A Theory on Information Security