6.1.1 Security, Privacy and Data Integrity
Computer systems often hold data that people and organisations depend on. To discuss how that data should be protected, we need three related ideas: security, privacy and integrity. They overlap, but each one focuses on a different question.
By the end of this section, you should be able to:
- Distinguish between data security, data privacy and data integrity.
- Use each term accurately when analysing a computing scenario.
- Explain why protecting the data is not enough unless the computer system is also protected.
- Explain how a security failure can damage privacy, integrity or availability.
Three Different Questions
A useful way to separate the terms is to ask three different questions about the same dataset.
| Concept | Main question | What a failure might look like |
|---|---|---|
| Data integrity | Can the data be trusted as accurate and current? | A record contains an incorrect quantity or an obsolete address. |
| Data privacy | Is the data only seen and used by authorised people? | A confidential file is displayed to someone without permission. |
| Data security | Is the data protected against loss, damage, alteration and unauthorised access? | Files are deleted, corrupted, stolen or unavailable when required. |
Data Integrity
Data has integrity when it remains accurate and up to date for the task in which it is being used. Integrity can be damaged by typing mistakes, incorrect processing, unauthorised changes, failed transfers or records that have not been updated.
Example: equipment records
A climbing centre's database reports that 26 safety helmets are available. A recent inspection removed four damaged helmets, but the database was not updated. The record is stored securely and only staff can view it, yet its integrity is poor because the value is no longer current.
Data Privacy
Privacy concerns who is permitted to access data and how that data is used. An authorised user is someone who has been given permission to perform a particular action, such as viewing or editing a record. Different users may need different levels of access.
Example: staff records
A company receptionist may need access to staff names and office extensions. This does not mean the receptionist should also be able to open payroll records. Both files belong to the same organisation, but their privacy requirements are different.
Data Security
Data security is the broader protection applied to data. It aims to prevent unauthorised access or alteration, reduce the chance of loss or corruption, and make sure authorised users can obtain the data when it is needed.
Consider a theatre booking system. If customer bookings are encrypted but the only copy of the database is destroyed by a storage failure, confidentiality may have been preserved, but security has still failed because the data is no longer available or recoverable.
Why Both the Data and the System Need Protection
Data is stored, processed and transmitted by a computer system. Protecting a file is therefore not enough if the device, operating system, user accounts or network around it can be compromised. System security protects the environment that handles the data; data security protects the data itself.
| Area being protected | What must be maintained | Example of failure | Possible effect on data |
|---|---|---|---|
| Computer system | Authorised use and continued operation | An attacker gains control of an administrator account. | Files may be viewed, changed or deleted. |
| Stored data | Protection from disclosure, alteration, corruption and loss | A database file is overwritten by an incorrect version. | Records may become inaccurate or unavailable. |
| Networked service | Reliable access for legitimate users | The service stops responding during a critical period. | Correct data exists but cannot be used when required. |
Later sections examine the threats that can cause these failures and the security measures used to reduce the risks.
How the Concepts Connect
Security supports privacy and integrity, but it does not automatically guarantee either one. A well-protected system can still contain inaccurate data, and an authorised user can still misuse information or make an incorrect change.
| Scenario | Integrity | Privacy | Security |
|---|---|---|---|
| A members-only timetable is correct, current and restricted to registered users. | Maintained | Maintained | Maintained |
| A delivery address is visible only to authorised staff, but it is three years out of date. | Failed | Maintained | Partly maintained |
| A correct employee rota is accidentally published on a public webpage. | Maintained | Failed | Failed |
| A correct encrypted database cannot be restored after the storage device fails. | May be maintained | May be maintained | Failed |
Interactive: Integrity, Privacy or Security?
Read each situation and choose the concept that is most directly affected. Some incidents influence more than one concept, so use the feedback to compare the strongest answer with the wider effects.
Common Mistakes and Misconceptions
- Using security, privacy and integrity as synonyms.
- Describing integrity as “only authorised users can see the data”. That describes privacy.
- Assuming private data must be inaccessible to everyone rather than restricted to authorised users.
- Forgetting availability when explaining security.
- Assuming strong security controls will correct data that was already inaccurate.
- Discussing only the data file and ignoring the system that stores and processes it.
Practice
Knowledge and application
- Write separate definitions for data integrity, data privacy and data security.
- Explain why an accurate dataset might still fail to meet privacy requirements.
- Explain why restricting access to a database does not guarantee that its records have integrity.
- A wildlife centre stores animal feeding records on a secure server. One record lists the wrong food quantity because a keeper selected the wrong value. Identify the main concept affected and justify your answer.
- A travel company keeps customer passport details in a file that all employees can open. The details are accurate and backed up. Explain which requirement has failed and why.
- A repair workshop's database is correct and access-controlled, but a server fault makes it unavailable for two days. Explain why this is still a security failure.
- Explain why protecting the computer system is necessary for protecting the data stored on it.
- Create your own scenario in which privacy is maintained but integrity is not.
Review
| Prompt | Essential idea |
|---|---|
| What does integrity focus on? | Whether data is accurate and up to date. |
| What does privacy focus on? | Whether access and use are limited to authorised people. |
| What does security focus on? | Protection against unauthorised access, alteration, loss and damage, together with availability. |
| Why protect the computer system? | A compromised or unavailable system can expose, change, destroy or block access to its data. |
| Does security guarantee integrity? | No. Securely stored data may still be incorrect or out of date. |