🔐 Confidentiality

Confidentiality means ensuring that information is only accessible to those who are authorised to see it. If you send a private DM on Instagram, confidentiality means that ONLY you and the recipient can read it — not Instagram, not hackers, not the government.

📖 Confidentiality in Practice

Technique	How It Maintains Confidentiality	Real Example
Encryption at rest (AES-256)	Data stored in databases is scrambled. Even if an attacker steals the hard drive, they cannot read the data without the decryption key.	Apple encrypts every iPhone with AES-256. A stolen phone cannot be read.
Encryption in transit (HTTPS/TLS)	Data travelling over the network is encrypted. Interceptors on the same Wi-Fi see gibberish instead of passwords or messages.	Every Google, Instagram, and banking site uses HTTPS. The padlock icon means TLS is active.
Password hashing (bcrypt)	Passwords are converted to irreversible hashes. Even the company storing your data cannot see your actual password.	If Medibank had hashed health records, the stolen data would have been unreadable.
Data classification	Data is labelled by sensitivity (public, internal, confidential, restricted). Each level gets different protections.	A school marks student grades as "restricted" — only the student and their teachers can see them.

⚠️ When Confidentiality Fails

Medibank (2022): 9.7 million Australians had their health records stolen and published on the dark web — including mental health diagnoses, pregnancy records, and HIV status. The data was not encrypted at rest. If it had been, the stolen files would have been unreadable gibberish. This is a catastrophic failure of confidentiality.