I.29 Information Security / Privacy

⬆️ Back to: P-I.I. Introduction to Computing

🧭

Page Outline — click a heading to jump. Past-paper questions sit in the last section.

🎯

Exam pattern (2016–2026): 2019 Q2(b) AI for cyber security · 2019 Q5(a) cloud security · 2022 Q3(b) security principles · 2024 MCQs Q10, Q11 · 2026 MCQ Q20. High priority.

---

CSS Computer Science (Optional) — Paper-I, Section-A, Topic I, p.70-72. Covers: Information Security/Privacy.

Definition

• Information Security: the practice of protecting data from unauthorized access, alteration, or destruction.
• Privacy: an individual's right to control what personal data is collected about them, how it's used, and who it's shared with.

Information Security

• Information security rests on the foundational CIA Triad framework:
• Confidentiality: ensuring information is accessible only to those authorized to see it
  • Definition: the principle that sensitive data is disclosed only to individuals, systems, or processes with proper authorization to view it.
  • How it's achieved: encryption (scrambling data so it is unreadable without a decryption key), access-control lists and role-based permissions, and strong authentication (passwords, biometrics, multi-factor authentication).
  • What violates it: a data breach, an insider leaking records, or an unencrypted database left exposed on the internet.
  • Example: a hospital encrypting patient records so only doctors with valid login credentials can read them; a bank encrypting card numbers both in transit and in storage.
• Integrity: ensuring information is accurate and has not been tampered with
  • Definition: the guarantee that data remains accurate, consistent, and unaltered from its authoritative state, whether the change would be accidental or malicious.
  • How it's achieved: checksums and hash functions (detect accidental corruption), digital signatures (detect tampering and confirm the true origin of data), version control, and audit logs.
  • What violates it: a hacker altering exam results in a university's database, or malware silently modifying financial transaction records.
  • Example: a digital signature on a downloaded software update proving the file has not been modified since the vendor released it.
• Availability: ensuring authorized users can access information/systems when needed
  • Definition: the assurance that systems, services, and data remain accessible to authorized users whenever they are needed.
  • How it's achieved: redundant/failover servers, regular backups, protection against Denial-of-Service attacks, and disaster-recovery planning.
  • What violates it: a Distributed Denial-of-Service (DDoS) attack flooding a bank's servers so customers cannot reach online banking; a fire or flood destroying a data center with no off-site backup.
  • Example: a website staying online during a traffic surge because it runs on geographically redundant, load-balanced servers.

Privacy

• Privacy: concerns an individual's right to control their own personal data — who collects it, how it's used, and who it's shared with.
  • Personal data: any information relating to an identifiable individual — name, CNIC number, biometric data, location history, browsing habits, medical records.
  • Informed consent: the principle that individuals should knowingly and freely agree to how their data is collected, used, and shared — often undermined in practice by long, unread terms-of-service agreements.
  • Pakistani legal context: Pakistan does not yet have a single comprehensive data-protection statute in force, but privacy-adjacent conduct is partly addressed under PECA 2016 (Prevention of Electronic Crimes Act, 2016) — e.g., offences around unauthorized interception of information and the unauthorized use or dissemination of a person's data/images. A dedicated Personal Data Protection Bill is also under development for more comprehensive regulation.
• Security vs privacy: related but distinct — security is the mechanism protecting data, while privacy is the right being protected.
  • Example: a system can be perfectly secure (no unauthorized access) while still violating privacy, if the organization that legitimately holds the data misuses it without consent.

---

MCQ Traps

• Confidentiality, Integrity, Availability — memorize as the CIA triad in that exact order; each maps to a distinct protective goal.
• Security and privacy are not the same concept — security protects data from unauthorized parties; privacy governs how even authorized parties may use data.
• A DDoS attack is an availability violation, not a confidentiality breach — no data is stolen or altered, but legitimate users are locked out.

✅ Self-Test Questions (with Answers)

Q1. Define the CIA triad and give one real-world mechanism that supports each element.

