← VCE Data Analytics U4O2

Evaluating a security strategy against confidentiality, integrity and availability

Judge how well a security strategy protects confidentiality, integrity and availability, using evidence to rate each one and weigh up trade-offs between them.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 35, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 59

Understanding Evaluating a security strategy against confidentiality, integrity and availability in VCE Data Analytics U4O2

What it does: Tight restrictions protect data from unauthorised users but can delay legitimate users, showing the trade-off between confidentiality and availability. Each of the three criteria gets its own rating, so the overall evaluation shows where the strategy is effective and where it needs improving. An evaluation checks each of confidentiality, integrity and availability and supports each judgement with evidence, not a general opinion. Integrity is about data being accurate, complete and trustworthy. Wrong records and no validation are evidence of weak integrity, even if the data is stored. A strong evaluation links a specific piece of evidence from the case study to a rating. Vague words like 'seem' and 'probably' are not evidence.

Common mistakes: A security strategy must be evaluated against all three criteria. Availability (A) is missing, so it should be criteria ← [C, I, A]. MFA on logins is evidence about who can access data, which is confidentiality. It does not show whether systems stay available, so the criterion should be "Confidentiality".

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Evaluating a security strategy against confidentiality, integrity and availability to a class →

This module's key terms are also in a printable crossword (Modules 26–43) and word search (Modules 1–43).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which statement best shows how to evaluate a security strategy against the CIA criteria?

Rate confidentiality, integrity and availability separately, using evidence for each ratingGive one overall rating of 'good' because the organisation has a firewall

Matches

Security is Strong overall because the firewall is good.

↓

The rating gives no evidence and does not assess confidentiality, integrity and availability separately.

Applying

Meanings

Term

Evaluate against CIA

Meaning

Judge how well a security strategy protects confidentiality, integrity and availability, using evidence to rate each one and weigh up trade-offs between them.

Practice

FOR each criterion IN [confidentiality, integrity, availability]

Testing

Gaps

criterion ← ""

Check Answer

Spots

1criteria ← [C, I]

2FOR EACH c IN criteria

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which statement best shows how to evaluate a security strategy against the CIA criteria?

A. Rate confidentiality, integrity and availability separately, using evidence for each rating ✓

B. Give one overall rating of 'good' because the organisation has a firewall

An evaluation checks each of confidentiality, integrity and availability and supports each judgement with evidence, not a general opinion.

2. A case study says only HR staff can open payroll files, and the access log shows no unauthorised views. Which criterion does this evidence support?

A. Confidentiality is well protected ✓

B. Availability is well protected

Restricted access and logs showing no unauthorised views are evidence that data is kept from people who should not see it. That is confidentiality.

3. Which piece of evidence would you use to rate AVAILABILITY?

A. The system had 99.9% uptime and was restored within one hour after a fault ✓

B. All staff must use a 12-character password

Availability is about authorised users being able to access data and systems when needed, so uptime and recovery times are the evidence. Password rules mainly support confidentiality.

4. A case study reports that 8% of customer records contain wrong addresses and nobody validates entries. Which rating fits the evidence?

A. Integrity is strong, because the records are still stored safely

B. Integrity is weak, because data is not accurate or checked ✓

Integrity is about data being accurate, complete and trustworthy. Wrong records and no validation are evidence of weak integrity, even if the data is stored.

5. A company makes staff use MFA and re-login every 10 minutes, and staff now struggle to get to the data they need. What is this an example of?

A. A strategy that improves all three criteria equally

B. A trade-off: stronger confidentiality has reduced availability ✓

Strong access controls can protect confidentiality but make access slower for authorised users. A good evaluation weighs up this kind of trade-off.

Match the Pairs

Confidentiality: Strong - MFA and encryption stop unauthorised access → A rating for one criterion, backed by evidence from the strategy that explains why it was given

Availability: Weak - no backups, 3 days of downtime after the attack → Evidence from a case study showing the strategy failed to keep data and systems accessible when needed

A trade-off: a control that improves one criterion can reduce another, so the evaluation must weigh them up → Strict access limits raise Confidentiality but slow staff access, lowering Availability

A strong evaluation judges all three criteria (confidentiality, integrity and availability) rather than only one → Rating: Confidentiality = Strong, Integrity = Partial, Availability = Weak

Security is Strong overall because the firewall is good. → The rating gives no evidence and does not assess confidentiality, integrity and availability separately.

Availability: Strong - we encrypted every file, so it is protected. → The evidence relates to confidentiality, not availability, so it does not support the rating.

Key Term

Evaluate against CIA

Judge how well a security strategy protects confidentiality, integrity and availability, using evidence to rate each one and weigh up trade-offs between them.

Fill in the Blanks

1. evidence ← "Daily backups, 99.9% uptime" criterion ← "Availability"

Hint: Type the CIA criterion that the backup and uptime evidence supports.

2. IF evidence = "missing" THEN rating ← "Unknown" END IF

Hint: Type the keyword that starts a decision, so a rating is only given when evidence exists.

3. IF loginSteps = "many" THEN reduced ← "Availability" END IF

Hint: Type the CIA criterion that is traded off when strict access controls make data harder to reach.

4. scores ← [conf, integ, avail] weakest ← MIN(scores)

Hint: Type the function that finds the lowest score, showing the weakest criterion.

5. FOR EACH criterion IN criteria DISPLAY criterion, rating, evidence END FOR

Hint: Type the command that shows each criterion with its rating and supporting evidence.

Spot the Error

Question 1

A criteria ← [C, I]

B FOR EACH c IN criteria

C rating ← rate(c, evidence)

D OUTPUT c, rating

E END FOR

Line A — A security strategy must be evaluated against all three criteria. Availability (A) is missing, so it should be criteria ← [C, I, A].

Question 2

A evidence ← "MFA on logins"

B criterion ← "Availability"

C rating ← "High"

D OUTPUT criterion, rating

Line B — MFA on logins is evidence about who can access data, which is confidentiality. It does not show whether systems stay available, so the criterion should be "Confidentiality".

Question 3

A IF evidence >= 3 THEN

B rating ← "High"

C ELSE IF evidence >= 5 THEN

D rating ← "Medium"

E ELSE rating ← "Low"

Line C — The Medium threshold must be lower than the High threshold. With >= 5, evidence of 1 or 2 would wrongly fall through to Low. It should be evidence >= 1.

Question 4

A encryption ← ON

B confidentiality ← "Low"

C speed ← "Slower"

D OUTPUT "Trade-off: C vs A"

Line B — Turning encryption on strengthens confidentiality, so the rating should be "High". The slower speed is the trade-off against availability.

Question 5

A case ← "Retail data leak"

B evidence ← "Data leaked"

C criterion ← "Confidentiality"

D rating ← "High"

E OUTPUT criterion, rating

Line D — The case study evidence shows data was leaked, so confidentiality failed. The rating must follow the evidence and be "Low", not "High".

Student with a class code? Join your class →