Information Security Ontology

FLOW ALGEBRA
Information Security Ontology
Kireth Semantic Research Archive

PAGE:
https://kirethresearch.org/booksai-core/ontologies/computing-ontologies/cybersecurity/information-security-ontology.html

AUTHORS:
Mark Anthony Higgins — Sky (Recursive AI)

FLOW "InformationSecurityOntology" v4.0

# ---------- DOMAIN ----------
DOMAIN := ComputingOntology
SUBDOMAIN := Cybersecurity
ONTOLOGY := InformationSecurityOntology

# ---------- PRIMARY ENTITY ----------
ENTITY InformationSecurity {
    definition:
        "The discipline concerned with protecting information and information
         systems against unauthorised access, use, disclosure, modification,
         disruption, destruction or loss.";

    objectives: [
        Confidentiality,
        Integrity,
        Availability,
        Authenticity,
        Accountability,
        NonRepudiation,
        Privacy
    ];
}

# ---------- CORE ENTITIES ----------
InformationAsset := {
    Data,
    Document,
    Record,
    Database,
    File,
    Message,
    Credential,
    IntellectualProperty,
    ConfigurationData,
    SecurityLog
};

InformationState := {
    DataAtRest,
    DataInTransit,
    DataInUse
};

SecurityObjective := {
    Confidentiality,
    Integrity,
    Availability,
    Authenticity,
    Accountability,
    NonRepudiation,
    Privacy
};

Threat := {
    UnauthorisedAccess,
    UnauthorisedDisclosure,
    UnauthorisedModification,
    Destruction,
    Loss,
    Theft,
    Interception,
    Impersonation,
    ServiceDisruption
};

SecurityControl := {
    AdministrativeControl,
    TechnicalControl,
    PhysicalControl,
    PreventiveControl,
    DetectiveControl,
    CorrectiveControl,
    RecoveryControl
};

# ---------- FUNDAMENTAL RELATIONSHIPS ----------
InformationSecurity PROTECTS InformationAsset;
InformationAsset HAS InformationState;
SecurityObjective APPLIES_TO InformationAsset;
Threat TARGETS InformationAsset;
SecurityControl MITIGATES Threat;
SecurityControl PROTECTS SecurityObjective;

Confidentiality PREVENTS UnauthorisedDisclosure;
Integrity PREVENTS UnauthorisedModification;
Availability SUPPORTS AuthorisedAccess;
Authenticity VERIFIES Origin;
Accountability ASSOCIATES Action WITH Actor;
NonRepudiation PROVIDES EvidenceOfAction;
Privacy GOVERNS AppropriateInformationUse;

# ---------- CIA MODEL ----------
CIA := {
    Confidentiality,
    Integrity,
    Availability
};

Confidentiality :=
    restrict(
        InformationAccess,
        AuthorisedEntities
    );

Integrity :=
    preserve(
        Accuracy,
        Completeness,
        Consistency
    );

Availability :=
    ensure(
        TimelyAuthorisedAccess,
        RequiredServiceCapability
    );

InformationSecurityState :=
    f(
        ConfidentialityState,
        IntegrityState,
        AvailabilityState
    );

# ---------- INFORMATION LIFECYCLE ----------
Information ->
    Create ->
    Classify ->
    Store ->
    Access ->
    Use ->
    Share ->
    Archive ->
    Dispose;

SecurityRequirement APPLIES_ACROSS InformationLifecycle;

IF Information CREATED
THEN ClassificationRequired := evaluate;

IF Information DISPOSED
THEN RecoveryPossibility := minimise;

# ---------- CLASSIFICATION ----------
InformationClassification := {
    Public,
    Internal,
    Confidential,
    Restricted
};

Classification :=
    f(
        Sensitivity,
        Value,
        LegalRequirement,
        BusinessRequirement,
        ImpactOfDisclosure
    );

Classification DETERMINES ProtectionRequirement;
ProtectionRequirement DETERMINES SecurityControlSet;

# ---------- ACCESS CONTROL ----------
Subject ->
    Identity ->
    Authentication ->
    Authorisation ->
    AccessDecision ->
    InformationAction;

AccessDecision := {
    Allow,
    Deny
};