Ans: The CIA triad is the foundational model of information security, naming the three goals every security control ultimately serves: Confidentiality, Integrity and Availability.

• Confidentiality — information is disclosed only to those authorised to see it. Real-world mechanism: encryption, such as AES-256 protecting a stored database and TLS/HTTPS protecting data in transit, so that intercepted or stolen data is unreadable without the key. Access-control lists, role-based permissions and multi-factor authentication support the same goal.
• Integrity — information remains accurate, consistent and unaltered from its authoritative state, whether the change would be accidental or malicious. Real-world mechanism: cryptographic hash functions such as SHA-256, and digital signatures, which reveal any modification; audit logs and version control reinforce it.
• Availability — authorised users can reach the systems and data when they need them. Real-world mechanism: redundant, load-balanced servers with failover, combined with regular backups and a disaster-recovery plan; anti-DDoS protection defends the same property.

The three are frequently in tension — tightening confidentiality with heavy authentication can reduce availability, and maximising availability by replicating data widely enlarges the confidentiality attack surface. Security design is therefore a balance, not the maximisation of any one element. A common extension adds non-repudiation (a party cannot deny having sent or signed something) and authentication.

Q2. Explain the distinction between information security and privacy.

Ans: Information security is the mechanism; privacy is the right being protected. Information security is the technical and organisational practice of protecting data from unauthorised access, alteration or destruction — it asks "is the data safe from people who should not have it?" Privacy is an individual's right to control what personal data is collected about them, how it is used, and with whom it is shared — it asks "should this data have been collected at all, and is it being used as the person agreed?"

The decisive difference is who the threat is. Security defends against outsiders and unauthorised insiders. Privacy governs the conduct of the legitimate holder of the data — the organisation that lawfully collected it. A company can defeat every hacker and still violate privacy by selling its users' data to third parties without meaningful consent.

The relationship is asymmetric and this is the key exam point: security is necessary but not sufficient for privacy. You cannot have privacy without security — if data leaks, control over it is gone regardless of policy. But you can have security without privacy — a perfectly hardened system can still be used to surveil people or monetise their data without consent. Privacy therefore constrains the authorised use of data in a way that security never addresses.

Q3. Give an example of a system that is secure but still violates privacy.

Ans: A social media or mobile-app platform that is technically impeccable yet monetises users' data without meaningful consent. Suppose the platform encrypts all data at rest with AES-256 and in transit with TLS, enforces multi-factor authentication, maintains audit logs, has never suffered a breach and passes every penetration test — security is excellent. Yet the same platform continuously collects location history, contact lists, browsing behaviour across other sites, and inferred attributes such as political leaning or health interests; builds a detailed behavioural profile; and sells targeted access to advertisers and data brokers — all disclosed only in a 40-page terms-of-service document no user reads. Privacy is comprehensively violated even though no unauthorised party ever obtained anything. The harm comes from the authorised holder's use of the data, which security controls are not designed to restrain.

Further examples of the same pattern:

• A mobile app demanding permissions far beyond its function — a torch app requesting contacts, microphone and location — and storing them securely on well-defended servers.
• An employer's monitoring system that securely logs every keystroke, screenshot and website visit of its staff.
• A state surveillance programme with excellent encryption and strict access control, collecting citizens' communications metadata without warrant or oversight.
• A smart TV or IoT device transmitting encrypted viewing habits back to the manufacturer for sale to advertisers.

The principle: security answers "who can get the data?"; privacy answers "what may be done with it, and should it have been collected at all?" Encryption cannot protect a person from the organisation holding the decryption key. The remedies for this failure are legal and ethical — consent that is genuinely informed, data minimisation (collect only what the stated purpose requires), purpose limitation (use it only for that purpose), retention limits and a right of deletion — not technical.

Q4. Explain, with an example, how a checksum or digital signature protects integrity specifically (as opposed to confidentiality).

Ans: These mechanisms detect change; they do not conceal content. That is precisely why they serve integrity rather than confidentiality.

