Questions tagged [confidentiality]

Confidentiality is the property of maintaining the secrecy of an asset. In other words, confidentiality means protecting against the threat of disclosure. It is one of the three key security properties of an asset, along with integrity and availability.

Filter by
Sorted by
Tagged with
7
votes
7answers
4k views

Implications of securing data in RAM

Someone told me that his company is storing all application data (at least the sensitive data I guess) in RAM for security. Their application runs for long periods of time, so data stays in memory for ...
1
vote
2answers
123 views

Is there any 'Open Enrypted File Container' Format?

Tools that create 'encrypted file containers' use open encryption standards like AES to encrypt container contents, however the container format is proprietary, I am guessing, so need the same tool to ...
1
vote
1answer
107 views

Is there any point in using PGP or S/MIME when your receipients mostly don't use it?

For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
1
vote
0answers
61 views

Keeping data confidential from the system administrator

Problem How do I ensure that I cannot access confidential data manually through the database? Practically speaking, this is a firestore database on google cloud, and I have access to the administrator ...
0
votes
0answers
43 views

Passing confidential data to an IFrame

There are two different web applications Host and App which are hosted separatedly, i.e. in particular on different domains. App is not designed to be accessed directly. Rather users are expected to ...
2
votes
2answers
56 views

MongoIDs and confidentiality

Given an application backed by a MongoDB database. Documents that are generated via the backend are assigned a BSON ObjectIDs (a hex string) to identify them, unlike SQL like IDs which are usually ...
0
votes
0answers
39 views

need to address a subset of CIA triad elements and not in entirety

Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad. ...
4
votes
1answer
14k views

Is there a specification for the color values representing information classification levels for the United States? [closed]

Executive Order 13526 section 1.2.⁠ Specifies Information may be classified as Top Secret, Secret, and Confidential. The absense of a classification is Unclassified. US Classification Levels are used ...
21
votes
5answers
3k views

Timing Safe String Comparison - Avoiding Length Leak

Let's say that we're building a generic timing-safe comparison function for general purpose use. Making it so that it is safe when both strings are equal length is pretty well known. However, what I'm ...
28
votes
7answers
18k views

Why encrypt data in memory?

I saw that KeePass not only encrypts its password-database-file, it also can encrypt the passwords it holds in memory. This is just an example. I thinking of a new project dealing with sensitve / ...
1
vote
2answers
432 views

What is the difference between concealment and secrecy in context of confidentiality?

I just started studying up for the CISSP and am having trouble understanding few concepts. This is regarding confidentiality, Below are some of the aspects of confidentiality Sensitivity Discretion ...
2
votes
1answer
1k views

How do you securely delete httpOnly cookies previously used for login?

I am using Angular 8 with Node.js (Express.js) to make a login system. It needs to be secure. I have set the cookies using httpOnly:true, which contain a JWT token and it should be deleted by the ...
4
votes
3answers
3k views

The history of thumbnails (or just a previous thumbnail) is embedded in an image file?

I was surprised when I cropped an image on Windows Phone, saved it, sent it via e-mail to a PC, and then downloaded it - and the thumbnail in the download folder was the one of original, not cropped ...
41
votes
3answers
5k views

Is passing sensitive data through the process environment secure?

Recently, I have been looking for the possibility to pass sensitive information from one process to another (at process startup time) without passing it through the command line or without using a ...
0
votes
0answers
37 views

When signature dont guarantee non repudiation

Ehy guys, I read that signature guarantee non repudiation. But in generale exist a way ti no guarantee non repudiation with signature? Ad example Enc(signature(m) should be guarantee Instead for ...
1
vote
1answer
57 views

Alternative approaches to letting users identify themselves while maintaining privacy

This is kind of a weird question maybe, so let me explain a little background first that I hope is relevant. I work as a Developer/Analyst for an organization that operates in a federated model with ...
0
votes
0answers
62 views

What are the main differences between a covert timing channel and a covert storage channel?

