Exercise 3: Why Curiosity-Driven Access Is Still a Genuine Violation — Possible Solution ==================================================================== WHAT MAKES THIS FEEL LIKE A HARMLESS EXCEPTION ------------------------------ There's no malicious intent, no plan to act on what's seen, and often no lasting consequence that the person looking is aware of - it can feel like "just checking," closer to idle curiosity than to an actual security incident. That feeling is exactly why this chapter calls it out specifically, rather than assuming it's obviously covered by common sense. WHAT DEFINES A CONFIDENTIALITY VIOLATION, ACCORDING TO THIS CHAPTER ------------------------------ Per the chapter's own "least exposure" principle, the standard for whether access is appropriate is whether the ticket or task actually needs it - not whether the person looking has good intentions. Curiosity-driven access, by definition, has no ticket or task behind it at all - there's no legitimate work reason motivating the look in the first place, which means it fails the least-exposure test regardless of what happens afterward. WHY INTENT DOESN'T CHANGE WHETHER THE ACCESS WAS APPROPRIATE ------------------------------ The harm in a confidentiality violation isn't only "what does the person do with what they saw" - it's the exposure itself. A colleague's ticket history, a public figure's account details, or an ex-partner's records being viewed without a legitimate work reason is already the violation, independent of whatever happens next. Good intentions affect what happens after the access, not whether the access itself was appropriate. WHY THIS CHAPTER SAYS IT'S SURPRISINGLY COMMON IN REAL INCIDENTS ------------------------------ Per this chapter, "many real confidentiality breaches involve no external attacker at all, just someone with legitimate access who looked at something they had no work reason to look at." This is worth stating explicitly because it runs against the instinct to think of confidentiality breaches as something attackers from outside cause - in practice, a large share come from people who already have legitimate access, misusing it in exactly this low-drama, no-intent way. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains why the absence of malicious intent makes this feel exempt, applies the chapter's own least-exposure standard to show why it isn't, and explains why the chapter specifically flags this as a common real-world pattern rather than a hypothetical edge case.