Questions tagged [confidentiality]

Confidentiality is the property of maintaining the secrecy of an asset. In other words, confidentiality means protecting against the threat of disclosure. It is one of the three key security properties of an asset, along with integrity and availability.

Filter by
Sorted by
Tagged with
0
votes
1answer
97 views

What is the difference between concealment and secrecy in context of confidentiality?

I just started studying up for the CISSP and am having trouble understanding few concepts. This is regarding confidentiality, Below are some of the aspects of confidentiality Sensitivity Discretion ...
3
votes
2answers
105 views

How do ERP systems track classified business activity?

One of the selling points of Enterprise Resource Planning systems like SAP or Oracle E-Business Suite is their claim to give management visibility across the business, by aggregating (or at least ...
0
votes
3answers
278 views

I found a website that lists all the email addresses of Facebook users in UK. What do I do? [closed]

I came across this very peculiar website that supposedly lists the email addresses of Facebook users in the UK. I will not be posting the URL for obvious reasons. I entered a couple of emails to see ...
0
votes
0answers
31 views

When sharing confidential information, which is more secure share via Outlook vs store on Sharepoint then provide access?

I'm trying to figure out what is good practice and what is more secure for my small team. I wanted to set a standard or governance on how to share confidential information within our team. One person ...
0
votes
1answer
178 views

Why do I see bridged devices when monitoring Wi-Fi activity?

I'm trying to figure out what information about my infrastructure can leak through Wi-Fi. I ran Kismet and was surprised to see that a few minutes later, Kismet displayed not only the MAC addresses ...
2
votes
1answer
93 views

Can the System Admin (the main guy with all the permissions) decrypt confidential data from the server?

We have a company Foo, we have user data all encrypted that are stored in some kind of a database. Correct me if I am wrong, the encryption keys have to be saved in the system. Now say the admin ...
0
votes
1answer
59 views

Is there any 'Open Enrypted File Container' Format?

Tools that create 'encrypted file containers' use open encryption standards like AES to encrypt container contents, however the container format is proprietary, I am guessing, so need the same tool to ...
1
vote
1answer
126 views

Why “ Simple Integrity Property” axiom of Biba model protects data integrity?

I am reading CISSP and more specifically the Biba model. Biba has some basic properties: The Simple Integrity Property states that a subject cannot read an object at a lower integrity level (no read-...
1
vote
2answers
130 views

What are the security implications of losing a paper calendar?

Assuming I have a paper calendar (organizer) with the following information on it: dates/locations where I have been and where I'm planning to go phone numbers and e-mail addresses of a few people my ...
1
vote
1answer
381 views

Does steganography ensure confidentiality?

Can we say that steganography ensures confidentiality? I think it does not ensure because it is based on the security through obscurity and then it does not respect Kerckhoffs's principles, but the ...
0
votes
0answers
84 views

Why do people redact MAC addresses? [duplicate]

What are the security implications of sharing a MAC address online? How important is it really, to redact this information; and why? I see it a lot, and I'm in the habit of doing it myself. 1. ...
0
votes
2answers
85 views

Is there any way to track the status of a document sent to an external entity?

I'm wondering what the capabilities for document (PDF/DOCX/XLSX/PPTX) tracking are , specifically to determine whether a client has broken a non-disclosure agreement. Here's a scenario: Service ...
2
votes
1answer
172 views

Imagine I found a fast algorithm for prime factorization. What to do? Who to contact? [closed]

I'm often playing around with prime numbers, just for fun. Imagine, I found an algorithm by accident that factorizes numbers into their prime parts exactly as fast as multiplicating them in the first ...
0
votes
4answers
123 views

Travel information and passport

I travel a lot and I am looking a good way to send my travel information, like hostel, passports etc. to send to my family before leaving. This information is confidential. Actually, I am using a Zip ...
0
votes
2answers
117 views

Privacy of client's virtual machine in cloud computing

As we know clients can create and run their virtual machines (VM)in the cloud computing. My question is about the confidentiality of data stored in the client's VM. Question 1: Does data stored in a ...
5
votes
1answer
1k views

Android Messages Web and Privacy

Recently Google rolled out the feature to send SMS/Chat messages over Web via their Android Messages app. The approach seems similar to the WhatsApp Web Client. What I didn't find however are ...
0
votes
2answers
121 views

User generated search queries

Are user generated search queries classed as sensitive data? For example, if an application put PII from a search query such as names, date of birth, addresses etc. in the query string of a URL (...
1
vote
1answer
305 views

Do symmetric cryptographic primitives provide both integrity and confidentiality?

