Chapter 1 — Security foundations for practitioners
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The course and the case"]
N2["1.2 Three security properties"]
N3["1.3 Security and data protection"]
N4["1.4 Basics at Halden"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The course and the case"]
N2["1.2 Three security properties"]
N3["1.3 Security and data protection"]
N4["1.4 Basics at Halden"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The course and the case]
|
v
[1.2 Three security properties]
|
v
[1.3 Security and data protection]
|
v
[1.4 Basics at Halden]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain confidentiality, integrity and availability for personal data; (2) relate security to data protection duties; (3) identify the security basics a recruitment agency needs.
1.1 The course and the case
Marta Silva, an office manager changing careers, joins a six-month professional course at the fictional Northgate Professional Academy. Her mentor is Ms. Grace Lin, an experienced privacy practitioner. Marta's placement is at the fictional Halden Recruitment, an agency with forty consultants that holds about 25,000 candidate profiles, CVs, interview notes, references and, for some roles, background check results. Candidates trust Halden with their career history, salary expectations and sometimes health or disability information needed for interview adjustments, so careful handling matters from the first day.
1.2 Three security properties
Ms. Lin starts with confidentiality, integrity and availability. Confidentiality means only authorised people see a candidate's CV and notes. Integrity means records are accurate and not altered without authority, so a candidate is not rejected because of a wrong note. Availability means consultants can reach records when a client is waiting for a shortlist. Marta notes that Article 32 of the GDPR asks controllers to ensure these properties with measures appropriate to the risk, and that each property protects candidates in a different way.
1.3 Security and data protection
Marta learns that data protection is broader than security. Security protects data against loss and misuse, while data protection also asks whether Halden should collect the data at all, for what purpose, for how long and what candidates are told. A perfectly secured database of CVs kept for ten years without reason still breaks the storage limitation principle in Article 5(1)(e). Ms. Lin summarises the relationship: security is necessary for data protection, but it is never sufficient on its own. Both are needed together.
1.4 Basics at Halden
Marta lists security basics and checks them at Halden: individual accounts with multi-factor authentication for the recruitment system, encrypted laptops, a password manager, automatic updates, backups that are tested, and a way for staff to report mistakes quickly. She finds that multi-factor authentication is enabled for only half the consultants and that laptops are encrypted except for two older machines. She records these as early findings, owned by the IT provider, with dates for fixing each one. The IT provider accepts both findings and agrees fixing dates.
Worked example
Marta explains confidentiality, integrity and availability for candidate records, distinguishes security from data protection and finds gaps in multi-factor authentication and laptop encryption.
Synthetic case. Northgate, Halden and all people are synthetic; GDPR Articles 5(1)(e) and 32 are real.
Errors and limits
Checklists of basics do not show whether controls actually work; verify later.
Exercises
- EX001 — Integrity example. Give an example of an integrity failure at Halden. Rubric: 3 = a wrong note leads to rejection;; 2 = mentions accuracy;; 1 = vague;; 0 = none.
- EX002 — Broader than security. Why is data protection broader than security? Rubric: 3 = it also covers whether, why and how long data are kept;; 2 = mentions purpose;; 1 = vague;; 0 = none.
- EX003 — Secured but unlawful. How can a well-secured CV database still break the law? Rubric: 3 = kept too long, breaking storage limitation;; 2 = mentions retention;; 1 = vague;; 0 = none.
- EX004 — MFA coverage. What share of consultants had multi-factor authentication? Rubric: 3 = about half;; 2 = partly correct;; 1 = all;; 0 = none.
- EX005 — Laptop gap. What was found about laptop encryption? Rubric: 3 = two older machines unencrypted;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 01 (chapter 01 of 12)
← Course home · Course chapter index · Chapter 02 →
Continue to the next authored lesson.