PRIVACY ENHANCING TECHNOLOGIES
|
|
|
- Darren Garrett
- 7 years ago
- Views:
Transcription
1 PRIVACY ENHANCING TECHNOLOGIES A CONTRIBUTION TOWARDS A STRUCTURAL SOLUTION FOR INFORMATIONAL PRIVACY PROBLEMS Drs John J. Borking Associate Board Member Data Protection Authority The Netherlands ITA Wien on PET 1
2 Where are PETs in the debate? Legal framework Privacy Enabling & Privacy Enhancing Technologies 1.Anonymity 2.Pseudonymity 3.Privacy Knowledge Engineering (PYKE) 4. Control & feedback ITA Wien on PET 2
3 The Privacy Principles applicable to the processing of personal data Purpose specification Fair and lawful collection Proportionality Data quality Transparency Data subject s rights Storage duration Right to object Security ITA Wien on PET 3
4 Legal context for PETs Nine privacy principles and against unlawful processing ITA Wien on PET 4
5 ARTICLE 17 (95/46/EC) + RECITAL 46 OUTLINES: The person responsible shall take suitable technical and organizational measures to protect personal data both at the design & processing phase of the system: AGAINST LOSS AGAINST ANY FORM OF UNLAWFULL PROCESSING TO PREVENT UNNECESSARY COLLECTION AND FURTHER PROCESSING CONSIDERING STATE OF ART, COSTS, RISKS ITA Wien on PET 5
6 UNDERSTANDING: Incidental vs.. Structural = how to solve the privacy problem! The law alone can t protect privacy From reactive to proactive The Cholera metaphor ITA Wien on PET 6
7 VISUALIZATION OF THE AGENT AND PERSONAL DATA FLOW Agentprovider External sources Agent 1 Agent 2 Agent N Mr. Jones MIKE AN EXAMPLE MIKE s Agent databases containing personal data about Mr. Jones Network Agents ITA Wien on PET 7
8 PRIVACY THREATS SOLUTION VIOLATIONS OF PRIVACY REGULATIONS USE INTEGRATED LIST OF THREATS SYSTEM PURPOSE TECHNOLOGY ITA Wien on PET 8
9 PET POLICY Can the EC directive 95/46 be translated into hard specifications? ITA Wien on PET 9
10 Privacy-Enhancing Technologies PETs The Path to Anonymity,, Augustus 1995 The concept of the Identity Protector And Identity Domains + 6 design models ISBN: ITA Wien on PET 10
11 PRIVACY-ENHANCING TECHNOLOGIES USER KNOWN PID 1 PID 2 IDENTTY DOMAINS THE IDENTITY PROTECTOR PID 3 PSEUDO IDENTITY DOMAINS ITA Wien on PET 11
12 STRUCTURE OF AN INFORMATION SYSTEM service provider user user representation service provider representation services * privileges audit information system * = environment database interaction lines ITA Wien on PET 12 9 *
13 DEFINITI0N OF PETs PETs IS A SYSTEM OF ICT MEASURES PROTECTING THE INFORMATIONAL PRIVACY BY ELIMINATING OR MINIMIZING PERSONAL DATA OR BY PREVENTING UNNECESSARY OR UNWANTED PROCESSING OF PERSONAL DATA, WITHOUT LOSS OF FUNCTIONALITY ITA Wien on PET 13
14 WHAT S PETs DOING? IT INCREASES THE POSSIBILITIES TO PROTECT BETTER THE PRIVACY OF THE INDIVIDUAL IT INCREASES THE POSSIBILITIES FOR CITIZENS TO CONTROL AND HAVE A SAY OVER THEIR OWN PERSONAL DATA ITA Wien on PET 14
15 ERGO: Protection of Privacy starts with the design of Information Systems 0nline and Offline ITA Wien on PET 15
16 General trends on PET s Growing awareness (since 1995) Increasing availability online and offline Rising expectations Evaluation & guidance Marketing effort is needed! ITA Wien on PET 16
17 Analysis of Data Streams and the Deployment of PET Phase 1: Capture of Personal Data (Intake) -Built-in tools data minimization -Fending off Classes of Data for purpose binding Phase 2: Processing and Storage of Data -Identity Protector & workflow Mgt Phase 3: Distribution of Data - Access protocols, PKI/TTP, P3P ITA Wien on PET 17
18 Basic strategies for PET s Minimize: identifiable data Eliminate: identifiable data Optimize: lawful processing Combine: additional solutions Convince: responsible stakeholders ITA Wien on PET 18
19 A few of the realized PET projects ICL Health Care systems (1997) Anonymous customer tracking system LADIS (1998) NCR Teradata Warehouse- privacy enabling tools (1999) Biometrics with decentralized storage of templates (1999) Privacy Incorporated Software Agent (PISA) (under construction) Mobimiles (Electronic Road Pricing) ITA Wien on PET 19
