Information Security
Information Security in this exam tests the protection of data throughout its lifecycle: classification, access control, cryptography, vendor handling and regulatory storage rules. Questions often target the CIA triad, ISO/IEC 27001, PCI DSS and RBI's payment-data localisation directive.
Core rules
- CIA triad plus: confidentiality, integrity and availability, supported by authenticity and non-repudiation.
- Classification and handling: data labelled public, internal, confidential or restricted, with matching storage, sharing and destruction rules.
- Access control: least privilege, need-to-know, segregation of duties and maker-checker; privileged accounts are vaulted and monitored.
- Cryptography: encryption in transit (TLS) and at rest; keys managed separately from data, rotated and backed up securely. Card data requires tokenisation or masking; CVV must never be stored.
- RBI localisation: payment system data must be stored only in India; if processed abroad, it must be brought back within 24 hours.
- ISO/IEC 27001: an ISMS based on risk assessment and Annex A controls, maintained through continual improvement, not a one-time certificate.
Worked example
A analytics vendor asks for the full customer database. The reasoned answer is data minimisation: share pseudonymised or aggregated fields, sign a data processing agreement, check cross-border transfer, log access and apply DLP. If card data is involved, use tokens rather than PANs and never expose CVV. Sharing the full database creates unnecessary confidentiality and regulatory exposure.
Traps
Equating information security with confidentiality alone; storing encryption keys alongside backups; assuming ISO certification guarantees security; sharing data with vendors without a DPA or transfer assessment.