Cisco CCNP Security Core (SCOR) 350-701Security ConceptsEasy
A security analyst is reviewing a recent data breach incident where customer credit card numbers were stolen from a compromised database. The investigation reveals that the database was accessible over the internet without proper authentication, and the data was stored in plain text. Which core security principle was primarily violated in this incident?
- AAvailability
- BConfidentiality
- CNon-repudiation
- DIntegrity
Show answer & explanationAnswer & explanation
Correct answer: B. Confidentiality
Confidentiality ensures that only authorized users can access sensitive information. Storing credit card numbers in plain text and making them accessible without authentication directly violates this principle, leading to unauthorized disclosure.
Why the other options are wrong
- A. Availability ensures systems and data are accessible when needed, which was not the primary issue here.
- C. Non-repudiation proves that a sender sent a message or an actor performed an action, which is not the core principle violated.
- D. Integrity ensures data is accurate and has not been tampered with, which was not the primary focus of this breach.
Confidentiality
The principle that sensitive information is protected from unauthorized access or disclosure.
- Ensures data privacy.
- Often implemented through encryption and access controls.
- Crucial for protecting personal and financial data.
Memory trick: CIA: 'C' for 'Cover' the secrets, 'I' for 'Intact' data, 'A' for 'Always' there.