input: [Vulnerabilities] Sensitive information may be exposed because of failure to adequately restrict access, due to: hastily constructed applications ignorance of regulatory requirements [Countermeasures] Application designers must be educated and adhere to policies regarding the use of encryption and access controls for compliance with applicable privacy laws and regulations, such as: Health Insurance Portability and Accountability Act (HIPAA) Gramm-Leach-Bliley Act (GLBA) Cardholder Information Security Program (CISP) Data Protection Act (in the UK) [Element / Threat] 
output: Confidentiality hiding sensitive information from unauthorized viewers Threat: News of a breach of confidential information causes embarrassment and legal liability.