Any information that is generated and stored should be protected against accidental or intentional manipulation or destruction if it is to be properly exploited by users [1].

Since the very early days, when writing and information exchange started, all human beings, particularly the rulers and military commanders sought new ways to protect the information and to detect information tampering [2-6].

Cryptography, a method of making data confidential, for example, was sed to make the message unintelligible to people other than the intended receiver. Cryptography dates back to nearly 2000 B.C. in Egypt, where hieroglyphics were used to decorate the tombs of the deceased rulers and kings [6-9].

Data security cannot be solely limited to information and communication technology (ICT) although the technology has played a significant role in taking the information system to work places and commercial exchanges, resulting in the greater dependence of governments and other organizations on electronic information. Rather, work places and commercial exchanges have also been very influential in developing people's individual and social life. Hence, similar to the ICT, work places should also receive special attention in securing their relevant information [10-14].

Along with the penetration of information technology in man's life, a lot of effort has been made to achieve data security within and between systems [6], mainly due to the tricky nature of information and communication technology, particularly when such technology turns out to be abstract in nature. ICT-related tools and equipment are not independent of penetrability rules and influences [4].

Since 1940, simultaneously with World War II, the need for developing confidential data increased resulting in widespread application of 'Enigma' machine for cryptography in battle fields by Germans. At this time the first generation of computers made the production of sophisticated cryptography possible resulting in greater data security [4, 15]. The noticeable point is that, with greater demand for effective communication between information systems, via data integration, the need for data security in information systems increased significantly.

In the field of communication, the presence of information system is inevitable. Such systems function as nodes which exchange information by sending and receiving data. The exchange of information between information systems and the circulation of such information within the system itself would involve the application of security systems for safeguarding the data. Considering such issues, the current study is intended to evaluate theories and models dealing with data security, with an emphasis on the fact that the issue of data security and data security management are two separate, but interrelated, subjects which have not been sufficiently investigated thus far.

With the expansion of information and communication technology in the 1980s, data security faced new challenges. Before this era, the security issue was trusted upon and left to multiuser computers or, in a sense, to machines which were limited in number. However, since the mid 1980s, with the spread of cheap software and hardware, data invasion increased, resulting in a security shift from computers to the data themselves. This decade marked the beginning of fresh discussions on data confidentiality, data integrity, and on-time data availability for the user. To this end, Saltzer and Schroeder (1975) referred to three types of invasion, from the perspectives of security specialists, known as (a) unauthorized information release (Confidentiality), (b) unauthorized information modification (Integrity) and (c) unauthorized denial of use (Availability). Before this era, data security was confined to military environments and was supported by the military men, but from 1980s computers entered the field of commerce. Commercial fields differed from military environments in numerous ways of which the most important were the costs incurred to achieve data security, lack of strict physical data support in commercial settings and attacks initiated by unprofessional users in such settings. Such differences resulted in changes in priorities set up for data security in commercial settings [16, 17].

The following section introduces a number of models known as data security models. The models deal with management in data security, in line with the objectives of this study.

The term 'security' would imply a state or condition in which the integrity of an entity is not biased; as such, the entity should remain immune against threats, risks and damages [28-35]. Hence, data security is used to refer to a condition in which the integrity of information remains fixed or free from any bias.

Of course, due to its unique nature, information should be exchanged between the sender and receiver, in a communication process; in other words, information is generated in order to be used and exchanged even when the conditional use of classified information by specific users is at the stake. So the senders' and receivers' identity, along with information integrity, belong to attributes that can protect the security of information if they are not biased or distorted.

Anyway, in a normal condition, when there is no particular threat to the integrity of information, data security tends to focus on three characteristics of integrity, identity of the sender and identity of receiver. From quality perspective also data security includes these three attributes.

Of course, it is worth mentioning that, like man's other valuable belongings, information may be stolen, distorted or invaded by individuals or social groups to achieve their illegal interests. Therefore, information security is in need of proper management to remain protected against any kind of threat, theft, robbery or distortion. Also, data security management would involve the process of protecting the integrity of information and the identity of senders and receivers against any sorts of damage, invasion or risks. As such, data security is a condition or state could be achieved by proper management. Fig. (1) illustrates the needs for and improvement cycle of data security and its management.

Fig. (1). The needs for and improvement cycle of data Security Management.

Attention to differences between data security and data security management is essential not only in terms of terminology but also in relation to the quality issue because data security and data security management are two separate but interrelated subjects which need continuous improvement. Therefore the proposed models (i.e. the CIA Triad, Parkerian Hexad, Five Pillars Information Assurance, 7 ISO principles, Traditional 4-Steps, Pentagon of Trust and Evolutionary Circles of Information Security) are viewed as data security management models. Table 1 depicts these models and their related attributes.

As the models under study indicate, data security management, in an unlimited evolutionary process, in line with other developments in information technology, would gradually build up new attributes with greater capabilities to achieve data security. In addition to its direct link with developments in the knowledge of Intrusion Detection System, data security management, with invaluable capabilities, has been able to extend its features, as a support umbrella, to safeguard data security. These features or characteristics, that are continuously increasing in number, unanimously highlight the role of control and assurance; their current characteristics appear in the box below:

Here, a graphic representation of data security management, in the form of a model, may help to get a better sense of the way it functions in supporting data security. As such, the following figure, known as ‘support umbrella model, is used to clarify the supportive role played by data security management to secure data.

Fig. (2). A support umbrella model for data security management.

Fig. (2) a support umbrella model for data security management with capabilities for further extension. The noticeable point is that, the suggested model ted to use the accessibility feature, instead of availability, because accessibility is essential for quick access to reliable data. Besides, the three features of utility, admissibility and transparency are not included in the new model because, according to their definitions, they could be achieved during the process of data development and management as they do not belong to data management security. The efficiency feature and cost-effectiveness also are not included in the support umbrella model of data security management because, in management, the optimal use of resources, with minimum losses, is of special significance. Also, the realization of these two features (i.e. efficiency and cost-effectiveness) will not affect on data security, as attention to them is inevitable in any kind of management, including data security management.

Exact definitions of the concepts could help different people to have similar understanding of the terms, as an essential requirement for effective communication. Proper definitions are additionally important for investigating the quality of the concepts and phenomenon. Also, identification of the precise characteristics of different phenomena and concepts is at the stake of accurate definitions.

Making a distinction between the concepts of data security and data security management is an important requirement which has been left unattended thus far although proper attention to such concepts could enhance quality. A noticeable point is that, along with new developments in information and communication technologies and novel advances in intrusion detection systems, data security management would continuously progress resulting in the development of more features in the management.

Data security management is a process which involves the implementation of certain measures to achieve data security as a condition in which, the integrity of data and the identity of the sender and recipient are properly established. In this regard, the introduction of a model that matches the definitions of the two concepts of data security and data security management is of special importance, because such a model could help to identify the services and facilities that are necessary for information security which, in turn, could facilitate the development of information security management.

Attention to differences between data security and data security management by international organizations like ISO, ITU, ASTM and IEEE, with long-time experience on data security and very effective roles in establishing internationally valid standards, could help to formulate more accurate studies to enhance the quality of work in both areas.

Hamid Moghaddasi proposed the topic; suggested the Umbrella model; and the Need - Improvement cycle theory, formulated research problem and helped with the methodology.

Mehran Kamkarhaghighi collected the data and carried out statistical analyses.

Samad Sajjadi reviewed the literature.

The authors confirm that this article content has no conflict of interest.