A sheriff’s office exchanges Criminal Justice Information (CJI) with state systems and also runs a public website. How should channel security be matched to data sensitivity?
Select an answer to reveal the explanation.
Short Explanation
CJI is not a city blog post—you don’t wrap a evidence vault and a tourist brochure in the same thin wrapper. Give justice data stronger, policy-grade channels with approved crypto, mutual auth, and locked-down endpoints, and keep casual browsing separate. Same guest Wi-Fi rules, “TCP is TCP,” or turning TLS off for audits miss the sensitivity match.
Full Explanation
Secure communication design scales channel strength to data classification and regulatory duty. Criminal Justice Information (CJI) transfers typically require approved cryptographic protocols, stronger mutual authentication, controlled endpoints, and monitoring that exceed what a public municipal website or guest browsing path needs. Policy-aligned channel protections—approved encryption, mutual authentication, and locked-down endpoints—keep evidence and justice data paths distinct from casual informational browsing so sensitivity and control strength stay matched.
Using the same open Wi-Fi guest portal encryption profile for both CJI and the public website understates CJI confidentiality and integrity obligations and often violates CJIS-aligned expectations for protected channels. Treating CJI exchanges like anonymous web browsing merely because both use TCP/IP confuses transport commonality with assurance level. Disabling TLS on CJI links “to simplify packet capture during audits” weakens the protections audits exist to verify and creates an avoidable interception window.
Exam caveat: not all HTTPS-looking or TCP flows are equal—match crypto, authentication, and endpoint control to data sensitivity and legal overlays such as CJI. Operational check: segregate CJI transfer paths from public/guest profiles, verify approved encryption and mutual auth are mandatory, restrict which endpoints may initiate or receive CJI, and ensure audit methods do not require turning protections off.