Questions tagged [confidentiality]

Confidentiality is the property of maintaining the secrecy of an asset. In other words, confidentiality means protecting against the threat of disclosure. It is one of the three key security properties of an asset, along with integrity and availability.

Filter by
Sorted by
Tagged with
0
votes
0answers
32 views

When signature dont guarantee non repudiation

Ehy guys, I read that signature guarantee non repudiation. But in generale exist a way ti no guarantee non repudiation with signature? Ad example Enc(signature(m) should be guarantee Instead for ...
1
vote
1answer
51 views

Alternative approaches to letting users identify themselves while maintaining privacy

This is kind of a weird question maybe, so let me explain a little background first that I hope is relevant. I work as a Developer/Analyst for an organization that operates in a federated model with ...
0
votes
0answers
30 views

What are the main differences between a covert timing channel and a covert storage channel?

I am trying to find the differences between a covert timing channel and a covert storage channel in terms of detectability, performance, features, and any other advantages and disadvantages. Is ...
24
votes
4answers
11k views

Why define CIA in security like this?

As we know CIA of the demand for security means: Confidentiality Integrity Availability I don't understand why define the "Integrity" and "Availability`, If we make a plaintext Confidentiality, the ...
0
votes
1answer
128 views

Forced to install certificate on my laptop when using company WiFi. Risk? [duplicate]

My company has a 'bring your own device' policy. You connect your device to the WiFi, and then open a citrix environment through a web portal. Basically, everything inside the citrix env is company-...
2
votes
0answers
124 views

How do you securely delete httpOnly cookies previously used for login?

I am using Angular 8 with Node.js (Express.js) to make a login system. It needs to be secure. I have set the cookies using httpOnly:true, which contain a JWT token and it should be deleted by the ...
2
votes
0answers
50 views

Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?

Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
1
vote
2answers
97 views

How to Prove you created IP using a Notary

Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
1
vote
1answer
83 views

What's the safest way to store data on a server abroad? [closed]

A very good friend of mine is a journalist in a country where the state is becoming more and more despotic. She would like to store critical data on a server abroad. Is there any service that would ...
2
votes
1answer
44 views

MongoIDs and confidentiality

Given an application backed by a MongoDB database. Documents that are generated via the backend are assigned a BSON ObjectIDs (a hex string) to identify them, unlike SQL like IDs which are usually ...
0
votes
2answers
157 views

Can importing an .ics file be dangerous?

Can there theoretically be any possible malicious code hidden in .ics files, which would steal your calendar data or something similar? For an example case, we'd be importing the .ics file into Google ...
0
votes
1answer
222 views

What is the difference between concealment and secrecy in context of confidentiality?

I just started studying up for the CISSP and am having trouble understanding few concepts. This is regarding confidentiality, Below are some of the aspects of confidentiality Sensitivity Discretion ...
3
votes
2answers
112 views

How do ERP systems track classified business activity?

One of the selling points of Enterprise Resource Planning systems like SAP or Oracle E-Business Suite is their claim to give management visibility across the business, by aggregating (or at least ...
0
votes
3answers
291 views

I found a website that lists all the email addresses of Facebook users in UK. What do I do? [closed]

I came across this very peculiar website that supposedly lists the email addresses of Facebook users in the UK. I will not be posting the URL for obvious reasons. I entered a couple of emails to see ...
0
votes
0answers
38 views

When sharing confidential information, which is more secure share via Outlook vs store on Sharepoint then provide access?

I'm trying to figure out what is good practice and what is more secure for my small team. I wanted to set a standard or governance on how to share confidential information within our team. One person ...
0
votes
1answer
249 views

Why do I see bridged devices when monitoring Wi-Fi activity?

I'm trying to figure out what information about my infrastructure can leak through Wi-Fi. I ran Kismet and was surprised to see that a few minutes later, Kismet displayed not only the MAC addresses ...
2
votes
1answer
93 views

Can the System Admin (the main guy with all the permissions) decrypt confidential data from the server?