I am trying to find the differences between a covert timing channel and a covert storage channel in terms of detectability, performance, features, and any other advantages and disadvantages. Is ...
24
votes
4answers
11k views

Why define CIA in security like this?

As we know CIA of the demand for security means: Confidentiality Integrity Availability I don't understand why define the "Integrity" and "Availability`, If we make a plaintext Confidentiality, the ...
4
votes
3answers
39k views

authenticity, confidentiality & integrity - general questions

I am pretty new when it comes to information security. And before I move on with more specific things I wanted to ask if I understood the three main parts of IPsec correctly: authenticity, ...
0
votes
1answer
226 views

Forced to install certificate on my laptop when using company WiFi. Risk? [duplicate]

My company has a 'bring your own device' policy. You connect your device to the WiFi, and then open a citrix environment through a web portal. Basically, everything inside the citrix env is company-...
8
votes
7answers
2k views

how to send confidential data through email?

At the moment I'm doing the following: add to zip and encrypt files send the encrypted zip to the recipient create a note through noteshred.com share the link through out-of-band SMS noteshred is ...
2
votes
0answers
56 views

Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?

Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
1
vote
2answers
103 views

How to Prove you created IP using a Notary

Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
1
vote
1answer
85 views

What's the safest way to store data on a server abroad? [closed]

A very good friend of mine is a journalist in a country where the state is becoming more and more despotic. She would like to store critical data on a server abroad. Is there any service that would ...
0
votes
2answers
780 views

Can importing an .ics file be dangerous?

Can there theoretically be any possible malicious code hidden in .ics files, which would steal your calendar data or something similar? For an example case, we'd be importing the .ics file into Google ...
0
votes
3answers
295 views

I found a website that lists all the email addresses of Facebook users in UK. What do I do? [closed]

I came across this very peculiar website that supposedly lists the email addresses of Facebook users in the UK. I will not be posting the URL for obvious reasons. I entered a couple of emails to see ...
7
votes
2answers
292 views

If smart hardware is evil can I still securely run software?

I was thinking. And I was searching the Internet. I want to check if there is more than I found. I considered asking on crypto.se. But the question might involve hardware and out of the box thinking. ...
8
votes
4answers
8k views

How effectively can ISPs detect illegal file sharing?

Recently the USA passed a law requiring ISPs to spy on their customers' internet connections to check for illegal file sharing. I assume that they would do this by sniffing packets, but doesn't this ...
3
votes
2answers
122 views

How do ERP systems track classified business activity?

One of the selling points of Enterprise Resource Planning systems like SAP or Oracle E-Business Suite is their claim to give management visibility across the business, by aggregating (or at least ...
0
votes
1answer
347 views

Why do I see bridged devices when monitoring Wi-Fi activity?

I'm trying to figure out what information about my infrastructure can leak through Wi-Fi. I ran Kismet and was surprised to see that a few minutes later, Kismet displayed not only the MAC addresses ...
0
votes
0answers
42 views

When sharing confidential information, which is more secure share via Outlook vs store on Sharepoint then provide access?

I'm trying to figure out what is good practice and what is more secure for my small team. I wanted to set a standard or governance on how to share confidential information within our team. One person ...
21
votes
6answers
35k views

Getting rid of a large quantity of paper

Say you were in charge of getting rid of a large quantity of paper - up to 1,000 in a row. It can't be used as scratch paper because it contains confidential information. It also can't be outsourced ...
2
votes
1answer
94 views

Can the System Admin (the main guy with all the permissions) decrypt confidential data from the server?

We have a company Foo, we have user data all encrypted that are stored in some kind of a database. Correct me if I am wrong, the encryption keys have to be saved in the system. Now say the admin ...
1
vote
2answers
134 views

What are the security implications of losing a paper calendar?

