Managing Privacy

1. ManagingPrivacy Managing Risk? Víctor Chapelavictor@sm4rt.com

2. Privacy Origin Human Rights The right to a dignified life Legal order independence Universal Declaration of Rights (1942) Right to intimacy Information self-determination / Privacy

3. What do we understand by Privacy? Having control over my personal information The ability to limit: Who keeps it What can be done with it Purposes of use

4. Privacy in the World

5. Privacy Regulatory Overview EU USA EU“light” Hábeas Data Four Main Groups

6. Universally Accepted Privacy DirectivesMadrid Conference: Privacy and Data Protection Authorities of the 5 continents

7. Principles Lawfulness and fairness Purpose specification Openness (Information) Proportionality Data quality Accountability

8. Legitimacy of Processing Consent Sensitive Data Provision of processing services International transfers

9. Rights Access Rectify Delete Opposition

10. Monitoring and Liability

11. Proactive Measures

12. Chief Privacy Officer What is a Chief Privacy Officer? Which is his place in the organization? Solid knowledge and ample experience Certified Data Privacy Professional

13. Risk Management 13

14. Risk Management Audit Independence Qualified expert

15. Privacy Impact Analysis

16. Mexico’s Privacy Law ü ü ü ü ü

17. Link between Privacy and Security

18. Perceived Risk is Reduced

19. Why isPrivacy agrowing concern?

20. How can we understand Digital Risk?

21. 3 Types ofDigital Risk Accidental Opportunistic Intentional 3. Intentional

22. Intentional Digital Risk = Threat x Vulnerability

23. Threat hasincreasedgeometrically!

24. Vulnerabilities areincreasing exponentially!!

25. Digital Risk = Threat x Vulnerability Threat

26. We all feel anonymous!This is true for criminals as well…

27. Without risk we all become lawbreakers!

28. By reducing the risk of breaking the law, everyone’s risk has grown

29. Profitability = Return / Risk

30. We are arriving at a new balance Profit Risk

31. Much more illegal money to be made!

32. Threathasincreasedgeometrically

33. Digital Risk = Threat x Vulnerability Vulnerability

34. Wehavelost Control

35. Computers used to be deterministic

36. Our digitalWorld hasbecome Undeterministic

37. Computers have become so complex they are not predictable any more

38. We rebootas a way to return to a known state

39. In chaotic systems we can only predict the first fewiterations

40. Networks increase complexity

43. 36 Nodes 630 Connections 2,783,137,628,160 Sockets

44. Moredevices = even moreconnections

45. Connections Grow Exponentially

46. Network connection growth creates Value

47. Butitalso increases Complexity

48. Complexity andUnpredictability increaseFrustration

49. Risk As well as

50. How doesDigital Risk affectPrivacy?

51. Reduced Privacy risk perception

52. TheNature of Privacy Risk isnot new

53. Privacy Risk hasincreased because of4 aspects

54. 1. Speed

55. It use to take days or weeks for information to be shared

56. Now it is instantaneous!

57. 2. Dispersion

58. The same people that would keep our secrets…

59. … are now becoming digital information broadcasters

60. Every single tweet is received in average by over 487 people The most retweeted message was received by more than 24 million accounts

61. 3. Persistence

62. We used to easily control, restrict access and destroy physical copies of our personal data

63. Source: http://www.civic.moveon.org/facebook/chart/

64. 4. Clustering

65. Our files used to be difficult toaccess

66. Now it is all clusteredandavailable worldwide

67. Therefore, if you were caught at an inconvenient state…

68. …your girlfriend would have immediate access…

69. … as well as all her friends…

70. …probably, forever!

