The (social) construction of information security

While the philosophical foundations of information security have been unexamined, there is an implicit philosophy of what protection of information is. This philosophy is based on the notion of containment, taken from analogies with things that offer physical security (e.g., buildings, safes, fences). I argue that this implicit philosophy is unsatisfactory in the current age of increased connectivity, and provide an alternative foundation. I do so from a constructionist point of view, where the coevolution of social and technical mechanisms is seen as the source of the security of an information system, rather than rational design choices only. I employ the concept of causal insulation from system theory in order to give an account of the fundamental characteristics of information security research. This generates definitions that can be used for philosophically informed discussions on the protection of information in new systems.