We have a company Foo, we have user data all encrypted that are stored in some kind of a database. Correct me if I am wrong, the encryption keys have to be saved in the system. Now say the admin ...
0
votes
1answer
79 views

Is there any 'Open Enrypted File Container' Format?

Tools that create 'encrypted file containers' use open encryption standards like AES to encrypt container contents, however the container format is proprietary, I am guessing, so need the same tool to ...
1
vote
1answer
200 views

Why “ Simple Integrity Property” axiom of Biba model protects data integrity?

I am reading CISSP and more specifically the Biba model. Biba has some basic properties: The Simple Integrity Property states that a subject cannot read an object at a lower integrity level (no read-...
1
vote
2answers
131 views

What are the security implications of losing a paper calendar?

Assuming I have a paper calendar (organizer) with the following information on it: dates/locations where I have been and where I'm planning to go phone numbers and e-mail addresses of a few people my ...
1
vote
1answer
435 views

Does steganography ensure confidentiality?

Can we say that steganography ensures confidentiality? I think it does not ensure because it is based on the security through obscurity and then it does not respect Kerckhoffs's principles, but the ...
0
votes
0answers
92 views

Why do people redact MAC addresses? [duplicate]

What are the security implications of sharing a MAC address online? How important is it really, to redact this information; and why? I see it a lot, and I'm in the habit of doing it myself. 1. ...
0
votes
2answers
89 views

Is there any way to track the status of a document sent to an external entity?

I'm wondering what the capabilities for document (PDF/DOCX/XLSX/PPTX) tracking are , specifically to determine whether a client has broken a non-disclosure agreement. Here's a scenario: Service ...
2
votes
1answer
181 views

Imagine I found a fast algorithm for prime factorization. What to do? Who to contact? [closed]

I'm often playing around with prime numbers, just for fun. Imagine, I found an algorithm by accident that factorizes numbers into their prime parts exactly as fast as multiplicating them in the first ...
0
votes
4answers
127 views

Travel information and passport

I travel a lot and I am looking a good way to send my travel information, like hostel, passports etc. to send to my family before leaving. This information is confidential. Actually, I am using a Zip ...
0
votes
2answers
143 views

Privacy of client's virtual machine in cloud computing

As we know clients can create and run their virtual machines (VM)in the cloud computing. My question is about the confidentiality of data stored in the client's VM. Question 1: Does data stored in a ...
5
votes
1answer
2k views

Android Messages Web and Privacy

Recently Google rolled out the feature to send SMS/Chat messages over Web via their Android Messages app. The approach seems similar to the WhatsApp Web Client. What I didn't find however are ...
0
votes
2answers
125 views

User generated search queries

Are user generated search queries classed as sensitive data? For example, if an application put PII from a search query such as names, date of birth, addresses etc. in the query string of a URL (...
1
vote
1answer
380 views

Do symmetric cryptographic primitives provide both integrity and confidentiality?

I understand that symmetric cryptographic algorithms provide confidentiality through the use of a key to encrypt plain text to cipher text but how can they provide for integrity as well? Would it not ...
-1
votes
1answer
3k views

Question about compare Bell-LaPadula and Biba models with Chinese wall policy

what the Chinese wall models try to achieve and how it differ from or improve upon the Bell-LaPadula and Biba models
4
votes
1answer
2k views

Authentication as CIA triad

As we all know, information security principles are stated as CIA triad, i.e., confidentiality, integrity, and availability. I wonder why authentication is not a part of CIA triad as being an ...
1
vote
1answer
146 views

A safe digital typewriter

If I understand well, it is now well documented that all Intel chips should be considered as back doored because of the Intel Management Engine. I guess one should now consider that all chips over a ...
4
votes
2answers
503 views

When using HTTPS, which part of domain is revealed to ISP? [duplicate]

Let's say you are visiting https://57vdyr6tyuibgyoihp.blogspot.com. Does the ISP only see the blogspot.com part, or the entire 57vdyr6tyuibgyoihp.blogspot.com?
1
vote
1answer
895 views

Confidentiality doesn't provide integrity, but it does enable it?

