[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 5 · 5.1.c
AP Cybersecurity · Securing Applications and Data
Assessing Application and Data Risks
Two dials set the band: how sensitive the data is, and how weak the protection is.
key ideaTwo dials set the band: how sensitive the data is and how weak the protection is.
The stages
Data risk is scored against the three security principles. A compromise of confidentiality when unauthorized persons can access sensitive data; of integrity when data can be manipulated or altered from its intended state; and of availability when data cannot be reached — and the band follows from sensitivity and the strength of what protects it.
1
Classify the data
How sensitive is it? Regulated data — governed by laws or regulations — sits at the top, and that classification carries into every later step.
in a data store out a sensitivity level
2
Name which principle is at stake
Confidentiality if unauthorized persons can access it; integrity if it can be altered from its intended state; availability if it can be made unreachable.
out the nature of the loss
3
Assess the protection actually in place
Encryption — and the key length. Access controls — and how strict they are. ‘Encrypted’ is not a yes-or-no answer.
out a protection strength
4
Assess likelihood of exploitation
A highly likely exploit against highly sensitive data is what pushes a finding to the top band.
out a likelihood
5
Band and document
High: highly sensitive data plus a highly likely exploit. Moderate: sensitive data with weak encryption or loose access control. Low: less sensitive data with short keys or loose controls.
out a ranked register
| Band | Data sensitivity | Protection weakness | Illustration |
|---|
| high | highly sensitive, often regulated | plus a highly likely exploit | regulated records reachable through a known, easily exploited flaw |
| moderate | sensitive | not strong enough encryption or not strict enough access controls | customer personal information encrypted weakly, or readable by too many staff |
| low | less sensitive | shorter keys, or access controls that are not strict enough | internal non-sensitive information with a short key |
The third column repeats between rows two and three deliberately. Weak protection is not itself the band — it becomes one only once you know what it is protecting.
Applying it
The most common scoring error here is treating encryption as binary. The CED distinguishes not strong enough encryption from shorter keys — both are real findings, and the data behind them decides which band they land in.
| Principle | Compromised when | Typical finding |
|---|
| confidentiality | unauthorized persons can access sensitive data | over-broad file permissions; unencrypted storage |
| integrity | data can be manipulated or altered from its intended state | write access granted too widely; no change auditing |
| availability | data cannot be reached when needed | no backups; a single point of failure |
Naming the principle is what turns ‘this is bad’ into a defensible risk statement — and it usually suggests the control as well.
Confidentiality riskUnauthorized persons can access sensitive data.
Integrity riskData can be manipulated or altered from its intended state.
Availability riskData cannot be reached when it is needed.
Regulated dataData governed by laws or regulations — the classification that pushes findings into the high band.
Key lengthHow long the encryption key is. The CED treats shorter keys as a distinct, lesser weakness from encryption that is simply not strong enough.
Worked analysis
EX 1
Score a high finding
An organization stores regulated health records in a database reachable through an application with a known, easily exploited injection flaw. Assess it.
1
Classify the data
Highly sensitive — governed by laws or regulations.
2
Name the principle
Confidentiality — unauthorized persons could access it.
3
Assess likelihood
A known flaw with a straightforward exploit is highly likely to be used.
4
Apply the band test
Highly sensitive data plus a highly likely exploit → high.
5
Document the mitigation
Fix the input validation; in the interim, restrict access and monitor closely.
EX 2
Weak encryption on sensitive data
A company stores customers' personal information encrypted with an outdated algorithm. Band it.
1
Classify the data
Sensitive — personal information, though not necessarily regulated here.
2
Note that it is protected
Encryption exists, so this is not the unencrypted case.
3
Assess the strength
Not strong enough — an outdated algorithm is a real weakness.
4
Apply the band test
Sensitive data without strong enough encryption → moderate.
5
Give the mitigation
Re-encrypt with a current algorithm and adequate key length, and record the interim exposure.
EX 3
A short key on unimportant data
An organization encrypts an internal, non-sensitive document store with a short key. Is this a high finding?
1
Classify the data
Less sensitive — nothing regulated, nothing personal.
2
Name the weakness
A shorter key than current practice recommends.
3
Assess the impact if broken
Limited — the contents are not sensitive.
4
Apply the band test
Less sensitive information with a shorter key → low.
5
Note what would change it
Move sensitive data into that store and the band rises immediately, without anything technical changing.
Check yourself
What three compromises can a data security risk involve?
Show answer
Confidentiality when unauthorized persons can access sensitive data; integrity when data can be manipulated or altered from its intended state; and availability when data cannot be reached.
What makes a data risk high?
Show answer
It involves highly sensitive data — often data governed by laws or regulations — that could be compromised through a highly likely exploit.
What characterizes a moderate data risk?
Show answer
Sensitive data that does not have strong enough encryption or strict enough access controls.
What characterizes a low data risk?
Show answer
Less sensitive information being encrypted with shorter keys, or having access controls that are not strict enough.