A hacker gains access to a webserver and can view a file on the server containing credit card numbers. Which of the Confidentiality, Integrity…

Confidentiality is the principle that ensures information is not disclosed to unauthorized individuals, entities, or processes. In the given scenario, the hacker, an unauthorized party, gained access to and viewed a file containing sensitive credit card numbers. This action is a direct violation of the confidentiality principle, as the secrecy of the data was compromised. The other principles of the CIA triad, Integrity and Availability, were not violated based on the description, which only mentions the unauthorized viewing of the data, not its modification or the denial of access to it for authorized users.

A. Availability: This is incorrect because the scenario does not state that authorized users were prevented from accessing the file. The hacker only viewed it.

C. Integrity: This is incorrect because the hacker only viewed the file. There is no indication that the data was altered, modified, or destroyed, which would constitute a loss of integrity.

D. Compliance: This is incorrect because "Compliance" is not a core principle of the CIA triad, which consists of Confidentiality, Integrity, and Availability. While this breach is a compliance failure, it is not one of the fundamental security principles in question.

---

1. ISO/IEC 27000:2018, Information technology — Security techniques — Information security management systems — Overview and vocabulary.

Section 3.10 (Confidentiality): Defines confidentiality as the "property that information is not made available or disclosed to unauthorized individuals, entities, or processes." This directly supports the correct answer, as the hacker's viewing of the file is an unauthorized disclosure.

Section 3.36 (Integrity): Defines integrity as the "property of accuracy and completeness." This supports why option C is incorrect, as the data was not described as being altered.

Section 3.7 (Availability): Defines availability as the "property of being accessible and usable on demand by an authorized entity." This supports why option A is incorrect, as access for authorized users was not mentioned as being denied.

2. National Institute of Standards and Technology (NIST), Special Publication 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations."

Appendix F, Glossary: Provides definitions for the security objectives. It defines Confidentiality as "Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information." This aligns perfectly with the scenario of a hacker viewing protected credit card data.