Section 11.1: Security Principles: CIA Triad & Privacy

Introduction to Data Security

In the context of the Data Management Body of Knowledge (DMBoK2), Data Security is defined as the planning, development, execution, and supervision of security policies and procedures to ensure proper authentication, authorization, access, and auditing of data and information assets. Data is an enterprise asset, and like any valuable asset, it must be protected from unauthorized access, loss, alteration, or destruction. Security is not a standalone IT project; rather, it is a foundational component of Data Governance (DG) and overall business risk management. Effective data security ensures compliance with legal and regulatory mandates, safeguards reputation, and enables the trusted sharing of information.

---

The CIA Triad

The core foundation of information security is the Confidentiality, Integrity, and Availability (CIA) Triad. Every security control, policy, or mechanism is designed to address one or more of these three pillars:

Confidentiality

Confidentiality ensures that sensitive data is accessed only by authorized users and processes. It prevents unauthorized disclosure, whether intentional (such as data theft or espionage) or accidental (such as emailing sensitive documents to the wrong recipient).

• Core Controls: Confidentiality is achieved through authentication mechanisms (confirming identity), authorization controls (restricting privileges), and robust encryption methods (making the data unreadable to interceptors).
• Data Security Role: Data stewards and owners define who should have access, while security administrators enforce these rules using access control tools.

Integrity

Integrity guarantees that data remains accurate, complete, and trustworthy throughout its entire lifecycle. It ensures that data cannot be altered, deleted, or tampered with by unauthorized parties or processes, and that any authorized modifications are fully auditable.

• Core Controls: Integrity checks include cryptographic hashing (generating a unique digital fingerprint of the data), digital signatures, database transaction logs, and change audit trails.
• DAMA Relevance: Data integrity is closely linked to Data Quality. If security controls fail and unauthorized modifications occur, the quality and credibility of the enterprise data asset are compromised.

Availability

Availability ensures that data and system resources are accessible to authorized users when needed to support business operations. High security controls that restrict access must not render data unusable or inaccessible.

• Core Controls: Ensuring availability requires infrastructure resilience, redundant systems, high availability (HA) clustering, database backups, and Disaster Recovery (DR) planning.
• The CIA Balance: Security is a balancing act. Excessive confidentiality controls (such as multi-factor authentication or network isolation) can sometimes introduce friction that reduces data availability, slowing business operations. Security architects must balance these three forces based on business risk tolerance.

---

Privacy by Design (PbD)

Data privacy is distinct from data security, though they are heavily interdependent. While security focuses on protecting data from unauthorized access, privacy focuses on the appropriate and lawful collection, use, and disposal of personal data. Privacy by Design (PbD) is a globally recognized framework developed by Ann Cavoukian in the 1990s, asserting that privacy must be integrated into IT systems, business processes, and physical infrastructure from the very beginning of the design phase.

The PbD framework is built upon seven foundational principles:

1. Proactive not Reactive; Preventative not Remedial: Anticipate and prevent privacy-invasive events before they occur, rather than fixing them after the fact.
2. Privacy as the Default Setting: Personal data must be automatically protected in any system or business practice. No action is required by the individual to protect their privacy.
3. Privacy Embedded into Design: Privacy is an essential component of the core architecture of IT systems and business practices, not an add-on or afterthought.
4. Full Functionality — Positive-Sum, not Zero-Sum: Avoid trade-offs (e.g., security vs. privacy). All requirements should be satisfied in a win-win manner.
5. End-to-End Security — Full Lifecycle Protection: Secure data collection, storage, use, and destruction. Robust security measures must ensure that all data is safeguarded throughout its entire lifecycle.
6. Visibility and Transparency — Keep it Open: All stakeholders (users, partners, regulators) must have clear visibility into how data is processed, verified, and protected.
7. Respect for User Privacy — Keep it User-Centric: Keep the interests of the individual uppermost by offering strong privacy defaults, detailed notices, and user-friendly options.

---

Data Classification Levels

To protect data cost-effectively, organizations must categorize their data assets based on sensitivity and risk. Data Classification is the process of labeling data according to its risk level and the potential impact on the organization if it is disclosed, altered, or destroyed.

Classification Ownership and Enforcement

The Data Owner (typically a business executive or trustee) is responsible for determining the classification of a data asset. The Data Custodian (IT or database administrator) is responsible for implementing the technical safeguards corresponding to that classification level.

Most enterprises employ a four-level data classification schema:

Exam Trap: Owner vs. Custodian

A frequent CDMP exam question asks who is responsible for classifying data. Remember that the Data Owner defines the classification and policies, while the Data Custodian or security administrator implements and enforces the technical controls. IT does not own or classify the business data.