I understand that symmetric cryptographic algorithms provide confidentiality through the use of a key to encrypt plain text to cipher text but how can they provide for integrity as well? Would it not ...
-1
votes
1answer
2k views

Question about compare Bell-LaPadula and Biba models with Chinese wall policy

what the Chinese wall models try to achieve and how it differ from or improve upon the Bell-LaPadula and Biba models
4
votes
1answer
1k views

Authentication as CIA triad

As we all know, information security principles are stated as CIA triad, i.e., confidentiality, integrity, and availability. I wonder why authentication is not a part of CIA triad as being an ...
1
vote
1answer
142 views

A safe digital typewriter

If I understand well, it is now well documented that all Intel chips should be considered as back doored because of the Intel Management Engine. I guess one should now consider that all chips over a ...
4
votes
2answers
436 views

When using HTTPS, which part of domain is revealed to ISP? [duplicate]

Let's say you are visiting https://57vdyr6tyuibgyoihp.blogspot.com. Does the ISP only see the blogspot.com part, or the entire 57vdyr6tyuibgyoihp.blogspot.com?
1
vote
1answer
701 views

Confidentiality doesn't provide integrity, but it does enable it?

I've heard it stated that it is a common misconception that encryption provides data integrity. A highly voted question on this topic - Does encryption guarantee integrity? - has some very insightful ...
3
votes
1answer
101 views

Is this a valid secure cookie scheme?

I have a scheme for a cookie with high-level confidentiality of information. The information to be hidden from the client is the expiration time of the cookie. I am wondering what insecurities i am ...
1
vote
1answer
139 views

Security aspect vs Security goal

What is the difference between a security goal and a security aspect ? I know about the three network security goals Confidentiality, Integrity and Availability. But I do not know much about security ...
4
votes
1answer
210 views

Gravatar - Is it a security risk for medical forums?

If site forums use Gravatar, and the users are predominantly posting personal information about mental health issues, is this a security risk? Should the site consider turning off, or allowing opt ...
-1
votes
3answers
145 views

Should Risk Impact (not likelihood or overall risk) be quantified by the initial impact, or should you quantify by eventual (potential) impact [closed]

I am undertaking a risk assessment and trying to work out the risk impact on confidentiality for if a company employee (specifically a System Administrator) steals Server Hardware. On the one hand ...
8
votes
6answers
2k views

how to send confidential data through email?

At the moment I'm doing the following: add to zip and encrypt files send the encrypted zip to the recipient create a note through noteshred.com share the link through out-of-band SMS noteshred is ...
11
votes
2answers
3k views

Is the image of the signature considered PII?

I wrote a pay app and as part of that, I have a HTML5 canvas where buyers can sign for credit card or goods received. I then ajax the base64 back to the server in a DB table (genius, I know). I also ...
0
votes
2answers
184 views

Prevent organization's code from being leaked or stolen [duplicate]

I am wondering how I can control the organization's code from being leaked or stolen. Currently we are using GitHub, in order to protect the code I am planing to use GitLab on a local server, so the ...
2
votes
2answers
27k views

authenticity, confidentiality & integrity - general questions

I am pretty new when it comes to information security. And before I move on with more specific things I wanted to ask if I understood the three main parts of IPsec correctly: authenticity, ...
0
votes
3answers
168 views

How to keep client data confidential when attacked by a ransomware?

Hypothetical scenario: If a ransom-ware attack was to happen which threatened to make public "private client data" if you didn't pay up. Assuming such a virus exists and you've already been infected,...
7
votes
2answers
275 views

If smart hardware is evil can I still securely run software?

