Confidentiality
Definition
The property that information is not disclosed to unauthorised individuals, processes, or devices. Protected by access controls, encryption, and need-to-know policies. Breached by unauthorised disclosure, eavesdropping, or credential theft.
- Triad position
- One of three CIA triad principles
- Companions
- Integrity, availability
- Controls
- Access control, encryption, need-to-know policy
- Failure modes
- Unauthorised disclosure, eavesdropping, credential theft
Common questions
How is confidentiality distinguished from integrity in the CIA triad?+
Confidentiality is about who is allowed to see data; integrity is about whether the data has been altered. A breach can compromise one without the other, for example an attacker who reads encrypted backups without modifying them harms confidentiality but not integrity.
Why does encryption alone not guarantee confidentiality?+
Encryption protects data in transit or at rest, but confidentiality also depends on key management, access control on the systems holding the keys, and user behaviour. A stolen or weakly protected key defeats strong encryption entirely.
Related terms
- Anonymity
- A data-collection condition in which no one, including the researcher, can link a response to the individual who gave it, because no...
- Availability
- The property that systems and data are accessible to authorised users when needed. Protected by redundancy, backup, failover, and incident response capabilities....
- Certificate of Confidentiality
- A US federal protection, issued for research involving sensitive identifiable information, that lets a researcher refuse to disclose participant data in most...
- Duty to Warn
- An obligation, recognised in several jurisdictions after Tarasoff v. Regents of the University of California (1976), to override confidentiality and alert an...
- Informed Consent
- Legally valid agreement to a procedure, requiring that the patient has been given sufficient information, has capacity to understand it, and is...
- Institutional Review Board
- A committee, called a research ethics committee outside the United States, that reviews a proposed study before it begins to confirm that...
- Integrity
- The property that information is accurate, complete, and has not been modified without authorisation. Protected by cryptographic hashing, digital signatures, and change...
- Non-Repudiation
- The property that a party cannot deny having performed an action. Provided by digital signatures, timestamped audit logs, and certified delivery receipts....
- Threat
- A potential cause of an unwanted incident that could harm an asset. Threats may be natural (flood, fire), environmental (power failure), human...
- Vulnerability
- A weakness in an asset or in a control protecting that asset, which a threat could exploit to cause harm. Examples: an...
Explained in these topics
- The CIA Triad and Security Fundamentals
- Research Ethics and Confidentiality in Criminal Justice ResearchA researcher's commitment to control access to identifiable data collected from a participant, distinct from a promise that no identifying information will eve...