ISCSECURITY Masterclass Series
Zane A. — Security Consultant
Confidentiality is not encryption.
A common mistake we see in 2026: teams declaring "we're secure" simply because their data traffic is fully encrypted. Encryption protects data in transit and at rest. It does completely fail to protect data in use, in process, or sitting exposed inside an over privileged SaaS tenant.
In modern operations, confidentiality breaks down in much quieter ways:
• Over permissioned identities with broad read access to sensitive object storage.
• Shared corporate mailboxes lacking strict role based access boundaries.
• SaaS data sprawl, where structured data exports and screenshots end up unmonitored in collaboration tools or unauthorized AI extensions.
• Shadow integrations and third-party OAuth apps holding excessive scope permissions.
From an authorized testing perspective, this highlights why the CIAAN framework must be evaluated holistically:
• Confidentiality fails when any valid identity can read unconstrained data.
• Authenticity fails when we can't reliably verify which machine or user identity initiated the request.
• Non-repudiation fails when logs lack the granularity to track specific data exfiltration paths.
In professional assessments, the highest-impact findings rarely involve an exploit kit.
They look like this,
1. Compromise a valid, low-privilege account.
2. Abuse excessive, default SaaS/Cloud permissions.
3. Exfiltrate sensitive data via native features.
4. Trigger zero alerts due to weak baseline monitoring of normal access patterns.
If your defense strategy stops at "TLS + full-disk encryption," you aren't enforcing confidentiality. You're just securing the path for the adversary to log in and take it.
Curriculum reference: https://iscsecurity.org
Community discussion: https://cyberr.ai/groups/iscsecurity
1 reactions · 0 comments