Question

confidentiality, integrity, and availability (CIA) are discussed as a core tenet, as well as the importance of protecting an organization from unintentional disclosures. An employee was terminated because proper CIA policy and procedures were not followed. Do you agree with this action or believe it was too harsh? Please provide a short justification for your response.

Provide references to back up your statement.

Answer 1

Confidentiality, Integrity, and Availability (CIA) are the principles of Cyber or IT security in protecting an organization from unintentional disclosures. Anyone of these when compromised will compromise the entire security of a system. Yes, I believe any employee not following proper CIA policy and procedures should be terminated. There have been cases where a single and very small miss in either of these three pillars- Confidentiality, Integrity, and Availability (CIA) has resulted in security breaches, attacks, hacks, password cracking, data theft, unavailability of data, altered data, and data disclosures, causing huge money and data loss, and other damages to the IT infrastructure, data, people, reputation, revenue, business, etc.

Confidentiality makes sure sensitive information is accessed only authorized people or users and kept away from those who are not authorized to possess or access them.

Integrity makes sure information is in a format true and correct to its original purposes, without it being altered or manipulated.

Availability makes sure information and resources are available to those authorized people or users who need them for access.

Security in IT and cyberspace is a very serious business, requirement, and necessity. Hence, all these three conditions must be met for security and safety of IT infrastructure, systems, servers, computers, software, hardware, network, applications, services, accounts, data, devices, components, etc.

In fact, any employee who joins a company to start working is required to make an agreement to learn and follow proper CIA policy and procedures, failing which he/she would be terminated despite all the security awareness training and education provided to him/her by the company he/she is working for, irrespective of his/her role or designation in the company.