20 PET EXAMPLES ITA Wien on PET 20
21 PRIVACY INCORPORATED DATABASE Prior Conditions Relational Database Client / Server Architecture ITA Wien on PET 21
22 HOSPITAL INFORMATION SYSTEM Basic Tables with relations patient seq_patient patient_number name + address care relation seq_care relation seq_patient seq_physician date_from datum_till physician seq_physician carer_number carer_name admission seq_admission seq_patient date_from date_till anamnesis seq_anamnesis seq_admission seq_physician details medication seq_medication seq_admision seq_physician details etc seq_etc seq_admission seq_physician details notes seq_notes seq_admission seq_physician text ITA Wien on PET 22
23 Hospital Information System Basic tables with Pseudo Identities patient seq_patient patient_number name, address care relation seq_care relation seq_patient pid_physician date_from date_till physician seq_physician carer_number carer_name admission seq_admission pid_patient date_from date_till anamnesis seq_anamnesis seq_admission pid_physician details medication seq_medication seq_admission pid_physician details etc seq_etc seq_admission pid_physician details notes seq_notes seq_admission pid_physician text ITA Wien on PET 23
24 Hospital Information System Lay out showing the domains patient seq_patient patient_number name, address identity domain 1 care relation seq_care relation seq_patient pid_physician date_from date_till physician seq_physician carer_number carer_name identity domain 2 pseudo identity domain admission seq_admission pid_patient date_from date_till anamnesis seq_anamnesis seq_admission pid_physician details medication seq_medication seq_admission pid_physician details etc seq_etc seq_admission pid_physician details notes seq_notes seq_admission pid_physician text ITA Wien on PET 24
25 Dialogue in PID Hospital Information System client server login with physician name (pn) transfer pn to the server check in table physician transfer sequence primary key of physician to the client encrypt to pid_physician transfer the pid_physician to the server search table care relation select sequence primary key of_patient and search table patient transfer identified patients to client select the required patient encrypt seq_patient to pid_patient transfer pid_client to server search table anamnesis with pid of physician and of patient etc ITA Wien on PET 25
26 The PET principles Pseudo - identity There are many more (to come) Zero Knowledge Systems Anonymous surfing the Internet Dutch Burns Information System Social Security Information System etc. etc ITA Wien on PET 26
27 Dutch Burns Information System Practically all seven PET Principles Biometrics to authenticate users fingerprint and voice templates stored on a smartcard Trusted Third Party to verify identity Firewalls to prevent intrusion by unwanted third parties Virtual Private Network Database encryption Balanced dataset ITA Wien on PET 27
28 The PET principles Control & Feedback Control is empowering people to find out what information is captured about them and who can get hold of it Feedback is informing people when and what information is being captured and to whom made available ITA Wien on PET 28
29 The PET principles Feedback and Control Create audit trails to log access to personal data (technical measure) to monitor the files and action upon unexpected entries (organisational measure) ITA Wien on PET 29
30 PYKE, the new branch of PET Building the nine privacy principles into information systems to realize privacy knowledge engineering (PYKE). The use of ontologies is needed The method : Design Embedded Privacy Risk Management (DEPRM) to assure a system design against privacy risks as discovered in the privacy threat analysis ITA Wien on PET 30