71. So yes, privacy is a growing concern And not only at a reputational level

72. Privacy is always a risk for INDIVIDUALS An organization’s risk always translates to individual stakeholder risks Employees get fired Users or customers are damaged Shareholders lose money

73. Two types of Privacy Intimacy Identity

74. Intimacy Ethnic origin or race Health Religious, philosophical and moral beliefs Syndicate affiliation Political views Sexual preference

75. Identity Name and address e-Mail Location Biometrical readings Payment card number User and password Behavioral information

76. Two types of Privacy Intimacy Perception <- Trust Regulation Compliance Identity Perception <- Trust Information Value

77. The most valuable piece of our personal information is our Identity

78. Most valuable, for others!

79. 2009 Data Breach Investigations Report Verizon Business RISK Team

80. 98% Payment Card Data

81. 1.5% Other Personal Information

82. Information posted for Sale Rank % Information 23% CVV2 Numbers 18% Credit Card Numbers 15% Credit card expiration dates 12% Addresses 11% Phone numbers 6% Email addresses 5% PIN for credit or debit cards 4% Social Security numbers 4% Full names 2% Dates of birth http://www.symantec.com/business/theme.jsp?themeid=threatreport

84. How was this data stolen?

85. 2/3 Hacking

86. 1/3 Malware

87. Malware

88. Hacking

89. 79% SQL Injection

93. Credit or Debit Cards

94. and OnlineBanking

95. Personal Information

96. Are both part of IdentityTheft

97. Over100billion per year in losses

98. 300% yearly growth rate

99. Two types of Privacy Intimacy Privacy Regulation Risk Management Identity Value Based Risk Management

100. They are divided into two groups: Redundancy Availability? Business Impact BIA Filters andAuthentication Confidentiality and Integrity? Market Value IVA

101. Information Value Analysis Information Risk= Impact x Probability Impact is determined by estimatingEconomic Value Probabilityismeasured by calculating Potential Connections

102. How tocalculateinformation value?

103. Intentionality Information Assets Information User Profiles Potential Losses Possible Attacks High Risk Nodes EconomicValue Access to High Risk Nodes Attacker Profit Known Attacks

104. We need to accept Risk Potential moves are infinite

105. Highly Dynamic Environment

106. Theboard changes daily

107. ThePieceschange daily

108. Therules change daily

109. Players change daily

110. TheEnd justifies theMeans In preventing Intentional Risk nothing less than securing allvectors is enough

111. Defense must be Optimized

112. Optimize Speed

113. Optimize Resources

114. Value Management Method Possible Incidents Real Incidents Applicable Incidents Recurring Incidents Measurement of Added Value Prioritized Incidents

115. This is how we estimate threatandImpact

116. How are probability andVulnerabilitycalculated?

117. Assets& Account Profiles

118. Assets & Account Profiles

119. COBIT Risks EfectividadEficienciaConfidencialidadIntegridadDisponibilidadCumplimientoConfiabilidad Business Requirements AplicacionesInfraestructuraInformaciónPersonas DOMINIOS PROCESOSACTIVIDADES IT Resources IT Processes Nodes Connections

120. Types ofNodes Information User Connection Information Node User Node Transfer Process Store Consult

121. NodeGrouping User Profiles

122. Graph Segmentation

123. Connection Measurement

124. Redundancy Availability? Business Impact Assets Filters andAuthentication Confidentiality and Integrity? Market Value Assets Accounts

125. Monitoring is also Required Availability? Business Impact Monitoring & Response Assets Confidentiality and Integrity? Market Value AssetsAccounts

126. Identity is the key to better risk management

127. Default Close Default Open Availability Confidentiality

128. Focus controls on main risks

129. Determinewhich nodes tomonitor

130. Redundancy Activos Monitoring Filtering &Authenticacion Risk Operation Center

131. RiskAnalysis

132. Always R1 Weak password storage protocol R5 R2 R2 Absence of robust password policy R3 Absence of data entry validation for web applications R3 R4 Possible Probability R1 R6 R4 Existing applications with vulnerable remote support R5 Weak wireless ciphered communication protocol R6 Absence of operating system security configuration Almost never Very high Insignificant Medium Impact Main Risks

