Information Security and Data Protection
Information Security and Data Protection tests CIA-based risk thinking, controls and the Sri Lankan legal floor. Know the Personal Data Protection Act No. 9 of 2022 and the Computer Crimes Act No. 24 of 2007 by role, not by quoting sections.
Core rules
- CIA: confidentiality, integrity, availability. Risk = likelihood × impact; treat by avoid, reduce, transfer or accept.
- Authentication proves identity; authorisation grants permissions; accounting/logging records actions.
- Encryption protects confidentiality; hashing checks integrity but is not encryption; backups protect availability, not confidentiality by themselves.
- The PDPA regulates processing of personal data and gives data subjects rights; the Computer Crimes Act criminalises unauthorised access and related offences. Sri Lanka CERT supports incident response.
Worked example
An officer loses an unencrypted USB containing citizen records. Reasoning: contain the incident, preserve evidence, assess data sensitivity and number of affected people, inform management and the data protection lead, and follow PDPA notification duties and legal advice. Then fix the cause: encrypted removable media, minimum data copies, logging and staff training. Do not simply overwrite the device before investigation.
Traps
Do not say hashing is reversible; do not confuse authentication with authorisation; do not treat antivirus as a complete control; and do not notify the public before assessing facts. 'Consent' is not the only lawful basis for processing under a data protection regime.