Evaluating a security strategy against confidentiality, integrity and availability

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which statement best shows how to evaluate a security strategy against the CIA criteria?

A Rate confidentiality, integrity and availability separately, using evidence for each rating

B Give one overall rating of 'good' because the organisation has a firewall

2. A case study says only HR staff can open payroll files, and the access log shows no unauthorised views. Which criterion does this evidence support?

A Confidentiality is well protected

B Availability is well protected

3. Which piece of evidence would you use to rate AVAILABILITY?

A The system had 99.9% uptime and was restored within one hour after a fault

B All staff must use a 12-character password

4. A case study reports that 8% of customer records contain wrong addresses and nobody validates entries. Which rating fits the evidence?

A Integrity is strong, because the records are still stored safely

B Integrity is weak, because data is not accurate or checked

5. A company makes staff use MFA and re-login every 10 minutes, and staff now struggle to get to the data they need. What is this an example of?

A A strategy that improves all three criteria equally

B A trade-off: stronger confidentiality has reduced availability

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Confidentiality: Strong - MFA and encryption stop unauthorised access		AEvidence from a case study showing the strategy failed to keep data and systems accessible when needed
2Availability: Weak - no backups, 3 days of downtime after the attack		BThe evidence relates to confidentiality, not availability, so it does not support the rating.
3A trade-off: a control that improves one criterion can reduce another, so the evaluation must weigh them up		CRating: Confidentiality = Strong, Integrity = Partial, Availability = Weak
4A strong evaluation judges all three criteria (confidentiality, integrity and availability) rather than only one		DThe rating gives no evidence and does not assess confidentiality, integrity and availability separately.
5Security is Strong overall because the firewall is good.		EStrict access limits raise Confidentiality but slow staff access, lowering Availability
6Availability: Strong - we encrypted every file, so it is protected.		FA rating for one criterion, backed by evidence from the strategy that explains why it was given

Definitions

Evaluate against CIA

Fill in the Blanks

Complete each line of code by filling in the missing parts.

evidence ← "Daily backups, 99.9% uptime" criterion ← "____________"

__ evidence = "missing" THEN rating ← "Unknown" END IF

IF loginSteps = "many" THEN reduced ← "____________" END IF

scores ← [conf, integ, avail] weakest ← ___(scores)

FOR EACH criterion IN criteria _______ criterion, rating, evidence END FOR

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A criteria ← [C, I]

B FOR EACH c IN criteria

C rating ← rate(c, evidence)

D OUTPUT c, rating

E END FOR

Question 2

A evidence ← "MFA on logins"

B criterion ← "Availability"

C rating ← "High"

D OUTPUT criterion, rating

Question 3

A IF evidence >= 3 THEN

B rating ← "High"

C ELSE IF evidence >= 5 THEN

D rating ← "Medium"

E ELSE rating ← "Low"

Question 4

A encryption ← ON

B confidentiality ← "Low"

C speed ← "Slower"

D OUTPUT "Trade-off: C vs A"

Question 5

A case ← "Retail data leak"

B evidence ← "Data leaked"

C criterion ← "Confidentiality"

D rating ← "High"

E OUTPUT criterion, rating

Answer Key

Evaluating a security strategy against confidentiality, integrity and availability

Section A: Quick Questions

A — Rate confidentiality, integrity and availability separately, using evidence for each rating

A — Confidentiality is well protected

A — The system had 99.9% uptime and was restored within one hour after a fault

B — Integrity is weak, because data is not accurate or checked

B — A trade-off: stronger confidentiality has reduced availability

Section B: Match the Pairs

Confidentiality: Strong - MFA and encryption stop unauthorised access → A rating for one criterion, backed by evidence from the strategy that explains why it was given

Availability: Weak - no backups, 3 days of downtime after the attack → Evidence from a case study showing the strategy failed to keep data and systems accessible when needed

A trade-off: a control that improves one criterion can reduce another, so the evaluation must weigh them up → Strict access limits raise Confidentiality but slow staff access, lowering Availability

A strong evaluation judges all three criteria (confidentiality, integrity and availability) rather than only one → Rating: Confidentiality = Strong, Integrity = Partial, Availability = Weak

Security is Strong overall because the firewall is good. → The rating gives no evidence and does not assess confidentiality, integrity and availability separately.

Availability: Strong - we encrypted every file, so it is protected. → The evidence relates to confidentiality, not availability, so it does not support the rating.

Section C: Definitions

Evaluate against CIA — Judge how well a security strategy protects confidentiality, integrity and availability, using evidence to rate each one and weigh up trade-offs between them.

Section D: Fill in the Blanks

evidence ← "Daily backups, 99.9% uptime"
criterion ← "Availability"

IF evidence = "missing" THEN
    rating ← "Unknown"
END IF

IF loginSteps = "many" THEN
    reduced ← "Availability"
END IF

scores ← [conf, integ, avail]
weakest ← MIN(scores)

FOR EACH criterion IN criteria
    DISPLAY criterion, rating, evidence
END FOR

Section E: Spot the Error

A — A security strategy must be evaluated against all three criteria. Availability (A) is missing, so it should be criteria ← [C, I, A].

B — MFA on logins is evidence about who can access data, which is confidentiality. It does not show whether systems stay available, so the criterion should be "Confidentiality".

C — The Medium threshold must be lower than the High threshold. With >= 5, evidence of 1 or 2 would wrongly fall through to Low. It should be evidence >= 1.

B — Turning encryption on strengthens confidentiality, so the rating should be "High". The slower speed is the trade-off against availability.

D — The case study evidence shows data was leaked, so confidentiality failed. The rating must follow the evidence and be "Low", not "High".