A hash function such as SHA-256 takes an input of any size and produces a fixed-length digest — for SHA-256, 256 bits shown as 64 hexadecimal characters. Two properties make it useful: it is deterministic (the same input always yields the same digest) and it exhibits the avalanche effect (changing a single bit of the input changes roughly half the digest bits). It is also one-way — the original data cannot be recovered from the digest.

Worked example — checksum. A university publishes a 2 GB software package along with its SHA-256 digest, a3f5...9c2e. After downloading, the user computes the hash of the received file. If the two digests match exactly, the file is bit-for-bit identical to what was published — integrity confirmed. If even one byte was corrupted in transit or altered by an attacker, the computed digest differs wildly and the tampering is detected. But note what did not happen: the file was transmitted in plain form the whole time, readable by anyone who intercepted it. Integrity was protected; confidentiality was not.

Worked example — digital signature. A signature adds authenticity and non-repudiation on top of integrity. A vendor releasing a software update hashes the file and then encrypts the hash with its private key — that encrypted hash is the signature, distributed alongside the update. The recipient decrypts the signature with the vendor's public key to recover the original digest, independently hashes the downloaded file, and compares. A match proves two things at once: the file has not been modified since signing (integrity), and it genuinely came from the holder of that private key (authenticity), who cannot later deny signing it (non-repudiation). Again, the update itself may be entirely unencrypted and readable by anyone.

A plain checksum alone is weak against a deliberate attacker who can replace both the file and the published checksum; the signature closes that gap because forging it requires the private key. In practice the two goals are combined — encryption for confidentiality plus a signature or MAC for integrity — which is exactly what TLS does on every HTTPS connection.

CSS angle: Digital signatures underpin e-governance in Pakistan. The Electronic Transactions Ordinance 2002 gives legal recognition to electronic records and digital signatures, and the National Institutional Facilitation Technologies (NIFT) operates as the certification authority — the legal basis on which electronically signed official documents, e-filing and online banking instructions are treated as authentic.

Q5. What legal instrument partially addresses privacy-related offences in Pakistan today, and what broader legislation is still being developed?

Ans: The instrument currently in force is the Prevention of Electronic Crimes Act (PECA), 2016 — Pakistan's principal cybercrime statute. PECA is primarily a criminal law against cyber offences, not a comprehensive data-protection regime, but several of its provisions address privacy-adjacent conduct:

• Unauthorised access to an information system or data, and unauthorised copying or transmission of data.
• Unauthorised interception of a transmission or of electromagnetic emissions from an information system — the electronic analogue of wiretapping.
• Unauthorised use or dissemination of a person's identity information, and offences concerning the non-consensual distribution of a person's images or intimate material.
• Electronic forgery and fraud, and offences relating to malicious code and critical infrastructure.

Enforcement rests with the federal investigating agency's cybercrime wing, with the PTA exercising regulatory functions over content and service providers.

The broader legislation still being developed is a dedicated Personal Data Protection Bill, which has been through several drafts under the Ministry of IT and Telecommunication but has not yet been enacted as a comprehensive statute in force. Its purpose is fundamentally different from PECA's: rather than punishing criminals after an intrusion, it would regulate the lawful, everyday handling of personal data by organisations — establishing principles of informed consent, purpose limitation, data minimisation, retention limits, a right of access and correction, obligations of breach notification, rules on cross-border data transfer, and an independent data-protection authority to enforce them. In broad design it follows the model of the EU's GDPR (in force since 2018).

Why the gap matters: PECA governs what happens when someone breaks in; it says very little about what a company or agency may do with data it collected perfectly lawfully. That is precisely the security-versus-privacy distinction. Pakistan's exposure is substantial — NADRA holds biometric and identity data on essentially the entire adult population, telecom operators hold CNIC-linked SIM records and location data, and branchless-banking platforms hold financial histories of tens of millions. Without a comprehensive data-protection law, the rules governing the use, sharing and retention of that data remain incomplete. This is a strong, current and frequently examinable point for a CSS answer on digital governance.

