The principle of data security management, which covers the procedures, policies and controls utilized to secure the data of customers and the organization against illicit access or use, is known as :
- (a)Integrity
- (b)Privacy
- (c)Availability
- (d)Confidentiality
Correct — D, Confidentiality. In the CIA triad of information security, confidentiality is exactly the principle that data is seen and used only by those authorised to do so. It is delivered through procedures, policies and controls — access control and authentication, least-privilege / need-to-know rules, encryption and firewalls — aimed at keeping customer and organisational data safe from illicit access or use. The wording of the question ('procedures, policies and controls … against illicit access') is the textbook definition of confidentiality.
- (a)Integrity — Integrity is about data being accurate, complete and unaltered — protection against tampering, using hashes, checksums, digital signatures and audit logs. It says nothing about who is allowed to see the data.
- (b)Privacy — The strongest trap. Privacy is the individual's right to control their personal data, protected in India by the Digital Personal Data Protection Act, 2023 and by the Puttaswamy judgment (2017) which read privacy into Article 21. Confidentiality is the security control through which an organisation delivers privacy — and it is the security principle the question asks for.
- (c)Availability — Availability means authorised users can reach the data and systems when needed — assured by backups, redundancy, disaster recovery and DDoS protection. A denial-of-service attack breaks availability, not confidentiality.
Information security rests on the CIA triad: Confidentiality (who may see the data), Integrity (has the data been altered) and Availability (can authorised users get it when they need it). Attacks map neatly onto the three — a data breach or eavesdropping violates confidentiality, tampering or a man-in-the-middle alteration violates integrity, a DDoS attack or ransomware lockout violates availability. Authentication and non-repudiation are commonly added as supporting objectives.
Confidentiality and privacy overlap in everyday speech, which is why (b) attracts marks. Keep the distinction sharp: privacy is a right of the data subject (a legal question), while confidentiality is a duty and a set of controls on the data holder (a security question). Any option stem that mentions 'procedures, policies and controls' is pointing at a security principle, not at a right.
- CIA triad = Confidentiality, Integrity, Availability — the three core objectives of information security.
- Confidentiality controls: access control and authentication, least privilege / need-to-know, encryption, firewalls.
- Integrity controls: hashing and checksums, digital signatures, version control, audit trails. Availability controls: backups, redundancy, disaster recovery, DDoS mitigation.
- Privacy is the individual's right over personal data — in India, the Digital Personal Data Protection Act, 2023 and the Supreme Court's Puttaswamy judgment (2017), which located privacy in Article 21.
The question describes access restriction through policies and controls, which is confidentiality; privacy is the right, not the security principle.
- Choosing 'Privacy' — privacy is a right of the individual, not one of the three security principles.
- Mapping a DDoS attack to confidentiality — it attacks availability.
- Reading 'integrity' as honesty of employees; in this context it means the data has not been altered.
MPPSC's computer/cyber section asks one-line definitions from the CIA triad, firewalls and attack types; UPSC frames the same area through law and institutions — the IT Act, CERT-In, the DPDP Act and the right to privacy.
What is the purpose of a firewall in cyber-security?
- (a) To allow unrestricted access to a network
- (b) To block unauthorized access to a network
- (c) To create a backup of a network’s data
- (d) None of the above
Answer(b) To block unauthorized access to a network
Same idea from the control side — a firewall is the standard confidentiality control, blocking unauthorised access to data and networks.
The feature(s) of cyber security is/are :
- (a) Compliance
- (b) Defence against internal threats
- (c) Threat prevention
- (d) All of the above
Answer(d) All of the above
MPPSC's earlier take on the same block — what the policies, controls and compliance side of cyber/data security consists of.
- practice — not a real PYQ
A Distributed Denial of Service (DDoS) attack primarily compromises which principle of information security?
- (a)Confidentiality
- (b)Integrity
- (c)Availability
- (d)Non-repudiation
Answer(c) Availability — the service is flooded so that authorised users cannot reach it.
- practice — not a real PYQ
Which one of the following is primarily a control for protecting data integrity?
- (a)Firewall
- (b)Cryptographic hash / checksum verification
- (c)RAID and off-site backups
- (d)Password policy
Answer(b) Cryptographic hash / checksum verification — it detects whether data has been altered. Firewalls and password policies serve confidentiality; RAID and backups serve availability.