Making Privacy Operational International Security Trust and Privacy
- Slides: 22
Making Privacy Operational International Security, Trust and Privacy Alliance (ISTPA) Michael Willett, Seagate John Sabo, CA, Inc. The Privacy Symposium Harvard University 20 August 2008 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
What is the ISTPA? n The International Security, Trust and Privacy Alliance (ISTPA), founded in 1999, is a global alliance of companies, institutions and technology providers working together to clarify and resolve existing and evolving issues related to security, trust, and privacy n ISTPA’s focus is on the protection of personal information (PI) 2 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved ISTPA
ISTPA’s Perspective on Privacy n Operational – Technical, Operational Focus u …“making Privacy Operational” u based on legal, policy and business process drivers u privacy management is multi-dimensional with extended lifecycle requirements n Privacy Framework v 1. 1 published in 2002 u supports the full “Lifecycle” of Personal Information n “Analysis of Privacy Principles: An Operational Study” published in 2007 n See www. istpa. org for downloads 3 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved ISTPA
Three Dimensions of Privacy Management n Principles/Legislation/Policies u n Business Processes u n Requirements and constraints on the collection and use of personal information by government and private sector organizations Data collection, processing and storage systems and business applications which make use of PI Operational Privacy Management and Compliance u Architectures and applications which incorporate standardized privacy management services and controls 4 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
Principles/Legislation/Policies “Analysis of Privacy Principles: An Operational Study” Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
Laws, Directives, Codes Analyzed The Privacy Act of 1974 (U. S. ) OECD Privacy Guidelines UN Guidelines EU Data Protection Directive Canadian Standards Association Model Code Health Insurance Portability and Accountability Act (HIPAA) US FTC Fair Information Practice Principles US-EU Safe Harbor Privacy Principles Australian Privacy Act Japan Personal Information Protection Act APEC Privacy Framework California Security Breach Bill 6 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
Analysis Methodology n Select representative international privacy laws and directives n Analyze disparate language, definitions and expressed requirements n Parse expressed requirements into working set of privacy categories and terms n Cross-map common and unique requirements n Establish basis for a revised operational privacy framework to ensure ISTPA Framework Services supports full suite of requirements 7 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
Comparative Analysis-Sample n OECD Guidelines – 1980 u u u u n Collection Limitation Data Quality Purpose Specification Use Limitation Security Safeguards Openness Individual Participation Accountability Australian Privacy Principles – 2001 u Collection u Use and Disclosure u Data Quality u Data Security u Openness u Access and Correction u Identifiers u Anonymity u Transborder Data Flows u Sensitive Information 8 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
Derived Privacy Requirements n n n n Accountability Notice Consent Collection Limitation Use Limitation Disclosure Access & Correction Security/Safeguards n n n n Data Quality Enforcement Openness Less common: Anonymity Data Flow Sensitivity 9 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
What we Discovered Example: Notice Principle n Notice: Information regarding an entity’s privacy policies and practices includes 1. definition of the personal information collected 2. its use (purpose specification) 3. its disclosure to parties within or external to the entity 4. practices associated with the maintenance and protection of the information 5. options available to the data subject regarding the collector’s privacy practices 6. changes made to policies or practices 7. information provided to data subject at designated times and under designated circumstances 10 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
PI Lifecycle Implications of “Notice” Notice: Information regarding an entity’s privacy policies and practices information provided to data subject at designated times and under designated circumstances definition of the personal information collected its use (purpose specification) its disclosure to parties within or external to the entity changes made to policies or practices options available to the data subject regarding the collector’s privacy practices 11 with the maintenance and protection of the information practices associated Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
Operational Privacy Management Revising the Framework Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
PI Life Cycle Perspective Subject PI Operational Privacy Management at each touch point Requestor PI PI Collector 13 Processor Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
Designing a Privacy Management System Step by Step …. Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
INTERACTION VALIDATION NEGOTIATION ACCESS CERTIFICATION CONTROL USAGE Audit ENFORCEMENT Personal Information AGENT SECURITY PI Touch Point Architecture 15 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
INTERACTION VALIDATION NEGOTIATION ACCESS CERTIFICATION CONTROL USAGE Audit ENFORCEMENT Personal Information AGENT PRIVACY AGENT SELFSECURITY ENCRYPTING PI Touch Point Architecture 16 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
ISTPA Privacy Framework Services n n n n n Control – policy – data management Certification – credentials, trusted processes Interaction - manages data/preferences/notice Negotiation – of agreements, rules, permissions Agent – software that carries out processes Usage – data use, aggregation, anonymization Audit – independent, verifiable accountability Validation - checks accuracy of PI Enforcement – including redress for violations Access - subject review/suggest updates to PI 17 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
Making Privacy Operational PI Touch Point Interaction Negotiation Control PI, Preferences & PIC Repository Access Usage PI Container (PIC) Agent Assurance Services Validation Certification - Each Touch Point node configured with operational stack - Privacy Policy is an input “parameter” to Control - Agent is the Touch Point programming persona -PIC contains PI and usage agreements Audit Enforcement Security Foundation Legal, Regulatory, 18 and Policy Context Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
Privacy SERVICES Any two touch points in the PI life cycle Interaction Negotiation Control PI, Preferences & PIC Repository Interaction Access Usage PI Container (PIC) Negotiation Control Usage PIC Repository Agent Assurance Services Validation Certification Audit Enforcement Security Foundation Legal, Regulatory, 19 and Policy Context Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
Converting Privacy Requirements to Privacy Management Operations n “Matrix” Conversion (ISTPA Tool. Kit Process): Privacy 10 Framework Services Requirements (eg, Service Principles, FUNCTIONS Legislation) 20 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
Next Steps for the ISTPA Privacy Framework n n Undergoing revision now Using the Analysis findings, major revisions to Service definitions and lifecycle issues for integrating services ISTPA has joined the OASIS standards organization as an institutional member to explore standards development We welcome your input and support! 21 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
MAKING PRIVACY OPERATIONAL Questions? Michael Willett, Seagate michael. willett@seagate. com John Sabo, CA, Inc. john. t. sabo@ca. com 22 Copyright © 1999 -2008 International Security, Trust & Privacy Alliance -All Rights Reserved
Azure pci dss responsibility matrix
Privacy awareness and hipaa awareness training cvs
Privacy operational life cycle
Private security
Visa international security model in information security
Chapter 9 privacy security and ethics
Chapter 9 privacy security and ethics
Chapter 9 privacy security and ethics
Hipaa privacy and security awareness training
Computer security safety ethics and privacy
Operational decision making tools
Northern trust charitable trust
Nsdd 298
War making and state making as organized crime
What is inference
Wireless security in cryptography
E commerce security policy
What is the osi security architecture
Security guide to network security fundamentals
Electronic mail security in network security
Nstissc security model in information security
Software security building security in
Security guide to network security fundamentals
