Which of the following Confidentiality, Integrity, Availability (CIA) attribute supports the principle of least privilege by providing access to information only to authorized and intended users?
Correct Answer: A
Confidentiality supports the principle of "least privilege" by providing that only authorized individuals, processes, or systems should have access to information on a need-toknow basis. The level of access that an authorized individual should have is at the level necessary for them to do their job. In recent years, much press has been dedicated to the privacy of information and the need to protect it from individuals, who may be able to commit crimes by viewing the information.
Identity theft is the act of assuming one's identity through knowledge of confidential information obtained from various sources.
An important measure to ensure confidentiality of information is data classification. This helps to determine who should have access to the information (public, internal use only, or confidential). Identification, authentication, and authorization through access controls are practices that support maintaining the confidentiality of information.
A sample control for protecting confidentiality is to encrypt information. Encryption of information limits the usability of the information in the event it is accessible to an unauthorized person.
For your exam you should know the information below:
Integrity Integrity is the principle that information should be protected from intentional, unauthorized, or accidental changes.
Information stored in files, databases, systems, and networks must be relied upon to accurately process transactions and provide accurate information for business decision making. Controls are put in place to ensure that information is modified through accepted practices.
Sample controls include management controls such as segregation of duties, approval checkpoints in the systems development life cycle, and implementation of testing practices that assist in providing information integrity. Well-formed transactions and security of the update programs provide consistent methods of applying changes to systems. Limiting update access to those individuals with a need to access limits the exposure to intentional and unintentional modification.
Availability Availability is the principle that ensures that information is available and accessible to users when needed.
The two primary areas affecting the availability of systems are:
1.Denial-of-Service attacks and
2.Loss of service due to a disaster, which could be man-made (e.g., poor capacity planning resulting in system crash, outdated hardware, and poor testing resulting in system crash after upgrade) or natural (e.g., earthquake, tornado, blackout, hurricane, fire, and flood).
In either case, the end user does not have access to information needed to conduct business. The
criticality of the system to the user and its importance to the survival of the organization will
determine how significant the impact of the extended downtime becomes. The lack of appropriate
security controls can increase the risk of viruses, destruction of data, external penetrations, or
denial-of-service (DOS) attacks. Such events can prevent the system from being used by normal
users.
CIA
The following answers are incorrect:
Integrity - Integrity is the principle that information should be protected from intentional,
unauthorized, or accidental changes.
Availability - Availability is the principle that ensures that information is available and accessible to
users when needed.
Accuracy - Accuracy is not a valid CIA attribute.
Following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 314
Official ISC2 guide to CISSP CBK 3rd Edition Page number 350
