Why is privacy not one of the pillars of information security? [closed]

Question

We have the three pillars: confidentiality, integrity and availability.

Why is privacy not one of the three pillars?

Answer 1

Firstly, CIA (confidentiality, integrity, and availability) are not comprehensive goals for information security. Other principles like privacy and non-repudiation don't fit cleanly into this famous triad. ISO/IEC 27000:2009 defines information security as: "Preservation of confidentiality, integrity and availability of information. Note: In addition, other properties, such as authenticity, accountability, non-repudiation and reliability can also be involved." (emphasis added)

While both principles say that personal or sensitive information should not fall into the wrong hands, privacy and confidentiality have slightly different definitions, especially in a technical application. ISO 27000 defines confidentiality as "the property, that information is not made available or disclosed to unauthorized individuals, entities, or processes." The key here is "unauthorized." Confidentiality aims to provide a dependable way to share information only with those authorized and hide information from all other parties without leaks. This also includes information that could compromise other sensitive information, like CPU timing and power used during cryptography.

Privacy is both a cultural and legal standard that varies widely, and can include the right to be anonymous, the right to choose who information is disclosed to, the absence of intrusion, the right to conceal delicate information, and limitations on access to certain personal possessions (like my hard drive or in-home cameras). Not only do some of these categories not fall cleanly under the defintion of confidentiality, but there are some categories where information access is authorized but still violates privacy.

For example, medical information must follow strict privacy policies. If any of these policies are violated (e.g. unconnected doctors accessing medical records or failure to properly inform a patient how their information is being used) this would be a privacy violation but not a failure of the information security. If someone unconnected in another country hacked into the medical records, that'd be a violation of privacy and confidentiality. Similarly, a database could be set up in the US to allow parents access to college students' grades. While this database could pass security checks with flying colors, it would violate local privacy laws. This is complicated by the fact that confidentiality and privacy are colloquially synonyms. You could say that disclosing grades to parents is a breach of confidentiality, but from a technical perspective the confidentiality detailed in the security policy was not violated.

TL;DR: In infosec confidentiality states that sensitive information should only be visible to parties who have been authorized by the security policy, while privacy is much more complex and holds that sensitive information should only be shared with the intended parties. Access to information can still violate privacy even when all access must be authorized. This is ok because CIA is not comprehensive.

Answer 2

Confidentiality is generally a privacy concern. It's just a more general term.

It's like saying animal instead of dog.

In addition to the definitions, you can confirm that by searching for synonyms of privacy and synonyms of confidentiality. You can use confidentiality instead of privacy, but not the opposite.

Answer 3

Privacy is a legal concept. It varies from place to place to place (both in content and extent).

In other words, it is not possible to define what should be done to ensure "privacy". The concept of ensuring confidentiality for specific data is part of security (the C in your list). "Privacy", when defined, may be one of the data candidates for confidentiality.

Answer 4

Generally we speak of privacy for personal data (it is mine, and I do not want anyone else to see it) and confidentiality for professional data (only authorized people should see it). In that sense, confidentiality is a generalization of privacy.

On another hand, IT security is a major concern for organizations (or it should be...) and professionals of IT security are mainly concerned with organizations’ security.

By the way, there is a 4th pillar even if it is generally not seen as being as important as the 3 others: traceability (who did what).

Answer 5

Because security and privacy have different (some similar) properties:

• Security properties: CIA (Confidentiality, Integrity, Availability), AAA (Authentication, Authorization, Accountability), Nonrepudiation.
• Privacy properties (based on LINDDUN mnemonic: Link): Unlinkability, Anonymity and Pseudonymity, Plausible deniability, Undetectability and Unobservability, Confidentiality, Content awareness, Policy and consent compliance.

So that they have different purpose:

• Security (Chapter 11 on Link): ability to protect system against accidental or deliberate intrusion.
• Privacy (based on LINDDUN paper above): ability to protect personal information from being revealed to unauthorized subjects.

However, as well as usability, I think privacy can become also considering as one of secure design principles. For example, antivirus is not only usable, but also must protect user privacy like MAPS feature to automatically report malware to Microsoft on Microsoft Security Essential by creating a privacy statement.

Answer 6

Confidentiality, integrity and availability are used to describe attributes of information and their meanings are fairly clear cut, generally speaking people will come up with broadly consistent definitions. And while the necessity to maintain those attributes may differ the meaning will be the same.

Privacy is a concept or right, and even if considering only its relevance to information there is no one simple meaning that is all encompassing, it can mean different things to different people and may be dependent on context.

The legal aspect in WoJ's answer is directly relevant, for example, as far as I recall in UK legislature there is no single legal definition for privacy only contextual precedent etc.

Answer 7

Privacy often is not your goal

Privacy cannot be a pillar of Information Security because maintaining privacy is not a fundamental goal of IS policy - it might be a goal, but depending on your circumstances, your goal may be to reduce privacy.

Information Security concerns with designing and implementing systems so that the information in those systems is secure and used only according to some policy. Privacy violations, on the other hand, are more about the contents of that policy - often a major violation of privacy is "working as intended" according to the policies.

Conflicting interests

Your privacy is useful to you, but the privacy of others may not be. Information Security in some organization concerns with protecting the interests and mitigating risks of that organization. Privacy, on the other hand, generally concerns interests of people outside the organization, which may be entirely opposite. An organization may have a legitimate interest to violate privacy (up to the extent legally allowed) by tracking people and taking de-anonymizing measures to increase sales, lower fraud, etc; or simply a profit motive to earn money by selling the private data. IS would be concerned with unintentional violations of privacy/confidentiality and mitigating risks of liability, PR and legal compliance, but not with protecting interests of others as long is it's in your interest to do so.

Legal requirements to avoid privacy

There may also be legal requirements to reduce privacy and prevent possibilities for anonymity or pseudonymity. For example, KYC (know your customer) legislation in financial industry; contractual agreements to provide private data (violating privacy) for fraud monitoring purposes, and legislation to identify and register certain types of users all impose IS needs that explicitly are anti-privacy. You will still have confidentiality concerns about this data, but in some aspects you will intentionally use them in a privacy-violating way.

Answer 8

For a practical understanding of the difference between privacy and security I would direct you to OMB Circular A-130 issued this summer.

The relevant excerpt:

While security and privacy are independent and separate disciplines, they are closely related, and it is essential for agencies to take a coordinated approach to identifying and managingsecurity and privacy risks and complying with applicable requirements." Privacy goes well beyond CIA and should not be confused with security. Privacy is concerned with the use of personally identifiable information, the sharing of that information, transparency, notice, choice, individual participation, and other issues related to the collection, creation, use, processing, storage, sharing, transfer, and disposal of PII. Privacy issues arise in many contexts related to the collection and use of information about individuals even when there are no security issues and there are no issues related to unauthorized access.

Answer 9

In the data protection classification, (ISC)^2 distinguishes "confidential" and "private". Both of them are considered the highest level of non-military "classified" information which needs to be protected from the public (lower levels are "sensitive" and "public"). Here, "private" explicitely refers to information related to human beings. Since "information security" very often relates to the security of enterprises you'll find more references to "confidentiality" than to "privacy". What Google or Facebook do with your private information is not of central relevance for companies.

Answer 10

The "Privacy of X", where X is some sensitive data, is the amount of control somebody should expect to have of that data.

Security provides the level of control required to assure that privacy. That is, the controls that assure the expected confidentiality, the expected integrity (i.e. protection from change) and the expected availability of the data to themselves or other authorised parties.