CIPT BOK

CIPT BOK

1. Need for Privacy

   • Compliance reqs
   • IT risks
     • Client side Server side Application, Network, Storage, Personnel & Security Policy
   • Stakeholders expectations
     • Consumers, Regulators, Industry groups, researchers, employees
   • Mistakes orgn make
     • Insufficirent policies, Improper training, Disjointed practices, complacency, Third party contracts
   • Privacy vs security
     • To ensure privacy, in is important to employ security mechanisms (guards, locks, cameras, access controls and encryption). Privacy governs how PII should be used, shared and retained, security restricts access to the sensitive data and protects it from being viewed during collection, storage and transmission.
   • IT governance v. data governance
     • IT governance focuses on the systems, applications and support personnel that manage data within a company. Mostly managed by the IT department. Data governmance focuses on the proper management of data within a company.
   • Role of IT professional
     • Laying down the technical foundation for an effective privacy program, ensure the computers, networks, applications, websites and databases and security are maintained at levels that protect data privacy according to company policy.

2. Privacy in systems and applications

   • common challenges
     • Architecture considerations, IT involvement through mergers and acquisitions, Industry and function specific systems
   • Id and acces mgt
     • Limitations of access management as a privacy tool, Principle of least-privilege required, Role-based access control (RBAC), User-based access controls, Context of authority, Cross-enterprise authentication and authorization models
   • Credit card info and processing
     • Cardholder data types, Application of Payment Card Industry Data Security Standard (PCI DSS), Implementation of Payment Application Data Security Standard (PCI PA DSS)
   • RAS, telecomnuting and BYOD
     • Privacy considerations, Security considerations, Access to computers, Device controls, Network controls, Architecture controls
   • Data encryption
     • Crypto design and implementation considerations, Application or field encryption, File encryption, Disk encryption, Encryption regulation, Encryption standards
   • Other privacy enhancing technologies
     • . Automated data retrieval b. Automated system audits c. Data masking and data obfuscation d. Data loss prevention (DLP) implementation and maintenance
   • Considerations for customer-facing applications
     • Software-based notice and consent b. Agreements (End-user license agreement (EULA), Terms of service iii. Terms of use for nonlicensed products), Mechanisms

3. Privacy considerations in information lifecycle

   • Collection: Notice, Choice/consent, Collection limitations, Secure transfer, Reliable sources, Collection from 3rd parties
   • Use: Compliance to regs, Data minimization, Secondary uses, User auth, access control, audit trails, Secure when in use and not in use, Using PII in testing, Limitations when sources are unclear
   • Disclosure: According to notice, Anonymize, minimize, Define limitations d. Vendor management programs, Inventory and secure transfers, secure remote access, review data protection capabilities prior to engaging, Using intermediaries for the processing of sensitive information
   • Retention: Working with records management, Regulatory limitations, legal restrictions, limit retention of sensitive data if not necessary, Provide data subject access (Legal requirements, Business rationale), Access mechanisms, Handling requests, Secure transfer to archiving, secure storage of information and meta data, Considerations for business continuity and disaster recovery, Portable media challenges
   • Destruction: Digital content, portable media, hard copy, Identify appropriate time, Secure transfer and disposal of information and media, return information from third parties, Regulatory requirements defining destruction standards

4. Core privacy concepts

   • Foundational elements
     • Privacy notices, Privacy policies, Data classifications, Incident response, SDLC process, cross-border transferes, PIAs, Privacy and security regulations, Common standards and frameworks
       • Life cycle: Collection, Use, Disclosure, Retention, Destruction
       • Privacy principles: collection limitation, data quality, Purpose specification, Use limitation, Security safeguards, Openness, Individual partitipation, Accountability
         • What? How used? How shared? user control? marketing contact? cookies and other tracking mechanisms? Gaining access to data? Privacy issues? Date of notice? Changes to notice?
         • Consolidation/Multilayered notices, Privacy icons/nutrition label Combination privacy statement, Blended mobile statements
       • Types of data classification, collection principles, Protection of data, Retention period, Treatment of sensitive data, Sharing across groups, sharing with partnemrs and vendors, departmental privacy policies, Performance of privacy reviewsPrivacy response center, responding to privacy inquiries, responding to data requests.
   • Common privacy principles
     • Collection limitation, Data quality, Use limitation, Security safeguards, Openness, Accountability
       • Notice, choice/consent, collection limitations, secure transfer, collection from third parties
       • Compliance with regulation, data minimization, secondary uses, user authentication, using PII in testing
       • According to notice, anonymize, minimize, define limitations, vendor management programs
       • Working with records management, regulatory limitations, providing data subject access, secure storage and archiving
     • Digital, portable media, hard copy, identifying appropriate time

5. Privacy techniques

   • Authentication techniques and degrees of strength
     • User name and password, Single/multi factor authentication, Biometrics, Portable media supporting authentication
   • Identifiability
     • Labels that point to individuals, Strong and weak identifiers, Pseudonymous and anonymous data, Degrees of Identifiability, Definition under the EU Directive, U.S. regulations, Other regulations addressing identity in data, Privacy stages and system characteristics, Identifiable versus identifie, Linkable versus linked, Data aggregation
   • Privacy by design principles
     • Commit to a PbD program Create a privacy standard Perform privacy reviews Perform a data flow analysis Transparency Control Access Retention Security
   • Privacy by redesign principles
     • As Organisation´s privacy policies change: regulations, laws and self-regulatory regimes can be updated, technology can evolve and threats to data can intensify. Security protections may need to be updated.

6. Online privacy issues

   • Specific reqs
     • Organizational privacy strategy, Regulatory requirements specific to the online environment, Consumer expectations Children’s online privacy
   • Social media and higher level of privacy challenges
     • Personal information shared, Personal information collected, No clear owner of content published or data collected
   • Online threats
     • Phishing, whaling, etc., SQL injection, Cross-site scripting (XSS), Spam and common tactics for dealing with spam
   • E-commerce personalization
     • End user benefits, End user privacy concerns
   • Online advertising
     • Understanding the common models of online advertising, Key considerations when working with third parties to post ads on your company’s website
       • Behavioural advertising: 1st party, 3rd party
       • Remnant, Premium, Contextful, Demographic, Psychograthic, behavioural
         • Behavious: Search, display, publisher ads
       • NAI - Network Advertising Initiative
   • Cookies, beacons and other tracking techs.
     • Common types, Privacy considerations, Responsible practices
   • Machine-readable priv policy languages
     • Platform for Privacy Preferences Project (P3P), Application Preference Exchange Language (APPEL), Enterprise Privacy Authorization Language (EPAL), Security Assertion Markup Language (SAML), eXtensible Access Control Markup Language (XACML)
   • Web browser privacy and security feats.
     • Private browsing, Tracking protection, Do not track
       • DNT is HTTP header sent with web content requests.
         • GET/POST requests
       • TOR anonymising network
   • Web security protocols
     • Secure sockets layer / transport security layer (SSL / TLS), Hypertext transfer protocol secure (HTTPS), Limiting or preventing automated data capture, Combating threats and exploits, Anonymity tools

7. Technologies with privacy considerations

   • Cloud
     • a. Types of cloud b. Common privacy concerns c. Common security concerns d. Associations and standards
   • Wireless
     • RFID, Bluetooth devices, Wi-Fi, Cellular telephones and tablet computers
   • LBS
     • Evolution of location based services on mobile phones and personal digital assistants (PDAs), Global positioning systems (GPS), Geographic information systems (GIS)
   • Smart
   • video/data/audio surveillance
   • Biometric recognition