In this lesson, we're going to cover confidentiality.
Now, confidentiality is a foundational concept
in the world of information security,
and it refers to the protection of information
from unauthorized access and disclosure.
Confidentiality is used to ensure
that private or sensitive information
is not available or disclosed to
an unauthorized individual, entity, or process.
Imagine you just walked into your local bank
and saw a stack of personal loan applications
being left out in the open for anybody to see.
Each application contains lots of sensitive data,
including the bank customer's names, their addresses,
their social security number, their work history,
their income, and all sorts of things like that.
If I saw that, I'd be pretty alarmed
and I'm pretty sure you would be too.
That's because most of us have an expectation
that our sensitive banking details will be kept secret
and only revealed to people who are authorized to see it,
such as the bank tellers or the bank managers.
Well, the same expectation occurs
for most of us inside of our computer networks.
We expect that confidentiality is going to occur
and that people aren't randomly
accessing data or information from our laptops,
smartphones, or tablets
without our knowledge, consent, or approval.
After all, confidentiality is all about
keeping your information secret and safe from prying eyes
while at the same time allowing authorized people
to access that data that they need.
So why is confidentiality so important?
Well, confidentiality is important for three main reasons.
This is to protect your personal privacy,
to maintain a business advantage,
and to achieve regulatory compliance.
Now, the first reason that confidentiality is important
is for you to be able to protect your personal privacy.
Just as you wouldn't want
your personal letters read by strangers,
most individuals don't want their personal data,
including their health records or financial details,
being shared without their consent.
So as cybersecurity professionals, we seek to ensure
that our data remains safe from prying eyes
in order to maintain the confidentiality of that data.
The second reason that confidentiality is important
is to maintain a business advantage.
Now, most businesses have proprietary data
that's used in their daily operations
including information about their products, their clients,
and their overall business strategy.
Keeping this information confidential is crucial
for maintaining a competitive edge within your industry.
And the third reason that confidentiality is important
is to achieve regulatory compliance.
Now, many industries have regulations
that mandate the protection of certain types of data,
like personally identifiable information, or PII,
protected health information, or PHI,
financial data, and various other types of data too.
If you fail to maintain confidentiality
of these types of data,
your organization could be levied a fine against it
and pay a large penalty for non-compliance;
so it's important to follow all the mandatory regulations
within your industry.
Now, in order to ensure confidentiality,
we're going to use five basic methods:
encryption, access controls, data masking,
physical security measures, and training & awareness.
First, we have encryption.
Encryption is a process of converting data into code
to prevent unauthorized access.
Even if somebody intercepts the data,
they won't understand it
unless they have the decryption key.
Essentially, with encryption,
we're scrambling up the plain text data
into an indecipherable jumble
until the right decryption key is provided,
in which case the scrambled data, which we call ciphertext,
can then be quickly presented again
in its plain text format.
Second, we have access controls.
By setting up strong user permissions,
you're going to be able to ensure
that only authorized personnel can access
certain types of data.
Access controls can be set up
by creating password-protected files,
or securing access to a database
by using a username and password
or other types of credentials.
For example, your boss might want you
to save your personnel record on the company's shared drive,
but they only want themselves to be able to access it.
In this case, they can set permissions for that record
so they have full access to read and write information
to that file, but nobody else can.
Third, we have data masking.
Now, data masking is a method that involves
obscuring specific data within a database
to make it inaccessible for unauthorized users
while retaining the real data's authenticity
and use for authorized users.
For example, if your customer service system
stores your user's credit card number,
you could use data masking
so the first 12 digits of the 16-digit number is masked
and only the final 4 digits of the customer's credit card
is going to be displayed to your support agents.
This type of confidentiality helps to prevent
accidental disclosures of the sensitive information,
and in this case, that would be
the entire 16-digit credit card number
while still allowing some portion of it
to be viewed for identification purposes.
Fourth, we have physical security measures.
Now, physical security measures are used
to ensure confidentiality for both physical types of data,
such as paper records stored in a filing cabinet,
and for digital information that's contained
on servers and workstations.
To protect data using physical security controls,
we can lock our filing cabinets,
install biometric security locks on the server room door,
install security cameras to detect
any physical data breaches
or other types of physical security controls
that we might want to use.
Fifth, we have training and awareness.
Often, breaches in confidentiality are going to occur
due to human error, negligence, or malicious intent.
To help prevent human error and negligence,
you should conduct regular training
on the security awareness best practices
that employees can use to protect
their organization's sensitive data.
So remember, confidentiality is the principle
of ensuring that information is only accessible
to those who have the right to access it
whether through encryption, access controls, data masking,
physical security measures, or training and awareness,
our goal is going to be to protect
our organization's sensitive data from prying eyes.
Anytime you're asked about confidentiality,
your answer should always have something to do
with protecting data from being seen by unauthorized users.
Most commonly, we do this using encryption,
so I really want you to link the words
confidentiality and encryption in your mind.
In a digital age where information is our digital currency,
maintaining the confidentiality of our organizational data
is really important and critical
to ensuring that we can maintain our customer's trust,
meet our regulatory compliance requirements,
and achieve continuous business operations
inside of our enterprise networks.