18 Questions
What is a potential consequence of unauthorized data modification?
Financial loss
What is the primary goal of confidentiality in information security?
To limit access to information
What is a potential legal implication of a security breach?
Lawsuits from investors or customers
Where does corporate information typically reside in an enterprise system?
Application servers and databases
What is the main purpose of integrity in information security?
To prevent information from being modified
What is information security also known as?
InfoSec
What is the primary concern of application and data confidentiality?
restricting access to sensitive data to authorized users
What is the purpose of categorizing data according to the impact of unauthorized access?
to implement more or less stringent security measures
Why is it essential to restrict access to sensitive information in a B2B website?
to ensure that only authorized corporate customers have access to their respective discounts
What is the primary objective of implementing access control in an enterprise system?
To ensure confidentiality, integrity, and availability of data
What is the primary goal of system confidentiality?
to prevent unauthorized access to network and host
In the context of the OASIS system, what is the primary function of mentors?
To view and manage student academic results
What is the relationship between data sensitivity and security measures?
more sensitive data requires more stringent security measures
What type of access control strategy is suitable for an enterprise system like OASIS?
Role-Based Access Control (RBAC)
What is an example of sensitive information that requires confidentiality?
all of the above
What is a critical aspect of designing an access control system for Woodlands Polytechnic?
Ensuring separation of duties and least privilege principles
What is the primary objective of authorization in an enterprise system?
To determine user access privileges
What is a potential security risk in the OASIS system?
Unrestricted access to student data
Study Notes
Data Security Risks
- Unauthorized data modification can go unnoticed, leading to financial loss and legal implications
- Examples of financial loss include theft of money and recovery of security incidents
- Legal implications include lawsuits from investors, customers, or the public due to security or privacy breaches
Information Security
- Information security (InfoSec) is the practice of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording, or destruction of information
- Corporate information resides on application servers and databases
- CIA (Confidentiality, Integrity, and Availability) considerations are essential for InfoSec
- Confidentiality ensures that information is only accessible to authorized parties
- Integrity ensures that information is trustworthy and accurate by preventing unauthorized modification
Application Security
- Application security involves mitigating security risks on web forms by performing input validation
- Other potential threats include SQL injection and cross-site scripting
CIA Model
- The CIA model is used to ensure confidentiality, integrity, and availability of data
- Data can be categorized according to the impact of unauthorized access, and security measures can be implemented accordingly
- Application and data confidentiality ensure that access is restricted to authorized users
Case Study: Woodlands Polytechnic
- Woodlands Polytechnic uses OASIS to manage student particulars, attendance, and academic results information
- The system provides various functions, including mentor and student access to academic results and student particulars
- An appropriate access control strategy is required to ensure the security of the system
Test your understanding of application security principles, including input validation, SQL injection, and the CIA model. Learn how to protect sensitive data and mitigate security risks.
Make Your Own Quizzes and Flashcards
Convert your notes into interactive study material.
Get started for free
