Cybersecurity and Data Privacy
Cybersecurity and data privacy are increasingly important topics on the ISC section of the CPA exam. CPAs must understand common threats, defensive controls, privacy regulations, and incident response procedures to protect organizational assets and ensure compliance.
Common Cybersecurity Threats
| Threat | Description | Impact |
|---|---|---|
| Phishing | Deceptive emails or messages that trick users into revealing credentials or clicking malicious links | Credential theft, malware installation, unauthorized access |
| Ransomware | Malware that encrypts data and demands payment for decryption keys | Business disruption, data loss, financial damage |
| SQL injection | Inserting malicious SQL code into application inputs to manipulate databases | Data breach, unauthorized data modification or deletion |
| Man-in-the-middle | Intercepting communications between two parties to eavesdrop or alter messages | Data theft, transaction manipulation |
| Insider threats | Malicious or negligent actions by authorized users (employees, contractors) | Data theft, fraud, sabotage |
| Denial of Service (DoS/DDoS) | Overwhelming systems with traffic to make them unavailable | Business disruption, lost revenue |
Encryption
Encryption protects data confidentiality by converting plaintext into unreadable ciphertext:
| Type | How It Works | Use Cases |
|---|---|---|
| Symmetric encryption | Same key for encryption and decryption (AES, DES, 3DES) | Encrypting data at rest, bulk data encryption |
| Asymmetric encryption | Public key encrypts, private key decrypts (RSA, ECC) | Digital signatures, key exchange, secure communications |
| Hashing | One-way function producing fixed-length output (SHA-256, MD5) | Password storage, data integrity verification |
Data should be encrypted both at rest (stored data) and in transit (data being transmitted). TLS/SSL protocols secure data in transit; full-disk encryption and database encryption protect data at rest.
Access Control Models
- Role-Based Access Control (RBAC): Access permissions assigned based on organizational roles. Most common in enterprise environments.
- Discretionary Access Control (DAC): Resource owners determine who can access their resources. Flexible but less secure.
- Mandatory Access Control (MAC): Access determined by security labels and clearance levels. Used in government and military systems.
- Multi-factor authentication (MFA): Requires two or more verification factors: something you know (password), something you have (token), something you are (biometric).
Data Privacy Regulations
| Regulation | Jurisdiction | Key Requirements |
|---|---|---|
| GDPR | European Union | Consent for data collection, right to erasure, data breach notification within 72 hours, data protection officer requirement |
| CCPA/CPRA | California, USA | Right to know, delete, and opt-out of sale of personal information; applies to businesses meeting revenue or data volume thresholds |
| HIPAA | United States (healthcare) | Privacy and security rules for protected health information (PHI); administrative, physical, and technical safeguards required |
| SOX | United States (public companies) | Internal controls over financial reporting; IT controls supporting financial data integrity |
Incident Response
A structured incident response process helps organizations contain and recover from security incidents:
- Preparation: Develop incident response plan, train team, establish communication channels
- Identification: Detect and confirm the incident through monitoring, alerts, and analysis
- Containment: Limit the scope and impact of the incident (short-term and long-term containment)
- Eradication: Remove the root cause of the incident (malware removal, vulnerability patching)
- Recovery: Restore systems to normal operations, verify functionality, monitor for recurrence
- Lessons learned: Document findings, update procedures, and improve defenses based on the incident
Build your cybersecurity knowledge with ISC flashcards and practice exams. Start free to access all study materials.