📜 Past-Paper Questions & MCQs (CSS 2016–2026)

2019 · Paper-I · Q2(b) · 5 marks

Q. How may artificial intelligence help in improving cyber security?

Quick revision and exam-ready model

Quick revision — key points

• AI detects anomalies and malicious files
• It flags phishing and suspicious transactions
• AI prioritises incident-response alerts
• Discuss false positives, adversarial threats and privacy

Exam-ready answer (5 marks)

Introduction: Artificial intelligence improves cybersecurity by analysing large volumes of security data, recognising suspicious patterns and helping defenders respond to threats more quickly.

Major applications

1. Anomaly detection: Machine-learning systems learn normal patterns of network traffic and user activity. They can flag unusual login locations, unexpected file access or abnormal data transfers that may indicate an intrusion.
2. Malware identification: AI-assisted security tools classify suspicious files and behaviour, helping detect both known malware and previously unseen variants.
3. Phishing prevention: Models examine email text, sender characteristics, links and website patterns to identify fraudulent messages before users disclose credentials.
4. Fraud and intrusion monitoring: Financial institutions can detect atypical payments or account activity, while intrusion-detection systems identify potentially malicious network events.
5. Faster incident response: AI can group related alerts, prioritise serious incidents and recommend responses, reducing the burden on security analysts.

Example: If a bank account is accessed from an unfamiliar device and immediately initiates unusual transfers, an AI-based monitoring system can flag the activity for verification.

Limitation and conclusion: False alarms, biased data and adversarial manipulation mean that AI decisions still require human oversight. AI is therefore an important supporting tool, not a replacement for basic security controls.

2019 · Paper-I · Q5(a) · 10 marks

Q. Discuss the security issues associated with cloud computing.

Quick revision and exam-ready model

Quick revision — key points

• Threats: exposed storage, weak identity, insecure APIs
• Also breaches, ransomware, insider risks and outages
• Use IAM, MFA, encryption, backups and monitoring
• Explain shared responsibility across IaaS/PaaS/SaaS

Exam-ready answer (10 marks)

Introduction: Cloud computing provides on-demand access to servers, storage, platforms and applications over a network. Although it reduces infrastructure costs and improves scalability, storing and processing data on shared, remotely managed systems introduces important security risks.

Principal security issues

1. Data breaches and unauthorised access: Confidential customer or organisational records may be exposed through weak permissions, stolen credentials or vulnerabilities. Example: A publicly accessible cloud storage bucket may reveal private documents.
2. Misconfiguration: Incorrect firewall rules, storage permissions and security settings can unintentionally expose services to the Internet. Continuous configuration checks are essential.
3. Account hijacking and weak identity management: Attackers may steal passwords, access tokens or API keys and then misuse cloud resources. Control: multifactor authentication (MFA), least-privilege access and key rotation.
4. Insecure APIs and applications: Cloud services depend on web interfaces and APIs. Weak authentication, poor input validation or unpatched software can provide entry points for attackers.
5. Insider threats: Authorised personnel at the customer organisation or cloud provider may accidentally disclose or intentionally misuse data. Access review, logging and separation of duties reduce this risk.
6. Data loss and ransomware: Accidental deletion, malicious encryption or failed recovery procedures can make important information unavailable. Independent backups and tested restoration plans are essential.
7. Shared infrastructure and isolation failures: Different tenants may use common physical hardware. Weak isolation or a provider vulnerability can expose one customer's workloads to another.
8. Availability attacks and outages: Distributed denial-of-service (DDoS) attacks, provider failures or network disruptions may interrupt access to critical services. Redundancy and incident-response plans help minimise disruption.
9. Compliance and data location: Data may be stored or processed under different legal jurisdictions. Organisations must consider privacy requirements, contractual obligations and permitted data locations.
10. Limited visibility and vendor dependence: Customers may have less direct control over the underlying infrastructure. They need reliable logs, monitoring, clear service-level agreements and exit/recovery strategies.

