Information Security Management Examination (SG) | Section A Security Properties and Design Principles Questions 07

Authenticity is the property that an entity, such as a user or system, is what it claims to be. Here, authentication verifies whether the person connecting is the registered technician they claim to be. Availability concerns being usable when required, while confidentiality concerns preventing disclosure to unauthorized entities.

Non-repudiation is the ability to prove that a claimed event or action occurred and which entity caused it. A signature or audit trail that links the approver to the approval and makes tampering detectable serves this purpose. Merely keeping the system running concerns availability, not proof of the approval action.

Reliability is the property of consistent intended behavior and results. Irregular results from the same valid input show that the system is not performing its intended calculation consistently. Being able to connect to the system does not by itself establish the reliability of its results.

An alert is an information security event indicating a possible breach or control failure; it is not automatically a major incident. The organization should assess related evidence and impact under its criteria to determine whether the event could harm assets and therefore constitutes an incident. Deleting it without review could eliminate an important opportunity to investigate.

Defense in depth assumes that one control may fail and combines controls at different layers, including the perimeter, endpoints, internal network, critical information, detection, and response. Even a stronger email gateway may be bypassed, so layers are also needed to limit execution, lateral movement, and data theft afterward.

Security by design analyzes threats early in planning and design and incorporates the necessary controls into requirements and architecture. Carrying the results into development, testing, and operations reduces omissions and costly redesign caused by adding controls later. A final vulnerability scan can be useful, but it is not a substitute for design-stage work.

Privacy by design incorporates protection of individuals' rights and interests from the design stage of a personal-data activity. Before collecting location data, the organization should assess purpose, necessity, minimization, retention, access, and impact, then build the results into the feature and its operation. A long consent notice alone does not remove the risks of unnecessary collection or excessive retention.

A cloud service independently used by a department without the organization's normal introduction and approval process is shadow IT. The organization should identify the data, sharing scope, contract, and settings, assess risk, and move safely to an approved environment when necessary. Preventing recurrence also requires an evaluation and request path that can meet legitimate business needs.

Excessive privileges, unrestricted export paths, and weak monitoring increase the opportunity to commit and conceal misconduct. Least privilege, export approval, and log monitoring directly reduce that opportunity. Support for personal pressure may address motivation, while communication of rules may address rationalization, but neither is the direct opportunity control asked for here.

Double extortion combines disruption through encryption with a threat to publish stolen data. Backups support recovery and availability, but they do not erase data already obtained by an attacker. The organization must investigate the intrusion path, outbound transfer, and affected data, then assess the impact and any reporting or individual-notification duties under applicable law and contracts.