Which of the following helps to ensure the confidentiality of data in computer operations?

Confidentiality ensures that data is not disclosed to unauthorized individuals, entities, or processes. Access Control Lists (ACLs) are a primary mechanism for enforcing this principle. An ACL is a set of rules applied to a resource (like a file, folder, or network connection) that specifies which subjects (users or systems) are permitted to access it and what operations they are allowed to perform. By explicitly defining and restricting access, ACLs directly prevent unauthorized viewing or retrieval of data, thereby ensuring its confidentiality. They are a fundamental preventative security control.

A. Data integrity controls: These controls, such as hashing and digital signatures, ensure that data has not been altered or destroyed in an unauthorized manner. This addresses integrity, not confidentiality.

C. Intrusion Detection System (IDS): An IDS is a detective control that monitors systems or networks for malicious activity or policy violations and generates alerts. It does not actively prevent access.

D. Antivirus software: This software is designed to detect and remove malware. While malware can compromise confidentiality, antivirus is a specific countermeasure, not a general mechanism for enforcing access policies.

1. Official Vendor Documentation (Cisco): In the CCNA 200-301 Official Cert Guide, Volume 1, Chapter 25, "Implementing Standard IPv4 ACLs," it is explained that ACLs are used to "control which hosts can access a network and to control traffic." This control of access is the core function that enforces confidentiality for network resources.

2. Peer-reviewed Academic Publications (Foundational Security Principles): Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 17(7), 38-47. Section I.B.1, "Principles of Design," implicitly supports access control as a mechanism for confidentiality by stating that systems must "provide mechanisms for controlled sharing" and prevent unauthorized access. This paper is a foundational text for computer security principles taught in university curricula. DOI: https://doi.org/10.1145/361011.361062

3. Official Standards (NIST): National Institute of Standards and Technology (NIST) Special Publication 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations. The "Access Control (AC)" control family is explicitly designed to "limit information system access to authorized users." Appendix F, "Security Control to PII Processing Purposes Crosswalk," directly maps the AC control family to the security objective of Confidentiality.