Paper 2 Unit 8 Flashcards
What is confidentiality?
Confidentiality in information security refers to the assurance that data is only accessible to authorized individuals or entities and remains protected from unauthorized access or disclosure.
What is integrity?
Integrity in information security ensures that data remains accurate, consistent, and trustworthy throughout its lifecycle, safeguarding against unauthorized alteration, corruption, or tampering.
What is availability?
Availability in information security refers to ensuring that data and systems are accessible and usable when needed by authorized users, while protecting them from disruptions or downtime caused by various threats or incidents.
What does integrity do?
Ensures that information remains accurate, consistent and trustworthy throughout its lifecycle. Involves protecting data from unauthorised modification, alteration or deletion, intentionally and unintentionally. Maintaining data integrity is crucial for ensuring the reliability and trustworthiness of information.
What techniques are used in integrity?
Techniques such as data validation, checksums, digital signatures and access controls are employed to verify the integrity of data and detect any unauthorised changes
What does confidentiality do?
Ensures information is accessible only to authorised people. Involves preventing unauthorised access to sensitive data, ensuring it remains private and protected. Ensures that information is only disclosed to authorised users or entities, maintaining the privacy and confidentiality of the data
What techniques are used in confidentiality?
Techniques such as encryption, access controls and data masking are commonly used to enforce confidentiality
What does availability do?
Ensures that information and computing resources are accessible and usable when needed by authorised users. It involves ensuring timely and reliable access to information and services, minimising downtime and disruptions. Essential for maintaining productivity, continuity of operations and meeting the needs of users and stakeholders
What measures are used for availability?
Measures such as redundancy, fault tolerance, disaster recovery planning and robust infrastructure design are implemented to ensure high availability of systems and services
Why is maintaining compliance important?
Adhering to the principles of Confidentiality, Integrity, and Availability (CIA) helps organisations comply with legal and regulatory requirements. Many industries have specific regulations governing the protection of sensitive information, such as GDPR, Data Protection Act 2018 or financial information under PCI-DSS. By maintaining CIA principles, organisations demonstrate their commitment to compliance, which helps avoid legal penalties, fines, and reputational damage resulting from non-compliance
Why is maintaining trust with internal and external stakeholders important?
Consistently upholding CIA principles fosters trust among internal stakeholders (employees, management) and external stakeholders (customers, partners, regulators). When individuals trust that their sensitive information is kept confidential, accurate, and accessible when needed, they’re more likely to engage with the organisation and share information. Trust is fundamental for building strong relationships, both within the organization and with customers and partners.
Why is promoting a positive brand image important?
Maintaining high standards of information security through CIA principles enhances an organisation’s reputation and brand image. Customers prefer to interact with businesses that prioritize the protection of their data, leading to increased customer loyalty and positive word-of-mouth referrals. A strong brand image as a trustworthy and secure entity can differentiate an organisation from its competitors and attract more customers and partners.
Why is avoiding security risks and unauthorised access important?
Adhering to CIA principles helps mitigate security risks and prevent unauthorised access to sensitive information. By implementing robust security measures, such as encryption, access controls, and regular security audits, organisations can safeguard against data breaches, cyberattacks, and other security incidents. Preventing unauthorised access not only protects sensitive information but also prevents potential financial losses, reputational damage, and legal liabilities associated with security breaches.
What are the financial consequences of not maintaining CIA?
Regulatory Fines: Organisations can face hefty fines from regulatory bodies for breaches of data protection laws. For instance, under the General Data Protection Regulation (GDPR), fines can amount to €20 million or 4% of global annual turnover, whichever is higher. In 2019, British Airways was fined £20 million by the UK Information Commissioner’s Office (ICO) for a data breach affecting over 400,000 customers’ personal data.
Refunds and Compensation to Customers: Companies may be required to provide refunds or compensate customers for financial losses incurred due to security breaches or unauthorised access to their personal information. This could include reimbursement for fraudulent transactions or identity theft resulting from a data breach.
Loss of Earnings: Security incidents can disrupt operations, lead to downtime, and result in loss of revenue. For example, ransomware attacks can paralyse systems, causing significant financial losses due to inability to conduct business. The 2017 WannaCry ransomware attack on the UK’s National Health Service (NHS) resulted in estimated losses of £92 million.
What are the legal consequences of not maintaining CIA?
*Lawsuits: Individuals affected by data breaches may pursue legal action against the organisation for damages, such as financial losses, identity theft, or emotional distress. In the case of Google’s Safari workaround, the company faced a class-action lawsuit in the UK and settled for £13 million for bypassing privacy settings on Apple’s Safari browser, leading to unauthorised tracking of users’ browsing habits.
Termination of Contracts: Non-compliance with information security standards can result in termination of contracts with clients or partners. Failure to adequately protect sensitive data may breach contractual obligations, leading to legal disputes and termination of business relationships.
