Information Security Blog

Is Confidentiality still an Information Security Requirement?

Information Security To an “old school” infosec practitioner (like myself) confidentiality is the most emphasized element of the CIA triad (integrity/availability) because the risks associated with the failure to provide confidentiality are usually the biggest and the regulations can be the stickiest (e.g., PII, PCI, HIPAA).

“New school” practitioners are likely to view things a bit differently. When you have grown up with “where you are/what you did/who you did it with” posted for the world to see on MySpace/ Facebook … the boundaries between private and public are pretty thin. Rather than ramp back, many are continuously broadcasting their whereabouts and activities using Four Square and Twitter. GenY folks are just not all that concerned about confidentiality … because they are not that concerned about privacy.

My conversations with GenY have altered my views on privacy quite a bit. So has my work as a social engineer. So has the fact that I have had my Personally Identifiable Information disclosed by multiple retailers and a mortgage company. In short, the Genie is already out of the bottle and there is no way to get the cork back on. If you don’t agree with me, Google yourself, and take a look at tools like pipl.com, paterva.com, and jigsaw.com. If you’re anyone who has at least partially embraced the internet — birthdates, mortgages, judgments, addresses, your work history, your military records (including serial number), Social Security Numbers, purchases you made on Amazon, your woeful performance in your fantasy football league, posts you made on the dementia message boards — are all just a click away.

So if our “private” information is now “public” do we really need confidentiality? Does it really matter if someone knows my Social Security Number? Driver’s License Number? Address?

Sadly it probably still does — because those items are often inappropriately used as a form of authentication. However, as GenY folks take more prominent roles in politics and information security I would not be surprised to see some big changes. Most notably a de-emphasizing of confidentiality and an emphasizing of authentication and authorization.

I’m ready …