Chapter 1 — Security foundations for practitioners

Learning outcomes

You will (1) explain confidentiality, integrity and availability for personal data; (2) relate security to data protection duties; (3) identify the security basics a recruitment agency needs.

1.1 The course and the case

Marta Silva, an office manager changing careers, joins a six-month professional course at the fictional Northgate Professional Academy. Her mentor is Ms. Grace Lin, an experienced privacy practitioner. Marta's placement is at the fictional Halden Recruitment, an agency with forty consultants that holds about 25,000 candidate profiles, CVs, interview notes, references and, for some roles, background check results. Candidates trust Halden with their career history, salary expectations and sometimes health or disability information needed for interview adjustments, so careful handling matters from the first day.

1.2 Three security properties

Ms. Lin starts with confidentiality, integrity and availability. Confidentiality means only authorised people see a candidate's CV and notes. Integrity means records are accurate and not altered without authority, so a candidate is not rejected because of a wrong note. Availability means consultants can reach records when a client is waiting for a shortlist. Marta notes that Article 32 of the GDPR asks controllers to ensure these properties with measures appropriate to the risk, and that each property protects candidates in a different way.

1.3 Security and data protection

Marta learns that data protection is broader than security. Security protects data against loss and misuse, while data protection also asks whether Halden should collect the data at all, for what purpose, for how long and what candidates are told. A perfectly secured database of CVs kept for ten years without reason still breaks the storage limitation principle in Article 5(1)(e). Ms. Lin summarises the relationship: security is necessary for data protection, but it is never sufficient on its own. Both are needed together.

1.4 Basics at Halden

Marta lists security basics and checks them at Halden: individual accounts with multi-factor authentication for the recruitment system, encrypted laptops, a password manager, automatic updates, backups that are tested, and a way for staff to report mistakes quickly. She finds that multi-factor authentication is enabled for only half the consultants and that laptops are encrypted except for two older machines. She records these as early findings, owned by the IT provider, with dates for fixing each one. The IT provider accepts both findings and agrees fixing dates.

Worked example

Marta explains confidentiality, integrity and availability for candidate records, distinguishes security from data protection and finds gaps in multi-factor authentication and laptop encryption.

Synthetic case. Northgate, Halden and all people are synthetic; GDPR Articles 5(1)(e) and 32 are real.

Errors and limits

Checklists of basics do not show whether controls actually work; verify later.

Exercises

• EX001 — Integrity example. Give an example of an integrity failure at Halden.
  Show marking criteria

  Rubric: 3 = a wrong note leads to rejection;; 2 = mentions accuracy;; 1 = vague;; 0 = none.
• EX002 — Broader than security. Why is data protection broader than security?
  Show marking criteria

  Rubric: 3 = it also covers whether, why and how long data are kept;; 2 = mentions purpose;; 1 = vague;; 0 = none.
• EX003 — Secured but unlawful. How can a well-secured CV database still break the law?
  Show marking criteria

  Rubric: 3 = kept too long, breaking storage limitation;; 2 = mentions retention;; 1 = vague;; 0 = none.
• EX004 — MFA coverage. What share of consultants had multi-factor authentication?
  Show marking criteria

  Rubric: 3 = about half;; 2 = partly correct;; 1 = all;; 0 = none.
• EX005 — Laptop gap. What was found about laptop encryption?
  Show marking criteria

  Rubric: 3 = two older machines unencrypted;; 2 = partly correct;; 1 = vague;; 0 = none.