But what is a security domain?

The term information security domain has many definitions. But one of these is a building block concept that underpins everything we do in the cybersecurity field.

Because the term domain is also used to designate a multitude of technological objects such as AD Domains, AAD Domains, CA Domains, DNS Domains, LDAP Domains, etc., IT engineers working with these may sometimes forget what an information security domain fundamentally is in computer science. In effect, while we get our hands dirty in technological intricacies, we sometimes lose sight of the social and organizational components of security domains:

• Community of Interest,
• Authority,
• Governance,
• and Policy.

So, let us review this concept's definition:

An Information Security Domain is a bounded and coherent system. It is composed of entities (e.g., organizations, people, …) that constitute a community of interest, identities, and/or resources. It is governed by common authorities that issue policies. These policies prescribe if and how entities are authorized to perform which operations on which resources.

The definition is dense, hence it may be more appealing to look at it using a conceptual diagram:

This concept is generic and may be used loosely to designate diverse combinations of micro- and macro-systems regarded as a whole, thus context is paramount for clarity.

I hope this short post was informative. To find out more about this and related concepts, check out the corresponding Open-Measure dictionary entry, or follow our LinkedIn feed.