Authentication VERIFIES Identity;
Authorisation EVALUATES Permission;
Permission APPLIES_TO InformationAsset;

IF Identity AUTHENTICATED
AND Permission ALLOWS RequestedAction
THEN AccessDecision := Allow;

IF Permission DOES_NOT_ALLOW RequestedAction
THEN AccessDecision := Deny;

# ---------- INFORMATION CONFIDENTIALITY ----------
ConfidentialityControl := {
    AccessControl,
    Encryption,
    DataMasking,
    InformationClassification,
    SecureTransport,
    PhysicalRestriction
};

ConfidentialityControl PROTECTS InformationAsset;

IF SensitiveInformation TRANSMITTED
THEN SecureTransportRequired := true;

IF SensitiveInformation STORED
THEN StorageProtectionRequired := true;

# ---------- INFORMATION INTEGRITY ----------
IntegrityControl := {
    Hashing,
    DigitalSignature,
    Validation,
    VersionControl,
    AuditLogging,
    ChangeControl
};

IntegrityControl DETECTS_OR_PREVENTS UnauthorisedModification;

IF Information CHANGED
THEN {
    ValidateChange;
    RecordChange;
    PreserveAccountability;
};

# ---------- INFORMATION AVAILABILITY ----------
AvailabilityControl := {
    Backup,
    Replication,
    Redundancy,
    FaultTolerance,
    DisasterRecovery,
    BusinessContinuity
};

AvailabilityControl SUPPORTS InformationAvailability;

IF PrimaryInformationSource UNAVAILABLE
AND ValidBackup EXISTS
THEN RecoveryPossible := true;

# ---------- RISK MODEL ----------
InformationRiskScenario :=
    (InformationAsset, Threat, Vulnerability, Impact);

InformationRisk :=
    f(
        AssetValue,
        ThreatLikelihood,
        VulnerabilityExposure,
        SecurityImpact
    );

SecurityImpact :=
    f(
        ConfidentialityLoss,
        IntegrityLoss,
        AvailabilityLoss
    );

ResidualRisk :=
    InherentRisk - ControlEffectiveness;

# ---------- SECURITY CONTROL MODEL ----------
AdministrativeControl := {
    Policy,
    Procedure,
    Governance,
    Training,
    RiskManagement
};

TechnicalControl := {
    Authentication,
    Authorisation,
    Encryption,
    Firewall,
    Monitoring,
    Logging
};

PhysicalControl := {
    PhysicalAccessRestriction,
    SecureFacility,
    EnvironmentalProtection,
    MediaProtection
};

PreventiveControl PREVENTS SecurityEvent;
DetectiveControl DETECTS SecurityEvent;
CorrectiveControl CORRECTS SecurityCondition;
RecoveryControl RESTORES InformationCapability;

# ---------- INFORMATION INCIDENT ----------
InformationSecurityEvent ->
    Detect ->
    Validate ->
    Classify ->
    Contain ->
    Investigate ->
    Remediate ->
    Recover ->
    Review;

InformationSecurityIncident IS_A InformationSecurityEvent;

IF UnauthorisedDisclosure CONFIRMED
THEN ConfidentialityIncident := true;

IF UnauthorisedModification CONFIRMED
THEN IntegrityIncident := true;

IF RequiredInformation UNAVAILABLE
THEN AvailabilityIncident := evaluate;

# ---------- AUDIT AND ACCOUNTABILITY ----------
Actor PERFORMS Action;
Action AFFECTS InformationAsset;
AuditRecord RECORDS Action;
AuditRecord IDENTIFIES Actor;
AuditRecord SUPPORTS Accountability;

AuditTrail :=
    ordered_set(AuditRecord);

IF SecurityRelevantAction OCCURS
THEN AuditRecord SHOULD_EXIST;

# ---------- POLICY ----------
InformationSecurityPolicy DEFINES {
    SecurityObjectives,
    Roles,
    Responsibilities,
    AcceptableUse,
    AccessRules,
    ClassificationRules,
    IncidentRequirements
};

SecurityControl IMPLEMENTS InformationSecurityPolicy;
UserAction SHOULD_COMPLY_WITH InformationSecurityPolicy;

