Cybersecurity and Data Privacy
Cybersecurity and data privacy are increasingly important topics on the ISC section of the CPA exam. CPAs must understand common threats, defensive controls, encryption methods, and privacy regulations to evaluate technology risks and advise clients.
Common Cybersecurity Threats
- Phishing and social engineering: Manipulating individuals into revealing sensitive information or performing actions. Includes spear phishing (targeted), whaling (executives), and vishing (voice-based).
- Ransomware: Malware that encrypts data and demands payment for decryption keys. Prevention requires backup strategies, patching, and endpoint protection.
- SQL injection: Inserting malicious SQL code into application queries to access or modify database contents. Prevented by parameterized queries and input validation.
- Man-in-the-middle attacks: Intercepting communications between two parties. Prevented by encryption (TLS/SSL) and certificate validation.
- Denial of service (DoS/DDoS): Overwhelming systems with traffic to prevent legitimate access. Mitigated by traffic filtering and content delivery networks.
- Insider threats: Malicious or negligent actions by employees, contractors, or other trusted individuals with system access.
Encryption Fundamentals
| Type | How It Works | Use Cases | Examples |
|---|---|---|---|
| Symmetric | Single key for encryption and decryption | Data at rest, bulk data encryption | AES, DES, 3DES |
| Asymmetric | Public key encrypts, private key decrypts | Key exchange, digital signatures, TLS | RSA, ECC |
| Hashing | One-way function producing fixed-length output | Password storage, data integrity | SHA-256, SHA-3 |
Digital signatures use asymmetric encryption in reverse: the sender signs with their private key, and the recipient verifies with the sender's public key. This provides authentication, integrity, and non-repudiation.
Access Control Models
- Role-based access control (RBAC): Access permissions assigned based on job roles. Most common in enterprise environments.
- Mandatory access control (MAC): Access determined by security labels and clearance levels. Used in government and military systems.
- Discretionary access control (DAC): Resource owners determine who can access their resources.
- Principle of least privilege: Users receive only the minimum access necessary to perform their job functions.
- Segregation of duties: Critical functions split among multiple people to prevent fraud. In IT: separate development, testing, and production access.
Data Privacy Regulations
CPAs must be aware of key privacy regulations and their requirements:
- GDPR (General Data Protection Regulation): EU regulation governing personal data processing. Requires consent, data minimization, right to erasure, breach notification within 72 hours, and data protection officers for certain organizations.
- CCPA/CPRA (California Consumer Privacy Act/California Privacy Rights Act): Gives California residents rights over their personal information including the right to know, delete, opt out of sale, and non-discrimination.
- HIPAA (Health Insurance Portability and Accountability Act): Protects health information with the Privacy Rule, Security Rule, and Breach Notification Rule.
- SOX Section 404: Requires assessment of internal controls over financial reporting, including IT controls that support financial reporting systems.
Business Continuity and Disaster Recovery
Key concepts for the CPA exam include:
- Recovery Point Objective (RPO): Maximum acceptable data loss measured in time. Determines backup frequency.
- Recovery Time Objective (RTO): Maximum acceptable downtime before business operations must resume.
- Hot site: Fully equipped backup facility ready for immediate use. Highest cost, lowest RTO.
- Warm site: Partially equipped facility that requires some setup before use.
- Cold site: Basic facility with power and connectivity but no pre-installed equipment. Lowest cost, highest RTO.
Strengthen your cybersecurity knowledge with ISC flashcards and timed mini exams. Sign up free to access all CPA exam prep materials.