9. Confidentiality and Privacy Controls

Question 1

What is confidentiality

Answer 1

Confidentiality relates to organizational intellectual property which includes strategic plan, trade secrets, cost information, legal documents etc.

Question 2

Describe the controls that can be used to protect the confidentiality(fortroligt) of sensitive(følsom) information.

Tip: a) encryption, b) authorization and authentication, c) training is the most important aspect of ensuring confidentiality, but training who?

Answer 2

a) encrypt the information
b) control access to the information, authorization and authentication
c) training employees to properly handle the information. Training is the most important part for ensuring confidentiality, employees need to know what can and cant be shared.

Question 3

What is privacy and how to protect privacy?

Tip: the controls are the same as to protect confidentiality.

Answer 3

Privacy focuses on protecting personal information on customers, vendors, employees, and business partners

Question 4

What is the main goal of the generally accepted privacy principles (GAPP) framework

Tip: guidance

Answer 4

Generally accepted privacy principles (GAPP) framework provides guidance on how to protect personal information the organization collects from customer, suppliers and employees.

Question 5

Encryption is a preventative control

What types of encryption are there?

Answer 5

Encryption is a preventative control. Types of encryption are symmetric and asymmetric

Question 6

Explain symmetric encryption

Answer 6

Symmetric encryption uses one key to encrypt and decrypt, both parties need to know the key. The transaction speed is fast

Question 7

Explain asymmetric encryption

Answer 7

Asymmetric uses two key, one key is public and the other key is private which is used to decrypt. Transaction speed is slow, but can create digital signatures.

Question 8

Explain digital signatures

Tip: hashing

Answer 8

Hashing (digital signatures)
Hashing transforming plaintext of any length into a short code called a hash.

Digital signature
A hash encrypted with the hash creator’s hash private hash.

The hash cant go back to orignial text, each time the document changes, a new hash is generated. Thats why digital signatures can be used as legally binding documents.