We're starting this course by talking about the CyberSecurity Triad of Confidentiality, Integrity and Availability. This triad forms the three pillars of Data Privacy. We start with Confidentiality.

Every time you collect and store data, you make decisions about the confidentiality required of that data. Being CyberSecure means ensuring that private data stays private. Although this sounds logical and elementary, the efforts required to maintain data privacy and confidentiality demand constant attention. Data doesn't tend to remain private and confidential without deliberate efforts to control where it is stored and how it is handled. The lifecycle of data starts at it's creation and follows through to it's destruction. We'll start this lesson by looking at one common risk of the disposal of data - dumpster diving.

Dumpster diving is the practice of searching through bins and dumpsters to find items of value. It's extremely common to find hard drives, external drives, and USB sticks that still contain valuable data. After all, who hasn't accidentally lost a USB drive with data on it? NordVPN (https://nordvpn.com/blog/dumpster-diving-attack/) provides an excellent summary of how dumpster diving can not only expose private data but also result in a successful cyberattack – all because data and documents discarded in a bin retain their value to attackers. Disposing of data in a non-recoverable manner is critical to Confidentiality. ASD have a very detailed guide at https://www.cyber.gov.au/protect-yourself/securing-your-devices/how-secure-your-device/how-dispose-your-device-securely . We highly recommend following this great advice!

Moving Data Around

Confidentiality can also be at risk when data is transmitted from one place to another, potentially being intercepted or received by an unintended person. A prime example is using insecure websites, which can lead to data breaches through the disclosure of confidential information. It is important to only use secure websites. Webcentral (https://webcentral.au/blog/https-vs-http-difference) explains the difference between insecure and secure websites with some technical detail. Quickly scan the linked page for the difference between "http" and https" websites and what those letters mean. It's worth noting that confidentiality and cryptography (encryption techniques) go hand in hand, so most technical discussions about confidentiality will also involve cryptography.

Access Controls and the Principle of Least Privilege

One of the most fundamental ways to protect confidential data is to limit who can access it in the first place. The principle of "least privilege" means that people should only have access to the data and systems they need to do their job – nothing more. Think of it like giving employees keys only to the rooms they need to enter, rather than a master key to the entire building. Least Privilege is often implemented through role-based access controls, where permissions are assigned based on job function. For example, someone in marketing doesn't need access to payroll data, and someone in accounts payable doesn't need access to customer service records. It's also crucial to regularly review who has access to what, because people change roles, leave the organization, or no longer need certain access. Leaving old access permissions in place is like forgetting to collect keys from a former employee – it creates unnecessary risk. More details about accessibility and practical actions will be given in Lesson 3.

Data Classification: Not All Data Is Equal

Not all data requires the same level of protection, and understanding this helps organizations allocate their security efforts appropriately. Data classification is the practice of categorizing information based on its sensitivity. A common classification scheme includes categories like Public (can be freely shared), Internal (for employees only), Confidential (sensitive business information), and Highly Confidential (extremely sensitive data like financial records or personal information). For instance, your company's public marketing brochure doesn't need the same protection as employee salary information or customer credit card details. By labeling data according to its classification, you help everyone in the organization understand how to handle it correctly. Highly confidential data might require encryption, restricted access, and special disposal procedures, while internal data might simply need basic access controls. Classification provides a framework for making consistent decisions about data protection.

Email and Communication Security

Email is one of the most common ways confidential information is accidentally exposed. Sending sensitive data via unencrypted email is like sending a postcard instead of a sealed letter – anyone handling it along the way can read it. Many people don't realize that regular email travels across the internet in a format that can be intercepted and read. For truly confidential information, it's better to use secure file transfer methods or encrypted email services. There's also the very human risk of sending information to the wrong recipient. The "reply all" button has caused countless confidentiality breaches when someone accidentally shares sensitive information with an entire group instead of just one person. Similarly, email auto-complete can lead to sending confidential data to the wrong John or Sarah. Before hitting send on any email containing confidential information, take a moment to verify the recipients and consider whether email is the appropriate channel for that particular information.

Mobile Devices and Remote Work Risks

As more people work remotely and use mobile devices for business, confidentiality risks have multiplied. Working on confidential data in public spaces – coffee shops, airports, trains – creates opportunities for "shoulder surfing," where someone nearby can simply look over your shoulder to see sensitive information on your screen. Public WiFi networks are particularly risky because they're often unsecured, making it easier for attackers to intercept data being transmitted. Lost or stolen devices are another major concern. A laptop or smartphone left in a taxi or stolen from a bag can contain vast amounts of confidential information. This is why security measures like screen locks, device encryption, and remote wipe capabilities (the ability to erase a device remotely if it's lost) are so important. When accessing confidential data remotely, using a Virtual Private Network (VPN) creates an encrypted tunnel for your data, protecting it even on untrusted networks. The convenience of mobile work must be balanced with awareness of these confidentiality risks.

What to Do When Things Go Wrong

Despite best efforts, confidentiality breaches can happen. Knowing what to do when they occur is crucial for minimizing damage. If you suspect confidential data has been exposed – whether through a lost device, an email sent to the wrong person, or any other means – report it immediately to your IT or security team. Time is critical because quick action can sometimes prevent further exposure or misuse of the data. Many organizations have specific incident response procedures and are required by law to report certain types of data breaches within strict time frames. Trying to hide a breach or hoping it won't be noticed only makes things worse. The final lesson of this course addresses Data Breaches in detail.

Lesson 1 – Confidentiality