CARACTERÍSTICAS ECONÓMICAS TRIBUTARIAS

With the advent of e-commerce, and the increasing use of information tech-nology as a tool for business communications, it became necessary to add non-repudiation to the definition of secure information. Non-repudiation is the ability to prove that an action or event has taken place, so that this event or action cannot be repudiated later (ISO/IEC TR 13335-1, 2004, p. 3). Thus, non-repudiation should be seen as a service provided by an information source, rather than a property of the information itself. Non-repudiation is vital if the information in question is to be used as evidence in a court of law. Usually, non-repudiation is achieved through cryptographic means (Dhillon, 2007, p. 22). The South African standard SABS ARP 057 (2002) defines the following sub-categories of non-repudiation services (SABS ARP 057, 2002, p. 28):

• Non-repudiation of delivery token (NRD token): A data item, which al-lows the originator of a piece of information to establish non-repudiation of delivery for a message. Thus, a token issued to the sender of infor-mation, which proves that the information was received by the intended recipient.

• Non-repudiation of origin token (NRO token): A data item, which al-lows recipients to establish non-repudiation of the origin for a message.

Thus, a token issued to the receiver of information, which proves that the sender of the information is who he/she/it claims to be.

• Non-repudiation of submission token (NRS token): A data item, which allows either the originator or the delivery authority to establish non-repudiation for a message (information) having been submitted for transmission. Thus, a token issued to both the sender of information and the entity responsible for delivering the information, which proves this information was ”handed over” to the entity responsible for deliv-ery, by the sender.

• Non-repudiation of transport token (NRT token): A data item, which allows either originator, or the delivery authority, to establish non-repudiation of the transport for a message. Thus, a token issued to both the sender of information and the entity responsible for delivering the information, which proves this information was transported by the entity responsible for its delivery to its intended destination.

Non-repudiation services are especially important in an electronic-commerce context. For example; if an email is to be used to negotiate a legally binding contract, the following tokens would be needed during the process of send-ing and receivsend-ing such an email. Firstly, the sender of the message would receive an NRS token, which proves that the message has been submitted for delivery. The delivery authority would receive a similar token, which proves the identity of the sender for this message. Once the message arrives at its destination the sender would receive an NRT token. This proves to both the sender and the delivery authority that the message has arrived at its destination. When the recipient now receives this message from the delivery authority, the recipient is issued with an NRO token, which proves the iden-tity of the sender of this message. At the same time, the sender is issued with an NRD token, which proves that the recipient has indeed received the message. Clearly, in e-commerce, these non-repudiation services play an inte-gral role in establishing trust between parties who have never met in person.

Furthermore, non-repudiation services are dependent on the confidentiality (privacy), where applicable, of the underlying non-repudiation tokens. Thus, in a digital signature scheme, the use of a private key relies on the owner of that key maintaining the privacy of the key (Dhillon, 2007, pp. 22-23).

3.2.7 Accountability

Accountability as a property of a secure information resource goes hand in hand with the property of non-repudiation. The ISO/IEC TR 13335-1 (2004) defines accountability as a property that ensures that the actions of an entity may be traced uniquely to the entity (SABS ARP 057, 2002, p. 1).

Without the ability, for example, to trace the actions of a person uniquely to that person, it would not be possible to hold such a person accountable for his/her actions. Accountability in this sense should not be confused with accountability for information security. Accountability for information security deals with the role(s) individuals play in the information security process and will be discussed in more detail in a later section.

3.2.8 Authenticity

The authenticity of an information resource is a property that is closely linked to the integrity of the information itself. The ISO/IEC TR 13335-1 (2004) defines authenticity as a property that ensures that the identity of a subject or resource is the one claimed. Authenticity applies to entities, such as, users, processes, systems and information (ISO/IEC TR 13335-1, 2004, p.

2). The authenticity of information depends on the ability to authenticate the information. Authentication is the ability of each party in a transaction to ascertain the identity of the other party (Laudon & Laudon, 2002, p.

447). If a user or entity is fooled into believing the wrong information is the right information, for example mistaking a spoof-site on the Internet for the real site it is mimicking, the authenticity of the information resource has been compromised and the integrity of the information itself would thus be lost. Clearly, non-repudiation services would also depend on the ability to authenticate all entities involved in a transaction. During an ongoing information exchange between two parties authentication would take place at two levels. Firstly, to determine that both entities are who they claim to be, and secondly to ensure that no third party starts to masquerade as one of the parties during the exchange (Dhillon, 2007, p. 21).

3.2.9 Reliability

Reliability is defined in the ISO/IEC TR 13335-1 (2004) standard as the prop-erty of consistent intended behavior and results (ISO/IEC TR 13335-1, 2004, p. 4). This property basically means that an information resource should be consistent (predictable), in terms of both its integrity and availability.

It also means that the results to a particular query against the information should be consistent. In other words, if the same question is asked, with the same parameters given, the answer returned should be the same, otherwise the reliability of the information is questionable.