OK, so now we'll move on the first element of information security, and that is confidentiality.
Now, confidentiality requires that only authorized users have access to the protected and sensitive
data.
Confidentiality is nothing, but only the people who are intended to access the data should be able
to access those data.
Any other unauthorized users should not access that data.
Now, that are some of the practices employed to address the confidentiality, for example, ensure
that there is an authentication process within the organization so that people can authenticate to access
a resource or a piece of information, authentication, recoilless and user with identity and a password
like username and password and addressing the confidential data.
Now implement security controls.
That is why many companies on many organizations have audits in place to check whether the proper security
controls are being employed or not.
Then ensure that the access control policies are implemented.
Now, this point is very important when it comes to ensuring confidentiality, access control policies
are very important.
Access control policies actually define which people have access to water resources.
For example, if you are an employee, if you are an associate, you might not have the access to the
data which is supposed to be accessed by the upper management.
So in this case, there is an access control policy which restricts other users from accessing the data
from other people.
Now, let's have a simple scenario.
This is Bob and this is Alice.
And this is truly from the face.
You can see that truly is a bad guy.
Is a bad person.
No, Bob is trying to send some information to Alice.
Bob is trying to send some information to Alice here.
Now, let's say Bob is trying to tell some information about his meeting.
And if Trudy tries to intercept that data and is able to read the data through the medium, then we
can see that the confidentiality element is being violated.
In this case, people often employ techniques like encryption and decryption and public or private key
cryptography in order to, you know, restrict anyone from accessing the data.
For example, if Bob is trying to send a bank account number and if that data is then encrypted with
a strong encryption algorithm like the is all the details which we are going to see in the next sections.
And if that data is being sent, then Judy has no chance of, you know, reading that data, no see
truly can intercept and can have the encrypted text.
But then there's no point because that data is supposed to be interrupted with a key that only Alice
can see that data is so encryption mechanism and hashing is used to avoid the confidentiality.
So if Rudy is able to access this data in plain text, then we can see that the data is being violating
the confidentiality principle.
So basically, confidentiality means to ensure that the information is only accessible to authorized
individuals, that is, individuals with a real identity.
For example, the personal data of salaried employees must only be accessible by authorized human resources
department.
Now there are several types of access control which can ensure the confidentiality information and encryption.
Its example, which I just discussed.
It can be used to protect the confidentiality of information.
Access control policies, which we have just seen a couple of minutes ago, can be applied at different
levels of information security management system.
For example, at the physical level, you can have locks on your doors, then filing cabinet that locks
or safe walls and the logical level access controls to information or encryption.
So this was all about the first element of information security.
That is the confidentiality.
In the next lecture, we will see about integrity.