BD308 – Cyber Security-Amelia Nurul Mupty

1️⃣ Provide a real-world business example for a failure in Confidentiality, Integrity, and Availability.

A real-world example of a failure in confidentiality is the 2017 data breach experienced by Equifax, where sensitive personal information of millions of individuals, including Social Security numbers and birth dates, was exposed to unauthorized attackers. This incident demonstrates a failure to protect confidential customer data. An example of an integrity failure occurred in 2013 when Target suffered a cyberattack that compromised its payment systems, allowing attackers to capture and potentially alter transaction data. This undermined the accuracy and trustworthiness of the company’s financial records. For availability, the 2016 DDoS attack against Dyn disrupted access to many major websites, making them temporarily unreachable and demonstrating a failure to ensure system availability.

2️⃣ How might an e-commerce website prioritize one aspect of the CIA triad over the others for its product pages versus its payment processing system?

On product pages, an e-commerce website would likely prioritize availability, since customers must be able to browse products at any time. If the website is down, the company risks losing sales and customers. While integrity remains important to ensure accurate pricing and product descriptions, confidentiality is less critical because product information is generally public. In contrast, within the payment processing system, confidentiality and integrity become the highest priorities. Sensitive information such as credit card details must be kept secure, and transaction amounts must remain accurate and protected from manipulation. In this case, protecting customer data and ensuring correct transactions are more important than simply keeping the system online.

3️⃣ Explain the principle of “least privilege” and how it supports confidentiality.

The principle of least privilege states that users, systems, or applications should be granted only the minimum level of access necessary to perform their tasks. This principle supports confidentiality by limiting access to sensitive information to only those who truly need it. By reducing unnecessary access rights, organizations decrease the risk of data breaches, internal misuse, and damage caused by compromised accounts. If an account is hacked, the potential harm is minimized because its access is restricted.

done 100%