Assuming I have a paper calendar (organizer) with the following information on it: dates/locations where I have been and where I'm planning to go phone numbers and e-mail addresses of a few people my ...
1
vote
1answer
270 views

Why “ Simple Integrity Property” axiom of Biba model protects data integrity?

I am reading CISSP and more specifically the Biba model. Biba has some basic properties: The Simple Integrity Property states that a subject cannot read an object at a lower integrity level (no read-...
18
votes
5answers
12k views

Keyboard sniffing through audio recorded typing patterns

I've been thinking about this for a while; I know people are aware of wireless wiretapping of keyboards. However, has there been research on how to wiretap keyboards based on typing patterns? I'm ...
5
votes
1answer
2k views

Android Messages Web and Privacy

Recently Google rolled out the feature to send SMS/Chat messages over Web via their Android Messages app. The approach seems similar to the WhatsApp Web Client. What I didn't find however are ...
1
vote
1answer
510 views

Does steganography ensure confidentiality?

Can we say that steganography ensures confidentiality? I think it does not ensure because it is based on the security through obscurity and then it does not respect Kerckhoffs's principles, but the ...
0
votes
0answers
116 views

Why do people redact MAC addresses? [duplicate]

What are the security implications of sharing a MAC address online? How important is it really, to redact this information; and why? I see it a lot, and I'm in the habit of doing it myself. 1. ...
0
votes
2answers
94 views

Is there any way to track the status of a document sent to an external entity?

I'm wondering what the capabilities for document (PDF/DOCX/XLSX/PPTX) tracking are , specifically to determine whether a client has broken a non-disclosure agreement. Here's a scenario: Service ...
3
votes
1answer
197 views

Imagine I found a fast algorithm for prime factorization. What to do? Who to contact? [closed]

I'm often playing around with prime numbers, just for fun. Imagine, I found an algorithm by accident that factorizes numbers into their prime parts exactly as fast as multiplicating them in the first ...
0
votes
4answers
138 views

Travel information and passport

I travel a lot and I am looking a good way to send my travel information, like hostel, passports etc. to send to my family before leaving. This information is confidential. Actually, I am using a Zip ...
0
votes
2answers
186 views

Privacy of client's virtual machine in cloud computing

As we know clients can create and run their virtual machines (VM)in the cloud computing. My question is about the confidentiality of data stored in the client's VM. Question 1: Does data stored in a ...
1
vote
1answer
189 views

Security aspect vs Security goal

What is the difference between a security goal and a security aspect ? I know about the three network security goals Confidentiality, Integrity and Availability. But I do not know much about security ...
5
votes
2answers
2k views

What security operations provide confidentiality, integrity and authentication?

I'm a newbie in security. I read a lot (recently read this book), and now asking question just to be sure if I understood everything. Here are my questions (or assumptions), which of them are correct?...
4
votes
1answer
249 views

Gravatar - Is it a security risk for medical forums?

If site forums use Gravatar, and the users are predominantly posting personal information about mental health issues, is this a security risk? Should the site consider turning off, or allowing opt ...
5
votes
3answers
509 views

Confidentiality and privacy

I understand that the confidentiality aimed at protecting access to the system data, while privacy aimed at protecting access to the person data. Now, could we consider anonymity as a sub-...
71
votes
6answers
59k views

Does SSL/TLS (https) hide the urls being accessed [duplicate]

Suppose I type this in my browser https://www.mysite.com/getsecret?username=alice&password=mysecret and an attacker is watching all traffic from me to my ISP. What information is protected by ...
0
votes
2answers
129 views

User generated search queries

Are user generated search queries classed as sensitive data? For example, if an application put PII from a search query such as names, date of birth, addresses etc. in the query string of a URL (...
1
vote
1answer
540 views

Do symmetric cryptographic primitives provide both integrity and confidentiality?

I understand that symmetric cryptographic algorithms provide confidentiality through the use of a key to encrypt plain text to cipher text but how can they provide for integrity as well? Would it not ...