133. Quick Hits High S1 S2 Password Policy S5 S4 S2 Migration of wireless communication protocol Strategic Quick Hits S6 S3 S1 Strategic S7 S3 Security configuration guidelines for applications Moderate Positive Impact of Implementation S4 Security configuration guidelines for operating systems Not Viable Nice To Have S5 Migration of passwords storage protocols S6 Secure application development process Minimum S7 Migration of remote support protocol Minor Medium Major Effort Action Plan

134. Procesos Gente Tecnología Policies and Configuration Guidelines S3 Security configuration guidelines for applications S4 Security configuration guidelines for operating systems Governance S1 Password policy Processes and Roles S1 Superior Technologies User controls S7 S8 S0 S9 Migration of remote support protocols Network controls S5 Migration of password storage protocols S2 Migration of wireless communication protocols S2 Host controls S4 S5 Recommendations for Sustainability Application controls S3 4 S7 S8 Secure change process administration Data level controls S9 Risk administration process S0 Vulnerability patches and updates process S6 Secure application development process Recommendations

135. Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Risk Administration Implementation Secure application development implementation Vulnerability patches and updates process administration Secure change process administration Migration to robust remote support protocols Migration of wireless communication protocol Migration of password storage Password policy Security configuration guidelines for operating system Security configuration guidelines for applications 2010 2011 Mitigation Roadmap

136. Demystifying the Privacy Implementation Process Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

137. Business Process Analysis Business Process Analysis Data Lifecycle Inventory Identification of applicable Law Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

138. Business Process Analysis Stakeholder Information acquisition Types of data Internal and external data flows Purpose of treatment Information systems and security measures Retention policies Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

139. Data Lifecycle Inventory Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

140. Privacy Legal & Regulatory Requirements (PIA) 1. Legal & Regulatory Contracts Clauses Privacy notices Authorizations Jurisdictions Other regulations Money laundering Sectorial Etc. Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

141. Privacy Legal & Regulatory Requirements (PIA) 2. Technical Authentication & authorization Access control Incident log Removable media and document management Security copies Recovery tests Physical Access Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

142. Privacy Legal & Regulatory Requirements (PIA) 3. Organizational Data privacy officer Roles and responsibilities Policies, procedures and standards Notifications to authorities Audits Compliance and evidence Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

143. Legal & Regulatory Data Categories High Risk Syndicate Affiliation Health Sexual life Beliefs Racial Origin Medium Risk Financial Profile Personal Fines Credit Scoring Tax Payment Information Basic Risk Personal Identifying Information Employment Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

144. External Economic Data Value (IVA) Black Market Value Sale price News Value Newspaper Magazines Television Competition Market Value Brand Value Political Value Authorities Fines Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

145. Data Value Categories Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

146. Asset Inventory Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

147. Policy Generation How should this data be: generated? stored? transferred? processed? accessed? backed-up? destroyed? monitored? How should we react and escalate an incident or breach? How will we punish compliance? Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

148. Controls, Standards & Procedures Business Process Analysis Data Lifecycle Inventory Controls are defined and mapped for each policy level Technical Standards Procedures Compensatory Controls Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

149. Controls, Standards & Procedures Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

150. Implementation & Audit Business Process Analysis Data Lifecycle Inventory BestPractices Laws and Regulations Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory PROCESSES Policy Generation APPLICATIONS PEOPLE Controls Controls, Standards, Procedures Evidence Implementation & Audit I.ACT D.SEG LOPD SOX LSSI ASSETS NETWORKS COMUNIC. CONTRACT

151. Implementation & Audit Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

152. Two types of Privacy Intimacy Privacy Regulation Compliance Identity Information Value Risk Management

153. 3 Main Aspects of Privacy Legal Organizational Technical

154. Privacy is not only about Compliance! Through Privacy we guarantee individual rights. By doing so, we increase stakeholder trust and increase our competitiveness.

155. Privacy Risk Management: Stakeholders Trust Management “Trust is the belief that a person or group will be able or willing to act an adequate and predictable manner under certain situations.”

156. Thank you! Víctor Chapela victor@sm4rt.com