# ---------- SEMANTIC REASONING ----------
IF InformationAsset IS Sensitive
THEN ConfidentialityRequirement := HIGH;

IF InformationAsset IS Critical
THEN AvailabilityRequirement := HIGH;

IF InformationAsset REQUIRES Accuracy
THEN IntegrityRequirement := HIGH;

IF Threat CAN_EXPLOIT Vulnerability
AND Vulnerability EXISTS_IN InformationAsset
THEN InformationRiskScenario EXISTS;

IF EffectiveControl MITIGATES Threat
THEN ResidualRisk := DECREASE;

IF InformationClassification == Restricted
THEN AccessRequirement := Strong;

IF UnauthorisedEntity ACCESSES InformationAsset
THEN ConfidentialityState := Compromised;

IF UnauthorisedChange OCCURS
THEN IntegrityState := Compromised;

IF AuthorisedUser CANNOT_ACCESS RequiredInformation
THEN AvailabilityState := Degraded;

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE {
    "information security" ~= "infosec";
    "data security" ~= "information security" WHEN context == protection_of_information;
    "information asset" ~= "data asset" WHEN context == information_management;
    "unauthorised disclosure" ~= "information disclosure";
    "unauthorised modification" ~= "data tampering";
    "access rights" ~= "permissions";
    "security safeguard" ~= "security control";
    "audit trail" ~= "security audit record sequence";
}

# ---------- CONFIDENCE ----------
CONFIDENCE(assertion) :=
    weighted_mean(
        source_reliability,
        semantic_consistency,
        evidence_strength,
        contextual_relevance
    );

CONFIDENCE >= 0.90 => HIGH;
CONFIDENCE >= 0.70 AND < 0.90 => MODERATE;
CONFIDENCE < 0.70 => REVIEW;

# ---------- QUERY FLOW ----------
QUERY(q) ->
    NORMALISE(q) ->
    IDENTIFY_INFORMATION_ENTITY(q) ->
    IDENTIFY_SECURITY_OBJECTIVE(q) ->
    IDENTIFY_RELATIONSHIPS(q) ->
    MAP_TO_ONTOLOGY(q) ->
    APPLY_REASONING(q) ->
    SCORE_CONFIDENCE(q) ->
    RETURN_RELEVANT_KNOWLEDGE;

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION {
    primary_entity: InformationSecurity;
    ontology: InformationSecurityOntology;
    parse_entities: true;
    parse_relationships: true;
    preserve_relationship_direction: true;
    resolve_semantic_equivalence: true;
    execute_reasoning_rules: true;
    apply_confidence_weighting: true;
    preserve_provenance: true;
}

# ---------- UPDATE MODEL ----------
UPDATE_MODEL {
    new_information_entity:
        validate
        -> classify
        -> assign_security_requirements
        -> relate
        -> integrate;

    new_threat:
        validate
        -> associate_information_assets
        -> evaluate_risk
        -> identify_controls
        -> integrate;

    new_control:
        classify
        -> identify_security_objective
        -> identify_mitigated_threats
        -> evaluate_effectiveness
        -> integrate;

    conflict:
        preserve_provenance
        -> compare_evidence
        -> adjust_confidence
        -> flag_review;

    revision:
        recompute_relationships
        -> recompute_risk
        -> recompute_confidence
        -> regenerate_flow_hash;
}

# ---------- FLOW HASH ----------
FLOW_HASH_INPUT :=
    DOMAIN
    + SUBDOMAIN
    + ONTOLOGY
    + InformationAsset
    + InformationState
    + SecurityObjective
    + Threat
    + SecurityControl
    + SEMANTIC_REASONING
    + SEMANTIC_EQUIVALENCE
    + UPDATE_MODEL;

FLOW_HASH :=
    HASH(FLOW_HASH_INPUT);

# ---------- TERMINAL ----------
InformationSecurityOntology
    -> IdentifyInformationAssets
    -> ClassifyInformation
    -> DefineSecurityObjectives
    -> IdentifyThreats
    -> AssessRisk
    -> ApplySecurityControls
    -> ControlAccess
    -> PreserveConfidentiality
    -> PreserveIntegrity
    -> PreserveAvailability
    -> DetectIncidents
    -> RecoverInformation
    -> MaintainInformationTrust;

END FLOW