Confidentiality of information
Confidentiality of information - means a situation in which classified information is disclosed and each of its recipients is bound by an obligation of confidentiality. It may constitute, in particular, business secrets or state secrets. Everyone who comes into possession of the confidentiality of information is obliged to maintain it. Very often such information is referred to as "classified' or "highly classified'. Violation of the regulations on confidentiality of information or signed, binding agreements, may be a basis for initiating criminal proceedings or civil proceedings aimed at enforcing appropriate compensation for damages suffered due to violation of confidentiality of information.
Non-disclosure agreements and confidentiality of information
It is often the case that companies have to disclose classified information to potential business partners. This is due, among other things, to the fact that they want to check the solutions applied within the organization. Before any due diligence or simply testing of the technology takes place, both parties sign a non-disclosure agreement that is designed to protect each party from disclosing classified information. They shall specify, inter alia, the scope, and type of use of classified information, the persons authorized to handle the information and the possible consequences if either party were to breach the provisions of the contract.
At the same time, however, these agreements are an appropriate protection for start-ups that seek financing from venture capital companies or angel of business. The aim is to protect their technology from being taken over by more powerful corporations and to present the concept of the planned business as safely as possible.
Information-flow and confidentiality
The flow of information is intrinsically linked to the confidentiality aspect. It is therefore important to maintain different security policies that do not involve interference with data resources. With this in mind, the following actions can be presented in the literature [1].
Noninterference - it consists of the fact that computer programs not only encrypt the transmitted messages but also monitor their flow during transmission.
General noninterference - consists of the fact that the program checks itself whether by performing specific algorithms it does not pass on confidential information. This is because some commands that can be applied by the attacker can lead to such situations.
The frequent reason for the above-described actions is the universality of hacking attacks. The aim of these attacks is very often to obtain information that can then be sold on the black market. It is therefore important to mitigate the risks arising from the possession of confidential information.
How to mitigate risk of confidential information disclosure
To maintain the confidentiality of information, any breach of information or data breach must be automatically reported to the persons responsible for maintaining such procedures in the company or institution. Therefore, employees should be able to use a system that automates such events. This makes it possible to call such a confidentiality of information procedure a due diligence procedure [2].
These measures reduce the risk of unauthorized persons getting into possession of information that is not intended for them. Also, a good solution may be to keep employees and oneself trained in the rules of maintaining information security. This is particularly popular when we work with sensitive data, such as personal data.
To mitigate the risk of a breach of confidentiality, it is also worth mentioning the employment of an external company specializing in the protection of such data. This will give you greater assurance that our information is handled by experienced individuals with the appropriate security tools to prevent any violations.
Confidentiality in the digital age
The era of digitization has made confidentiality much more vulnerable to violation. For example, doctors, who use social media must be careful not to disclose the data of their patients in the course of their professional duties. Besides, if they store any data on external drives or personal devices, they should be aware that they may be victims of theft or that all their data may be erased.
As the literature points out, current regulatory applications are not adapted to the challenges and risks of digitization [3]. This may be due, inter alia, to the fact that new technologies are developing too fast than legislators can adapt existing legislation to economic or social needs.
Footnotes
| Confidentiality of information — recommended articles |
| Windstorm Insurance — Accident policy — Fidelity guarantee — Disclosure requirements — Resignation of directors — Information security policy — Ethical values — Limitation of liability — Authorized person |
References
- Crotty, B. H., Mostaghimi A. (2014), Confidentiality in the Digital Age.
- Hedin D. , Sabelfeld A. (2012), A perspective on information-flow control, Chalmers University of Technology, Gothenburg, Sweden, p.5-7
- Hettiarachchi R. (2013), Data Confidentiality, Residual Disclosure And Risk Mitigation, United Nations Economic Commission For Europe (Unece) Conference Of European Statisticians, p.3-6
Author: Marta Cader
