9

We have the three pillars: confidentiality, integrity and availability.

Why is privacy not one of the three pillars?

15
  • 91
    Confidentiality means not letting people see information unless you want them to. What does privacy mean?
    – user253751
    Sep 21, 2016 at 3:33
  • 2
    @Bakuriu But the link between the vote and you is confidential. Confidentiality.
    – Ajedi32
    Sep 21, 2016 at 15:27
  • 2
    @immibis my favorite definition of privacy comes from Unix System Security Tools by Seth Ross: “Privacy – Ensuring that individuals maintain the right to control what information is collected about them, how it is used, who has used it, who maintains it, and what purpose it is used for.
    – mikeazo
    Sep 21, 2016 at 20:01
  • 2
    That's just a motto and isn't really worth much in practice.
    – Celeritas
    Sep 22, 2016 at 3:47
  • 3
    Pretty simple, CIA does not contain a P, and no one would care about those three words unless they spelled out CIA.
    – pipe
    Sep 22, 2016 at 7:05

10 Answers 10

19

Firstly, CIA (confidentiality, integrity, and availability) are not comprehensive goals for information security. Other principles like privacy and non-repudiation don't fit cleanly into this famous triad. ISO/IEC 27000:2009 defines information security as: "Preservation of confidentiality, integrity and availability of information. Note: In addition, other properties, such as authenticity, accountability, non-repudiation and reliability can also be involved." (emphasis added)

While both principles say that personal or sensitive information should not fall into the wrong hands, privacy and confidentiality have slightly different definitions, especially in a technical application. ISO 27000 defines confidentiality as "the property, that information is not made available or disclosed to unauthorized individuals, entities, or processes." The key here is "unauthorized." Confidentiality aims to provide a dependable way to share information only with those authorized and hide information from all other parties without leaks. This also includes information that could compromise other sensitive information, like CPU timing and power used during cryptography.

Privacy is both a cultural and legal standard that varies widely, and can include the right to be anonymous, the right to choose who information is disclosed to, the absence of intrusion, the right to conceal delicate information, and limitations on access to certain personal possessions (like my hard drive or in-home cameras). Not only do some of these categories not fall cleanly under the defintion of confidentiality, but there are some categories where information access is authorized but still violates privacy.

For example, medical information must follow strict privacy policies. If any of these policies are violated (e.g. unconnected doctors accessing medical records or failure to properly inform a patient how their information is being used) this would be a privacy violation but not a failure of the information security. If someone unconnected in another country hacked into the medical records, that'd be a violation of privacy and confidentiality. Similarly, a database could be set up in the US to allow parents access to college students' grades. While this database could pass security checks with flying colors, it would violate local privacy laws. This is complicated by the fact that confidentiality and privacy are colloquially synonyms. You could say that disclosing grades to parents is a breach of confidentiality, but from a technical perspective the confidentiality detailed in the security policy was not violated.

TL;DR: In infosec confidentiality states that sensitive information should only be visible to parties who have been authorized by the security policy, while privacy is much more complex and holds that sensitive information should only be shared with the intended parties. Access to information can still violate privacy even when all access must be authorized. This is ok because CIA is not comprehensive.

40

Confidentiality is generally a privacy concern. It's just a more general term.

It's like saying animal instead of dog.

In addition to the definitions, you can confirm that by searching for synonyms of privacy and synonyms of confidentiality. You can use confidentiality instead of privacy, but not the opposite.

2
  • 8
    I guess you could say that confidentiality is a hypernym of privacy. Sep 21, 2016 at 13:41
  • 2
    While they may be colloquial synonyms, the legal and ISO definitions of privacy and the ISO definition of confidentiality are not close synonyms. Additionally, ISO 29100 lists information security as only part of privacy principles, but here you seem to indicate that privacy is instead part of confidentiality.
    – Cody P
    Sep 21, 2016 at 16:40
5

Privacy is a legal concept. It varies from place to place to place (both in content and extent).

In other words, it is not possible to define what should be done to ensure "privacy". The concept of ensuring confidentiality for specific data is part of security (the C in your list). "Privacy", when defined, may be one of the data candidates for confidentiality.

2
  • 2
    Privacy isn't only a legal concept; people may have a desire for information to remain private regardless of how that information must "legally" be handled. Your main point is correct though; "privacy" is a fairly nebulous notion that isn't very clear-cut, whereas the confidentiality of specific information is.
    – Ajedi32
    Sep 21, 2016 at 15:30
  • If there is desire to keep the visibility of some data limited - this is confidentiality. Any data can fit this category. There are also laws which dictate that some data must be kept to the eyes of the owner only (roughly speaking). These are privacy laws. They are not nebulous : countries usually state which data exactly is subject to privacy. If peope want to keep some data for themselves the word "privacy" should not be used in its common sense. These are confidential data, which may in some jurisdictions have the privacy law applied to them (by marking them for instance)
    – WoJ
    Sep 21, 2016 at 18:43
5

Generally we speak of privacy for personal data (it is mine, and I do not want anyone else to see it) and confidentiality for professional data (only authorized people should see it). In that sense, confidentiality is a generalization of privacy.

On another hand, IT security is a major concern for organizations (or it should be...) and professionals of IT security are mainly concerned with organizations’ security.

By the way, there is a 4th pillar even if it is generally not seen as being as important as the 3 others: traceability (who did what).

