CPA ISC Area II.C Study Notes: Protecting Confidentiality and Managing Privacy

Confidentiality

Ensuring information is accessible only to authorized people, processes, and systems.

Privacy

Focuses on the rights and expectations around how personal information is collected, used, shared, retained, and disposed of.

CIA triad

A model for security that encompasses Confidentiality, Integrity, and Availability.

Data Classification

The process of categorizing data based on the impact of unauthorized disclosure.

Least Privilege

A principle that users should receive the minimum access necessary to perform their jobs.

Need-to-Know

A principle that emphasizes that users should only access specific sensitive data required for a task.

RBAC (Role-Based Access Control)

A model where permissions are grouped into roles and users gain access based on these roles.

ABAC (Attribute-Based Access Control)

An access control model that evaluates user attributes to make access decisions.

MFA (Multi-Factor Authentication)

A security method that requires multiple forms of verification to access resources.

Data Loss Prevention (DLP)

Tools designed to detect and prevent sensitive data from leaving authorized boundaries.

Data Masking

Obscuring parts of a data element to allow users to perform tasks without seeing full sensitive values.

Tokenization

Replacing sensitive data with a non-sensitive surrogate value, with the original stored securely.

Anonymization

The process of making data not reasonably identifiable to individuals.

Pseudonymization

Replacing direct identifiers with pseudonyms while still allowing for potential re-identification.

Key Management

The process of managing cryptographic keys, including generation, storage, access control, rotation, and destruction.

Encryption at Rest

Protects stored data, ensuring it is unreadable without the appropriate decryption key.

Encryption in Transit

Protects data moving across networks to prevent interception or unauthorized access.

Incident Response

The process of managing and addressing a data breach or security incident.

Privacy by Design

Incorporating privacy requirements into system and process design from the outset.

Retention Limitation

The principle that data should only be kept as long as necessary for its intended purpose.

Accountability in Privacy

The allocation of responsibility for data management policies and compliance oversight.

Data Handling Standards

Rules governing the storage, transmission, and retention of categorized data.

Access Control

Mechanisms that restrict access to sensitive data or systems based on user permissions.

Governance in Data Privacy

Establishing policies, roles, and procedures to manage how personal information is processed.

Purpose Limitation

The principle stating that personal data should only be used for specified legitimate purposes.

Compliance Failure

The failure to meet legal and regulatory obligations concerning data privacy or confidentiality.

Data Lifecycle

The stages data goes through: Collect/Create, Store, Use/Process, Share/Transmit, Retain/Archive, Dispose/Destroy.