Used hard drives, smartphones and USB sticks are sold online. Buyers regularly find patient data, account numbers, password lists and contract documents on them — even though the previous owners believed the data had been deleted. Emptying the recycle bin or performing a quick format is nowhere near enough.
The disclosure of sensitive information is one of the most consequential threats to information security. The BSI lists it as G 0.19.
What’s behind it?
Confidentiality is one of the three foundational values of information security — alongside integrity and availability. Confidential information may only be accessible to those authorised to know it. G 0.19 describes the threat that this boundary is breached — through technical failure, human inattention or deliberate action.
Access points
Confidential information can be captured at many points:
-
Storage media — hard drives, SSDs, USB sticks, memory cards in computers and mobile devices.
-
Removable media — USB sticks and external hard drives that are passed on, lost or disposed of improperly.
-
Paper — printouts, files, notes, whiteboards in meeting rooms.
-
Transmission paths — unencrypted network connections, emails, cloud uploads.
-
Screens — reading along in public spaces, meeting rooms with glass walls, open-plan offices.
-
Inadvertent disclosure — storage media are given for repair without deleting the data first. Old devices are sold or disposed of without secure erasure.
-
Misconfiguration — cloud storage is accidentally publicly accessible. Databases hang on the internet without authentication.
-
Malware — infostealers forward credentials and documents to attackers.
-
Social engineering — employees disclose confidential information in response to skilful requests.
-
Inadequate deletion — “deleted” files can be recovered with standard tools as long as the storage space has not been overwritten.
Impact
The consequences of disclosing confidential information can be severe: violations of data protection laws (GDPR, banking secrecy), fines, claims for damages, reputational damage and the loss of trade secrets. A loss of confidentiality is often only discovered with considerable delay — sometimes only through external tips or press enquiries.
Practical examples
Used hard drives with patient data. A hospital replaces server hard drives and hands the old ones to an IT service provider for disposal. The service provider resells the drives instead of destroying them. Buyers find patient records, diagnoses and billing data on them. The incident only becomes public when a buyer contacts the media.
Publicly accessible cloud database. A development team sets up an Elasticsearch instance for test data and forgets to enable authentication. The instance is reachable over the internet. Months later, a security researcher discovers the database with several million customer records — and reports the finding to the company.
Confidential documents at the printer. In an open-plan office, the central network printer is in the corridor, accessible to all employees and visitors. Confidential HR documents printed by a department head sit unattended in the output tray until a visitor happens to discover them.
Relevant controls
The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 71 mapped controls below in the section “ISO 27001 Controls Covering This Threat”.)
Prevention:
- A.5.13 — Labelling of information: Visible classification reminds of the protection need at every handling step.
- A.8.12 — Data leakage prevention: Technical DLP measures detect and stop the uncontrolled outflow of data.
- A.8.10 — Information deletion: Secure deletion procedures for storage media and files.
- A.8.3 — Information access restriction: The need-to-know principle limits the circle of people with access.
- A.6.3 — Information security awareness, education and training: Sensitisation to the handling of confidential information in daily work.
Detection:
- A.8.15 — Logging: Access logs make unusual data access visible.
- A.8.16 — Monitoring activities: Monitoring detects anomalies such as mass downloads or unusual export actions.
Response:
- A.5.24 — Information security incident management planning and preparation: Prepared response plans for data breaches, including the GDPR notification process.
- A.5.26 — Response to information security incidents: Structured containment and processing after a disclosure.
- A.5.34 — Privacy and protection of PII: Specific protection measures for personal data in accordance with GDPR.
BSI IT-Grundschutz
The BSI IT-Grundschutz catalogue links G 0.19 to numerous modules, including:
- CON.1 (Crypto concept) — encryption as a core measure against disclosure.
- CON.6 (Deletion and destruction) — requirements for the secure disposal of storage media and documents.
- CON.9 (Information exchange) — rules for the controlled exchange of confidential information.
- DER.2.1 (Handling security incidents) — processes for dealing with data breaches.
Sources
- BSI IT-Grundschutz: Elementary Threats, G 0.19 — original description of the elementary threat
- ISO/IEC 27002:2022 Section 8.10 — implementation guidance on information deletion
- BSI: Recommendations for Secure Deletion — practical guidance on secure data deletion