Confidentiality

ISO/IEC 27000 defines confidentiality as the property that information is not made available or disclosed to unauthorised individuals, entities or processes. It is enforced by two families of mechanism that are easy to confuse. Access control decides who may read an object while it sits inside a system that enforces the rules; encryption protects the object when it leaves that enforcement boundary, on the wire, on a stolen disk, in a backup or at a cloud provider. Neither replaces the other: an encrypted database is fully readable by an application account with excessive privileges, and perfect access control is irrelevant once a file has been copied to a USB stick.

Access-control models formalise the "who". Discretionary access control (DAC) lets owners grant access, as with file-system ACLs; mandatory access control (MAC) enforces system-wide labels, the classic example being the Bell-LaPadula model (1973) with its "no read up, no write down" rules for classified data; role-based access control (RBAC) attaches permissions to job roles; attribute-based access control (ABAC) evaluates policies over user, resource and context attributes at request time. Across all of them the governing principles are need-to-know and least privilege, and the operational weak point is usually privilege creep as people change jobs.

For encryption, the usual split is data in transit (TLS 1.3, RFC 8446, with forward secrecy through ephemeral Diffie-Hellman so that a later key compromise does not expose recorded sessions), data at rest (full-disk, database or object-level encryption, where the real question is who controls the keys) and, increasingly, data in use through confidential computing enclaves. "Harvest now, decrypt later" is a confidentiality threat specific to long-lived secrets, and is the main argument for migrating to post-quantum key exchange before large quantum computers exist.

Confidentiality also leaks through channels that access control does not model: metadata such as who communicates with whom and when, traffic analysis of encrypted flows, error messages and timing differences, side channels such as the Spectre and Meltdown CPU flaws disclosed in 2018, and inference from aggregated or "anonymised" datasets. Confidentiality is distinct from privacy, which is about lawful and fair processing of personal data even by authorised parties, and from integrity, which concerns modification rather than disclosure. Under GDPR, Art. 5(1)(f) and Art. 32 require appropriate confidentiality measures, with Art. 32(1)(a) naming encryption and pseudonymisation, and unauthorised disclosure is a personal data breach that must be assessed for notification to Datatilsynet within 72 hours under Art. 33.