Information Security and Data Protection Awareness
Security staff hold and see sensitive information: visitor logs, staff rosters, CCTV footage, incident reports, keys and codes. The exam tests confidentiality, least privilege, social-engineering awareness, safe handling of footage and records, and prompt breach reporting.
The core model
Confidentiality (only authorised people see it), integrity (it is accurate and unaltered), availability (it is there when needed). Apply least privilege and need-to-know: a supervisor needs the roster; a visitor does not. Strong, unique passwords with multi-factor authentication, locked screens when leaving a desk, clean desks with no passwords on sticky notes, and controlled use of removable media.
Social engineering
Attackers ask, they do not hack. Common approaches: a caller claiming to be IT needing your password, a "contractor" wanting to plug in a laptop, an email urging urgent payment, a person at the gate seeking a staff member's mobile number. Defence: verify identity through a separate, known channel; never disclose credentials or personal data on an inbound call; refuse and report. Pretexting works because it applies pressure and flattery, so slow down and follow procedure.
Records and footage
Visitor logs, incident reports and CCTV are personal data. Share only on a lawful basis, with authorisation, minimum necessary content, secure transfer and a written record of who received what and when. Destroy or archive on the retention schedule; do not keep it forever because storage is cheap.
Worked example
A caller says he is the manager's driver and needs a staff member's mobile number urgently. Correct: refuse, offer to pass the caller's number to the staff member, verify through the known internal contact, and log the call. Reasoning: the request is plausible but unverified, and disclosure cannot be undone.
Traps
Sending a CCTV clip over personal WhatsApp; password sharing to cover a shift; helping a polite caller; leaving the incident book open on reception.