4
  • 1
    it could be argued that traceability is a subset of integrity as it essentially serves to validate that the data hasn't been modified in an inappropriate way. Sep 21, 2016 at 11:09
  • @RоryMcCune: It is not limited to integrity. If a seldom consulted (and protected) information suddenly is disponible in the wide internet, it may be interesting to know who read it recently to restrict the research for the one that published it. Sep 21, 2016 at 11:24
  • Traceability makes sense to control the usage that employees make of their professional internet access. It is normally protected by privacy in my country, but if a professional internet access is used for an illegal act, to employer must have traces for the police investigation. Sep 21, 2016 at 11:29
  • @SergeBallesta then that would come down to confidentiality. Traceability isn't a 4th piller, its a means to obtainining the existing 3, if anything in the analogy its some part of the mortar. :)
    – JamesRyan
    Sep 21, 2016 at 14:59
3

Because security and privacy have different (some similar) properties:

  • Security properties: CIA (Confidentiality, Integrity, Availability), AAA (Authentication, Authorization, Accountability), Nonrepudiation.
  • Privacy properties (based on LINDDUN mnemonic: Link): Unlinkability, Anonymity and Pseudonymity, Plausible deniability, Undetectability and Unobservability, Confidentiality, Content awareness, Policy and consent compliance.

So that they have different purpose:

  • Security (Chapter 11 on Link): ability to protect system against accidental or deliberate intrusion.
  • Privacy (based on LINDDUN paper above): ability to protect personal information from being revealed to unauthorized subjects.

However, as well as usability, I think privacy can become also considering as one of secure design principles. For example, antivirus is not only usable, but also must protect user privacy like MAPS feature to automatically report malware to Microsoft on Microsoft Security Essential by creating a privacy statement.

3

Confidentiality, integrity and availability are used to describe attributes of information and their meanings are fairly clear cut, generally speaking people will come up with broadly consistent definitions. And while the necessity to maintain those attributes may differ the meaning will be the same.

Privacy is a concept or right, and even if considering only its relevance to information there is no one simple meaning that is all encompassing, it can mean different things to different people and may be dependent on context.

The legal aspect in WoJ's answer is directly relevant, for example, as far as I recall in UK legislature there is no single legal definition for privacy only contextual precedent etc.

1
  • It indeed depends on the countries. In France and Germany for instance, there is a specific list of information which falls under the privacy laws. In the US there were none but this is changing (with Michigan first, as far as I recall)
    – WoJ
    Sep 21, 2016 at 18:47
3

Privacy often is not your goal

Privacy cannot be a pillar of Information Security because maintaining privacy is not a fundamental goal of IS policy - it might be a goal, but depending on your circumstances, your goal may be to reduce privacy.

Information Security concerns with designing and implementing systems so that the information in those systems is secure and used only according to some policy. Privacy violations, on the other hand, are more about the contents of that policy - often a major violation of privacy is "working as intended" according to the policies.

Conflicting interests

Your privacy is useful to you, but the privacy of others may not be. Information Security in some organization concerns with protecting the interests and mitigating risks of that organization. Privacy, on the other hand, generally concerns interests of people outside the organization, which may be entirely opposite. An organization may have a legitimate interest to violate privacy (up to the extent legally allowed) by tracking people and taking de-anonymizing measures to increase sales, lower fraud, etc; or simply a profit motive to earn money by selling the private data. IS would be concerned with unintentional violations of privacy/confidentiality and mitigating risks of liability, PR and legal compliance, but not with protecting interests of others as long is it's in your interest to do so.

Legal requirements to avoid privacy

There may also be legal requirements to reduce privacy and prevent possibilities for anonymity or pseudonymity. For example, KYC (know your customer) legislation in financial industry; contractual agreements to provide private data (violating privacy) for fraud monitoring purposes, and legislation to identify and register certain types of users all impose IS needs that explicitly are anti-privacy. You will still have confidentiality concerns about this data, but in some aspects you will intentionally use them in a privacy-violating way.

2

For a practical understanding of the difference between privacy and security I would direct you to OMB Circular A-130 issued this summer.

The relevant excerpt:

While security and privacy are independent and separate disciplines, they are closely related, and it is essential for agencies to take a coordinated approach to identifying and managingsecurity and privacy risks and complying with applicable requirements." Privacy goes well beyond CIA and should not be confused with security. Privacy is concerned with the use of personally identifiable information, the sharing of that information, transparency, notice, choice, individual participation, and other issues related to the collection, creation, use, processing, storage, sharing, transfer, and disposal of PII. Privacy issues arise in many contexts related to the collection and use of information about individuals even when there are no security issues and there are no issues related to unauthorized access.

2

In the data protection classification, (ISC)^2 distinguishes "confidential" and "private". Both of them are considered the highest level of non-military "classified" information which needs to be protected from the public (lower levels are "sensitive" and "public"). Here, "private" explicitely refers to information related to human beings. Since "information security" very often relates to the security of enterprises you'll find more references to "confidentiality" than to "privacy". What Google or Facebook do with your private information is not of central relevance for companies.

1

The "Privacy of X", where X is some sensitive data, is the amount of control somebody should expect to have of that data.

Security provides the level of control required to assure that privacy. That is, the controls that assure the expected confidentiality, the expected integrity (i.e. protection from change) and the expected availability of the data to themselves or other authorised parties.

Not the answer you're looking for? Browse other questions tagged or ask your own question.