Tutorial 4: Information Security and Privacy Preservation

COMP200 · Unit 4 · Section 4

Objectives

Security protects systems and information from unauthorized disclosure, alteration, or disruption. Privacy concerns appropriate collection, purpose, access, sharing, retention, and deletion of personal information. Use threat modeling, least privilege, updates, backups, encryption, validation, and monitoring.

collect minimally -> protect -> restrict use -> retain briefly -> delete safely

Exercises

  1. Threat-model a student portal.
  2. Classify three privacy risks.
  3. Design layered controls.

Self-check

  1. What does integrity protect?
  2. Why minimize data?
  3. What is least privilege?

Self-Check Quiz

1. What limits unauthorized disclosure?

AnswerConfidentiality controls such as authorization, encryption, and careful sharing.

2. Does encryption replace access control?

AnswerNo. It protects data in particular states; authorization controls who may use it.

Homework

  1. Write a privacy and security review for an information system.
  2. Specify data lifecycle and controls.
  3. Identify residual risks.
Sample answerCollect only necessary fields, define purpose and retention, restrict roles, encrypt transit and storage, audit sensitive access, validate input, back up safely, and provide deletion or correction processes. Residual risks include compromised endpoints and insider misuse.