I've heard it stated that it is a common misconception that encryption provides data integrity. A highly voted question on this topic - Does encryption guarantee integrity? - has some very insightful ...
3
votes
1answer
106 views

Is this a valid secure cookie scheme?

I have a scheme for a cookie with high-level confidentiality of information. The information to be hidden from the client is the expiration time of the cookie. I am wondering what insecurities i am ...
1
vote
1answer
177 views

Security aspect vs Security goal

What is the difference between a security goal and a security aspect ? I know about the three network security goals Confidentiality, Integrity and Availability. But I do not know much about security ...
4
votes
1answer
225 views

Gravatar - Is it a security risk for medical forums?

If site forums use Gravatar, and the users are predominantly posting personal information about mental health issues, is this a security risk? Should the site consider turning off, or allowing opt ...
-1
votes
3answers
151 views

Should Risk Impact (not likelihood or overall risk) be quantified by the initial impact, or should you quantify by eventual (potential) impact [closed]

I am undertaking a risk assessment and trying to work out the risk impact on confidentiality for if a company employee (specifically a System Administrator) steals Server Hardware. On the one hand ...
8
votes
7answers
2k views

how to send confidential data through email?

At the moment I'm doing the following: add to zip and encrypt files send the encrypted zip to the recipient create a note through noteshred.com share the link through out-of-band SMS noteshred is ...
11
votes
2answers
3k views

Is the image of the signature considered PII?

I wrote a pay app and as part of that, I have a HTML5 canvas where buyers can sign for credit card or goods received. I then ajax the base64 back to the server in a DB table (genius, I know). I also ...
0
votes
2answers
200 views

Prevent organization's code from being leaked or stolen [duplicate]

I am wondering how I can control the organization's code from being leaked or stolen. Currently we are using GitHub, in order to protect the code I am planing to use GitLab on a local server, so the ...
4
votes
3answers
32k views

authenticity, confidentiality & integrity - general questions

I am pretty new when it comes to information security. And before I move on with more specific things I wanted to ask if I understood the three main parts of IPsec correctly: authenticity, ...
0
votes
3answers
173 views

How to keep client data confidential when attacked by a ransomware?

Hypothetical scenario: If a ransom-ware attack was to happen which threatened to make public "private client data" if you didn't pay up. Assuming such a virus exists and you've already been infected,...
7
votes
2answers
278 views

If smart hardware is evil can I still securely run software?

I was thinking. And I was searching the Internet. I want to check if there is more than I found. I considered asking on crypto.se. But the question might involve hardware and out of the box thinking. ...
2
votes
0answers
72 views

Is common_schema safe?

Edit: this already has an answer here. I just ran across common_schema, a utility for MySQL database administrators. It is a SQL script that creates a schema called common_schema in your database and ...
1
vote
2answers
218 views

Identify a user using random characters of the password

Assuming a password is not stored in plain-text, how is it possible that a support guy is able to identify during a phone call a customer by asking him random characters of his password? For example, ...
1
vote
2answers
722 views

Confidentiality and Integrity violation in database security

I read some topics on database security. Now I have two questions about confidentiality and integrity violation, Thanks anyone who answers me: If we consider knowing the availability of data as a ...
5
votes
2answers
2k views

What security operations provide confidentiality, integrity and authentication?

I'm a newbie in security. I read a lot (recently read this book), and now asking question just to be sure if I understood everything. Here are my questions (or assumptions), which of them are correct?...
0
votes
0answers
70 views

What Is The Authorities' Stance On The Use of Microsoft Office For Sensitive Information?

I want to know what the U.S. (or E.U. countries) policy is towards the use of Microsoft Office (particularly local versions) and potentially sensitive information requiring clearance. In particular, ...
3
votes
3answers
870 views

Any solutions out there to counter shoulder surfing?

I'm talking about an unknown or undetected physical presence who may be looking over your shoulder as you view or type in sensitive information or passwords. Most likely to happen when you are ...