Information Security and Ethics
Domain scope
Information security and ethics covers the CIA triad, threats and controls, authentication, encryption, backups, legislation and professional conduct. Questions often require matching a threat to a control and justifying an ethical response.
Core rules
- CIA: Confidentiality (only authorised access), Integrity (data accurate and unaltered) and Availability (accessible when needed).
- Malware categories: virus (attaches to files), worm (self-replicates across networks), Trojan (disguised as legitimate), ransomware (encrypts and demands payment) and spyware (covertly collects data).
- Authentication factors: something you know, something you have and something you are. MFA combines different types.
- Symmetric encryption uses one shared key; asymmetric encryption uses a public/private key pair. Hashing is one-way and checks integrity, not confidentiality.
- Backups follow the 3-2-1 pattern: three copies, two media and one off-site; test restoration.
Worked example
An employee receives an email urging immediate payment to a new supplier with a changed bank account. Classify the threat and propose two controls. Reasoning: this is phishing or social engineering, possibly business email compromise; it targets human trust rather than a technical flaw. Controls include verifying bank changes through a known phone number, enforcing MFA and email authentication, and training staff to report suspicious messages. Encryption alone does not stop a user from authorising a fraudulent transfer.
Traps
- Confusing integrity with confidentiality: encryption protects confidentiality; hashes and signatures help integrity.
- Saying a firewall stops phishing emails opened inside the network.
- Treating ethics as legality; an act can be legal but unethical.
- Backing up to the same disk and calling it a backup.