Security And Privacy - Overview
Updated: 2020-12-29
Legal vs Compliance vs Security vs Privacy
- Legal: What can we do
- Compliance: What must we do
- Security: How can we do it
- Privacy: What should we do
Be careful about special types of data
- Accelerometer: detects acceleration by vibration, so it can be a kind of microphone to record user's voice.
- Timestamp: if it is down to milliseconds, it may be used as a join key to link to other datasets.
Wipeout vs Takeout
- Wipeout: all data related to the user will be removed. The right to be forgotten.
- Takeout: all data related to the user can be downloaded. Also serves the purpose of transparency: users know what we know about them.
Regulartions / Standards
- GDPR: General Data Protection Regulation (EU)
- HIPAA: Health Insurance Portability and Accountability Act. (US)
- PCI-DSS: Payment Card Industry Data Security Standard
- CCPA: California Consumer Privacy Act, similar to GDPR.
GDPR
Data subject: the individual that information describes
6 GDPR DSRs: data subject rights
- the right to be forgotten
- the right to access
- the right to portability
- the right to restriction of processing
- the right to rectify
- the right to object
Methods to prove lawfulness of processing
- contractural necessity: processing required to fulfill an agreement between a company and an individual
- consent
- legitimate interests
Controllers vs Processors
- Controllers: decide how personal data will be processed. must meet obligations set forth in the GDPR
- Processors: process data at the direction of another entity
Data governance
- moral?
- ethical?
- legal?
- fair?
Security
Authn, authz, audit
Resources
- IAPP (The International Association of Privacy Professionals) https://iapp.org/
- https://blackhat.com/