Confidentiality is the protection of information in the system so that an unauthorized person cannot access it. This type of protection is most important in military and government organizations that need to keep plans and capabilities secret from enemies. However, it can also be useful to businesses that need to protect their proprietary trade secrets from competitors or prevent unauthorized persons from accessing the company’s sensitive information (e.g., legal, personal, or medical information). Privacy issues have gained an increasing amount of attention in the past few years, placing the importance of confidentiality on protecting personal information maintained in automated systems by both government agencies and private-sector organizations. Confidentiality must be well-defined, and procedures for maintaining confidentiality must be carefully implemented. A crucial aspect of confidentiality is user identification and authentication. Positive identification of each system user is essential in order to ensure the effectiveness of policies that specify who is allowed access to which data items.
Threats to Confidentiality: Confidentiality can be compromised in several ways. The following are some of the commonly encountered threats to information confidentiality –
- Hackers
- Masqueraders
- Unauthorized user activity
- Unprotected downloaded files
- Local area networks (LANs)
- Trojan Horses
Confidentiality Models: Confidentiality models are used to describe what actions must be taken to ensure the confidentiality of information. These models can specify how security tools are used to achieve the desired level of confidentiality. The most commonly used model for describing the enforcement of confidentiality is the Bell-LaPadula model.
- In this model the relationship between objects (i.e, the files, records, programs and equipment that contain or receive information) and subjects (i.e, the person, processes, or devices that cause the information to flow between the objects).
- The relationships are described in terms of the subject’s assigned level of access or privilege and the object’s level of sensitivity. In military terms, these would be described as the security clearance of the subject and the security classification of the object.
Another type of model that is commonly used is Access control model.
- It organizes the system into objects (i.e, resources being acted on), subjects (i.e, the person or program doing the action), and operations (i.e, the process of interaction).
- A set of rules specifies which operation can be performed on an object by which subject.
Types of Confidentiality :
In Information Security, there are several types of confidentiality:
- Data confidentiality: refers to the protection of data stored in computer systems and networks from unauthorized access, use, disclosure, or modification. This is achieved through various methods, such as encryption and access controls.
- Network confidentiality: refers to the protection of information transmitted over computer networks from unauthorized access, interception, or tampering. This is achieved through encryption and secure protocols such as SSL/TLS.
- End-to-end confidentiality: refers to the protection of information transmitted between two endpoints, such as between a client and a server, from unauthorized access or tampering. This is achieved through encryption and secure protocols.
- Application confidentiality: refers to the protection of sensitive information processed and stored by software applications from unauthorized access, use, or modification. This is achieved through user authentication, access controls, and encryption of data stored in the application.
- Disk and file confidentiality: refers to the protection of data stored on physical storage devices, such as hard drives, from unauthorized access or theft. This is achieved through encryption, secure storage facilities, and access controls.
Overall, the goal of confidentiality in Information Security is to protect sensitive and private information from unauthorized access, use, or modification and to ensure that only authorized individuals have access to confidential information.
Uses of Confidentiality :
In the field of information security, confidentiality is used to protect sensitive data and information from unauthorized access and disclosure. Some common uses include:
- Encryption: Encrypting sensitive data helps to protect it from unauthorized access and disclosure.
- Access control: Confidentiality can be maintained by controlling who has access to sensitive information and limiting access to only those who need it.
- Data masking: Data masking is a technique used to obscure sensitive information, such as credit card numbers or social security numbers, to prevent unauthorized access.
- Virtual private networks (VPNs): VPNs allow users to securely connect to a network over the internet and protect the confidentiality of their data in transit.
- Secure file transfer protocols (SFTPs): SFTPs are used to transfer sensitive data securely over the internet, protecting its confidentiality in transit.
- Two-factor authentication: Two-factor authentication helps to ensure that only authorized users have access to sensitive information by requiring a second form of authentication, such as a fingerprint or a one-time code.
- Data loss prevention (DLP): DLP is a security measure used to prevent sensitive data from being leaked or lost. It monitors and controls the flow of sensitive data, protecting its confidentiality.
Issues of Confidentiality :
Confidentiality in information security can be challenging to maintain, and there are several issues that can arise, including:
- Insider threats: Employees and contractors who have access to sensitive information can pose a threat to confidentiality if they intentionally or accidentally disclose it.
- Cyberattacks: Hackers and cybercriminals can exploit vulnerabilities in systems and networks to access and steal confidential information.
- Social engineering: Social engineers use tactics like phishing and pretexting to trick individuals into revealing sensitive information, compromising its confidentiality.
- Human error: Confidential information can be accidentally disclosed through human error, such as sending an email to the wrong recipient or leaving sensitive information in plain sight.
- Technical failures: Technical failures, such as hardware failures or data breaches, can result in the loss or exposure of confidential information.
- Inadequate security measures: Inadequate security measures, such as weak passwords or outdated encryption algorithms, can make it easier for unauthorized parties to access confidential information.
- Legal and regulatory compliance: Confidentiality can be impacted by legal and regulatory requirements, such as data protection laws, that may require the disclosure of sensitive information in certain circumstances.
