are the files that store the database information, whereas other files, such as index files and data dictionaries, store administrative information, known as metadata.

Based on http://www.webopedia.com/TERM/D/data.html