Shared-responsibility model

• Cloud provider: Generally protects the physical facilities and underlying cloud infrastructure.
• Customer: Must protect its data, user accounts, application settings and access permissions; the precise division varies across IaaS, PaaS and SaaS.

Practical safeguards: Encryption, MFA, least-privilege IAM, secure API design, patching, monitoring, regular audits and recoverable backups address the principal risks.

Conclusion: Cloud security requires more than trusting the service provider. Effective protection depends on secure configuration, continuous monitoring and a clearly understood division of responsibility.

2022 · Paper-I · Q3(b) · 6 marks

Q. Write a detailed note on the principles of information security / privacy.

Quick revision and exam-ready model

Quick revision — key points

• Define CIA triad: confidentiality, integrity, availability
• Identity authentication and least privilege
• Auditability and non-repudiation
• Privacy: minimisation, purpose and retention

Exam-ready answer (6 marks)

Introduction: Information security protects digital information and systems against unauthorised access, alteration and disruption. Privacy concerns the lawful and appropriate handling of personal information. Their foundational principles are outlined below.

A. The CIA triad

1. Confidentiality: Only authorised individuals should access sensitive information. Controls: encryption, passwords and role-based access restrictions. Example: Patients' medical records should be accessible only to authorised healthcare staff.
2. Integrity: Data must remain accurate, complete and protected against unauthorised modification. Controls: cryptographic hashes, digital signatures and audit trails. Example: A bank must detect improper changes to a transaction amount.
3. Availability: Information and systems should remain usable whenever authorised users need them. Controls: backups, redundant servers, maintenance and disaster-recovery arrangements. Example: An online banking service should remain operational during a hardware failure.

B. Supporting security principles

1. Authentication and authorisation: Authentication verifies who the user is, while authorisation determines what the verified user can access. The principle of least privilege limits access to what a job requires.
2. Accountability and non-repudiation: Logs help associate actions with responsible users, while appropriately designed digital signatures provide evidence relevant to whether a signed action can later be denied.

C. Information-privacy principles

1. Purpose limitation and data minimisation: Collect personal data for a defined purpose and only in the quantity genuinely required. Inform users about its use, restrict retention and dispose of it securely when no longer needed.

Integrated example: A hospital encrypts patient records (confidentiality), verifies changes (integrity), keeps backups (availability), restricts staff access (least privilege) and retains personal data only as necessary (privacy).

Conclusion: The CIA triad, supporting access controls and responsible personal-data handling together provide a sound foundation for information security and privacy.

MCQs

2024 P-I · Q10. An employee asks for root access to a UNIX system that you administer. You should not give it unless the job needs those rights. Which cyber security notion is this an example of?

• (A) Least privileges ✅
• (B) Separation of Privileges
• (C) Open Design
• (D) None of these
• Answer: (A) Least privileges.
• Why: the principle of least privilege says every user gets only the access needed for the job. Separation of privilege needs two conditions or two parties to grant access, and open design says security must not depend on secrecy of the design.

2024 P-I · Q11. After a certain time (say thirty minutes) an online application, like a banking website, prompts users to log in again. Which cyber security concept is this an example of?

• (A) Compromise recording
• (B) Psychological acceptability
• (C) Complete mediation ✅
• (D) None of these
• Answer: (C) Complete mediation.
• Why: complete mediation means every access to a resource is checked every time, not just at the first login. Re-authentication after a timeout re-checks the user's authority. Psychological acceptability is about making security easy to use.

2026 P-I · Q20. A project is using open-source components that have security vulnerabilities. What is the risk?

• (A) Security breaches or compliance issues ✅
• (B) Non-technical issues
• (C) Open-source issues
• (D) None of these
• Answer: (A) Security breaches or compliance issues.
• Why: a known vulnerability in a library can be exploited to attack the whole product, and using vulnerable or wrongly licensed components can break security rules and legal or regulatory requirements. The other options are not real risk categories.