3

As the title suggests, can you name an example when your information would be private but insecure? Or does privacy imply security?

  • un-encrypted flash drives are private, until you lose them, then security comes into play... – dandavis Apr 5 '18 at 22:23
  • 2
    mutually exclusive? no, that doesn't makes sense. – dandavis Apr 5 '18 at 22:42
  • Privacy can be frail, just like security. You can have privacy with frail security, up until the point where that security fails. You can also have frail privacy with good security due to information being aggregated, shared, used out of the context under which it was submitted, etc. – pseudon Apr 7 '18 at 16:31
2

Privacy (in the form of confidentiality) is a subset of information security.

Information security is composed of three primary concepts, together called the CIA triad. It stands for Confidentiality, Integrity, and Availability. Privacy itself is the act of maintaining the confidentiality of sensitive information, allowing it to be only shared with authorized parties. The violation of privacy would be a violation of confidentiality, in effect breaking security. Now, security implies privacy, but not necessarily the other way around. For example, you may be able to control the flow of your information so it does not fall into the wrong hands, but if someone is able to destroy or otherwise deny legitimate access to the information, they have violated availability, even if they are not privy to the sensitive content itself. This would break one aspect of security without breaking the rest.

A simple real-world example would be TLS, used to encrypt browsing traffic. TLS provides confidentiality (the data being transmitted cannot be viewed by unauthorized parties) and integrity (the data cannot be tampered with en route to its destination), but it does not provide availability. It is trivial to deny access to a TLS connection simply by mounting a denial of service attack, or even unplugging the modem. This would be a case where privacy cannot be violated, but availability is not at all guaranteed. Without availability, you have just lost a major requirement for security.

  • It's too limiting to only discuss privacy in the form of confidentiality. There are many theories of privacy, and no consensus definition. Control, obscurity, context, and other aspects are also very important. But in few or no senses are privacy and security mutually exclusive. If anything, security is a necessary but insufficient condition for privacy. – pseudon Apr 7 '18 at 15:45
  • @pseudon Sure, but the CIA triad is a simplification. – forest Apr 8 '18 at 1:05
0

Having a door on your home gives you privacy but without a lock on it - its not secure.

When you submit data the expectation is that the data will not then be shared amongest all employees in a company. This doesnt mean it has been secured so that someone cannot try to gain access to say a excel sheet ina shared directory with customer data and no security controls.

Where privacy is expected, security controls are how its ensured.

-3

Privacy is not the same thing as anonymity.

Anonymity provides privacy, but it also undermines trust. OTOH, privacy is not anonymity and is in direct opposition to trust. And trust is essential to assuring confidentiality and integrity which I am sure you are aware are 2 of the 3 tenets of security.

Walking into your bank and presenting your bank card will result in a very different experience from walking into your bank wearing a ski mask and asking for money.

  • The question is about privacy and security, not privacy and anonymity. – forest Apr 6 '18 at 5:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.