I was thinking. And I was searching the Internet. I want to check if there is more than I found. I considered asking on crypto.se. But the question might involve hardware and out of the box thinking. ...
2
votes
0answers
72 views

Is common_schema safe?

Edit: this already has an answer here. I just ran across common_schema, a utility for MySQL database administrators. It is a SQL script that creates a schema called common_schema in your database and ...
1
vote
2answers
218 views

Identify a user using random characters of the password

Assuming a password is not stored in plain-text, how is it possible that a support guy is able to identify during a phone call a customer by asking him random characters of his password? For example, ...
1
vote
2answers
655 views

Confidentiality and Integrity violation in database security

I read some topics on database security. Now I have two questions about confidentiality and integrity violation, Thanks anyone who answers me: If we consider knowing the availability of data as a ...
5
votes
2answers
1k views

What security operations provide confidentiality, integrity and authentication?

I'm a newbie in security. I read a lot (recently read this book), and now asking question just to be sure if I understood everything. Here are my questions (or assumptions), which of them are correct?...
0
votes
0answers
69 views

What Is The Authorities' Stance On The Use of Microsoft Office For Sensitive Information?

I want to know what the U.S. (or E.U. countries) policy is towards the use of Microsoft Office (particularly local versions) and potentially sensitive information requiring clearance. In particular, ...
3
votes
3answers
754 views

Any solutions out there to counter shoulder surfing?

I'm talking about an unknown or undetected physical presence who may be looking over your shoulder as you view or type in sensitive information or passwords. Most likely to happen when you are ...
1
vote
2answers
128 views

What policies and agreements regarding information security are a must have for every self respecting company?

I assume that it's a good idea to supply the users of a system (or employees) with policies and agreements regarding information security. What kind of documents should be considered? For example (...
6
votes
2answers
193 views

What issues exist in generating a signed, paper-based PGP message stored by a hostile organisation?

I have recently been the victim of having my medical record tampered with by the organisation holding it. Under state law I have a legal right to submit information to be included in my medical record,...
0
votes
0answers
24 views

Can confidential data be gotten from a “hibernation file”? [duplicate]

When a computer hibernates, AFAIK a copy of the RAM is saved into a file on disk. Is this a potential security flaw, knowing someone can take the disk and read the RAM freely?
4
votes
2answers
153 views

Internet browsing confidentiality [duplicate]

I wonder how easy or difficult it is to find out who I am, using information security's most advanced techniques. And what can I do that will not affect my browsing experience too much, as a lambda ...
4
votes
3answers
2k views

The history of thumbnails (or just a previous thumbnail) is embedded in an image file?

I was surprised when I cropped an image on Windows Phone, saved it, sent it via e-mail to a PC, and then downloaded it - and the thumbnail in the download folder was the one of original, not cropped ...
0
votes
2answers
86 views

Guarantee one unique identity per node

I'm in the early stages of designing a decentralised systems protocol, based on a blockchain, for a thesis. For the protocol to remain secure, each node in the system must be capable of generating one,...
1
vote
3answers
7k views

Are private pastes on pastebin.com vulnerable? Can you trust pastebin?

I use https://pastebin.com/ to organize some lists. When I select "Paste Exposure: Private" , will it be really private and only accessible via login? I read somewhere in the internet that there are ...
7
votes
2answers
7k views

Best reasonable way to store a secret safely

I'm working on a software that need to store and use secrets. These secrets can be for example: a password to connect to a database a client secret for an OAuth 2.0 client_credentials grant. I need ...
0
votes
2answers
574 views

Does SSL/TLS (https) reveals your IP address? [duplicate]

Because the NSA monitors traffic going through the major nodes of the internet, they can know which IP address does what on your website, even if you are using HTTPS. Is this true or false?
3
votes
2answers
491 views

What does it mean to have authentication without confidentiality or authentication without encryption?

I came across these functions m+EeA(H(m)) (for authentication without confidentiality) and m+H(m+k) (for authentication without encryption) and I'm having a bit of a difficult time understanding them. ...
11
votes
3answers
1k views

Using encryption inside of SSL connection

We are using SSL to make our connection between clients and backbone servers safer. Does it really make sense if also we use another encryption mechanism to encrypt transmitted data twice? For example,...