How should confidential information be handled by security staff?

How should confidential information be handled by security staff?

• A. Share confidential information with all staff to improve awareness.
• B. Limit access to authorized personnel, enforce data handling policies, and monitor for breaches.
• C. Store confidential data in publicly accessible folders.
• D. Ignore breaches and rely on external audits.

Answer: (B)

Confidential information should be protected by limiting access to those who need it and by enforcing how data is handled. The best approach is to ensure access is granted only to authorized personnel, implement clear data handling policies (including classification, secure storage, encryption, and proper transmission), and continuously monitor systems for any breaches or unusual activity. This combination reduces the risk of disclosure, supports accountability, and enables prompt response if something goes wrong. Sharing confidential information with all staff undermines the need-to-know principle and greatly increases the chance of a leak. Storing confidential data in publicly accessible folders instantly defeats confidentiality and makes data easy to access. Ignoring breaches and relying on external audits leaves incidents undetected and unaddressed, which is unacceptable in security practice.

Confidential information should be protected by limiting access to those who need it and by enforcing how data is handled. The best approach is to ensure access is granted only to authorized personnel, implement clear data handling policies (including classification, secure storage, encryption, and proper transmission), and continuously monitor systems for any breaches or unusual activity. This combination reduces the risk of disclosure, supports accountability, and enables prompt response if something goes wrong.

Sharing confidential information with all staff undermines the need-to-know principle and greatly increases the chance of a leak. Storing confidential data in publicly accessible folders instantly defeats confidentiality and makes data easy to access. Ignoring breaches and relying on external audits leaves incidents undetected and unaddressed, which is unacceptable in security practice.