Privacy in Technology

Privacy in Technology

1. Frameworks

   • COBIT 5 (risk assessment of IT systems)
   • NCASE rules by Federal Trade Commission´s FIPPS
     • Principles: 1. Notice 2. Choice 3. Access 4. Security 5. Enforcement

2. IT risks

   • Client side
     • Computers used by employees
   • Server side
     • Reduce surface area of attack by limiting the apps on a server
     • Use a bastion server, eg. email server or proxy.
     • Clasify all data based on its category, origin, sensitivity and purpose
   • Personnel and security policy
     • PIA to find gaps in coverage and determine security requirements
       • Security measures: SW protection, Encryption, Access controls, Physical protection, social engineering prevention, auditing.
       • Madrid resolution states imporance of PiA.
       • At least yearly.
       • NZ, australia, HongKong, Canada, UK, USA
     • Policies: 1. Corporate 2. Regulatory 3. Industry
       • Regulations: FTC, Office and Privacy Commissioner of Ontario and UK information Commissioner´s Office.
       • Industry: Better Business Bureau, Interactive Advertising Bureau, TRUSTe and Entertainment Software Rating Board.
   • Application
     • Employee training, privieged access, software policy, privacy links, application research
     • IT involvement
       • IT controlled, IT monitored, Employeed controlled
   • Network
     • Keep computers clear of malware, Validate apps, Validate network devices, strong authentication practices, smartphone policies, write secure code, network encoding, network monitoring,
   • Storage
     • Files, Database, Cloud, Applications, websites, backup tape, hardware

3. Mistakes

   • Insufficient policies, improper traiining, disjointed practices, complacency, third party contracts

4. Security expectation

   • Consumers
   • Regulators
     • US: Federal Trade Commission, Federal Communication commission and Federal Reserve Board
       • US: COPPA, Fair Credit Reporting Act, Right to Financial Privacy Act
     • EU: European Data Protection Supervisor, European Free Trade Association (EFTA), EFTA Surveillance Authority.
       • Data Protection Directive
     • Canada: Privacy Commission per province
   • Industry groups
     • Better Business Bureau, Interactive Advertising Bureau and TRUSTe.
       • Remnant (cheapest ad), premium (most expensive type), contextual (most common type), demographic, psychografic, behavioural.
         • Types: Search ads, display ads, publisher ads, third-party ads.
         • Behavioural: 1st (eg.Amazon suggestions) or 3rd party advertising
           • More effective over short sessions.
           • Web-based profiling ((browser based technology) vs. Network-based profiling (browser based technology AND ISPs!!!!!)
   • Researchers
   • Employees

5. Privacy notice

   • What? How used? How shared? user control? marketing contact? cookies and other tracking mechanisms? Gaining access to data? Privacy issues? Date of notice? Changes to notice?
   • Consolidation/Multilayered notices, Privacy icons/nutrition label Combination privacy statement, Blended mobile statements

6. Privacy policy

   • Types of data classification, collection principles, Protection of data, Retention period, Treatment of sensitive data, Sharing across groups, sharing with partnemrs and vendors, departmental privacy policies, Performance of privacy reviewsPrivacy response center, responding to privacy inquiries, responding to data requests.

7. Common regulations

   • Collection, use, disclosure, retention
   • Collection limitation, data quality, purpose, use limitation, safeguards, openness, individual participation, accountability
     • Canada - Pipeda
     • EU Data Protection Directive
     • Hong Kong Personal Data Ordinance
     • Mexico Law on the protection of personal data help by private parties
     • US COPPA

8. Architecture considerations

   • Technology standardisation, policy consolidation, data center distribution.

9. Cross-site authentication models

   • Open ID Federation, eg. Klout.com uses Twitter.com or facebook.com as authentication service.
   • Liberty Alliance, builds trust frameworks for verifying online identities.
   • Identity Metasystem Architecture, permits multiple logins with one identity. More privacy as no tracking.
   • Social Networks, Facebook, Google+, etc.

10. PCI DSS

    • 12 requirements: 1. Build and maintain secure network, 2 Protect cardholder data, 3. Maintain a vulnerability mgt program, 4. Implament strong access control measure, 5. Regularly monitor and test networks, 6. Maintain an information security policy.

11. Privacy Techniques

    • Authentication techniques
      • Passwords
        • single factor authentication / multifactor
      • Biometrics
      • Portable devices supporting auth
        • RSA SecurID, TAILS portable OS
    • Privacy by design
      • 1. Commit to PbD program 2. Create privacy standard 3. Perform privacy reviews 4. Perform data flow analysis 5. trasnparency 6. Control 7. Access 8. Retention 9. Security
      • Privacy by redesign
    • Identifiability
      • Labels, device identifiers, Pseudonyms and anonymous data, imprecise data, de-identification, re-identification,degrees of identifiability, Data aggregation.
        • Article 29 Working Party Opinion: " a natural person can be considered identified when whithin a group of persons, he is distinguished from all other members of the group. A natural person is not identified, but CAN BE.

12. Strategy for Social Media

    • Determine audience, message, assign owners, create content guidelines, corporate IDs, limit sharing,
      • Regulatory reqs
        • COPPA, e-privacy directive, CAIOPPA

13. Policy languages

    • P3P, APPEL, EPAL, SAML, XACML,
      • P3P: XML.
      • APPEL: complementary to P3P. Browsers..
      • EPAL: by IBM, based on Privacy Rights Markup Language made by Zero Knowlede systems.
      • SAML:Platform neutrality, loose coupling of directories, better online user experience, Reduced administrative costs, risk transference.
      • HACML:standard, generic, powerful, distributed.