31 Definition: ONTOLOGIES Formal machine understandable description of terms and relations in a particular domain For privacy protection: Encapsulation of knowledge about the data protection domain in an unambiguous standardization To resolve the mismatch between law and technology ITA Wien on PET 31
32 PYKE & DEPREM 1. Determine the privacy principles 2. Chain selected articles of the DPD that belong to the chosen privacy principles. 3. Split the principles into a sets of tiny elements 4. Find the ontologies and taxonomies leading to a simplified conceptual model of the principle 5. Add knowledge base to enable interpretation of the queries between the agents 6. Formulate transfer rules 7. Implement required security ITA Wien on PET 32
33 PISA: PRIVACY INCORPORATED SOFTWARE AGENT: MAIN OBJECTIVES OF EU PROJECT TO PROVE AND SHOW THAT THE PRIVACY OF USER WHILE USING AGENTS IS PROTECTED IN ALL KINDS OF PROCESSES BY INCORPORATING PET FEATURES IN AGENTS ITA Wien on PET 33
34 Structure of Privacy Incorporated Software Agent (PISA) Pseudo nymity Shell Agent General functions Privacy- Enhancing Technologies Public non-personal data Built in legal knowledge Security related functions Privacy protection related functions General knowledge base Security related knowledge base Privacy related knowledge base Trust mechanisms Infrastructure specific sec. measures Communication aspects Mechanisms to enforce legal aspects Sensitive nonpersonal data Secured personal data from own user Secured personal data from others ITA Wien on PET 34
35 Standard Transfer Rule in PISA IF APS-1 MATCHES PISA privacy-preference-2 AND APS- 2 MATCHES privacypreference-1and PII level 2-1 MATCHES PII level 2-2 THEN ALLOW disclosure and or exchange PII level ITA Wien on PET 35
36 PET internationally accepted ITA Wien on PET 36
37 Common Criteria Technology Security Evaluation (ISO 15408) 9 Privacy - defined as: anonymity no identifiable data at all pseudonymity identifiable for authorised users only unlinkability no common identifier to link systems unobservability anonymous until required for identification ITA Wien on PET 37
38 Financial case for implementation of PET BASIC ASSUMPTION Data security is an integral part of the development of information systems Privacy protection is an integral part of the data security THEN ITA Wien on PET 38
39 Then: From scratch: design phase might increase. The actual development costs increases only by 1% of the Total Costs of Ownership If not and / or existing systems have to be enhanced: prohibitive expensive due to breaking up the existing structure of the information systems ITA Wien on PET 39
40 PET ONLINE ITA Wien on PET 40
41 Types of online software tools Anonymity and pseudonymity tools Anonymizing proxies Mix Networks and similar web anonymity tools Onion routing Crowds Freedom Anonymous Encryption tools File encryption encryption Encrypted network connections Filters Cookie cutters Child protection software Agents of choice Personal information managers P3P ITA Wien on PET 41
42 P3P v1.0 Offers an easy way for web sites to communicate about their privacy policies in a standard machinereadable format Can be deployed using existing web servers This will enable the development of tools (built into browsers or separate applications) that: Provide snapshots of sites policies Compare policies with user preferences Alert and advise the user ITA Wien on PET 42
43 PRIVACY ENHANCING TECHNOLOGIES Objectives: conventional information system Quantity of data 0 privacy information system quality of data ITA Wien on PET 43
44 PRIVACY Can be compared to our skin. It is a line of defence against intrusion from the outside world. If we tear down these defences, we become vulnerable. Privacy cannot be protected adequately unless legal requirements are translated into hard system specifications ITA Wien on PET 44
45 For ongoing activity: :// pet-pisa pisa.nl Thank you ITA Wien on PET 45
The Education Fellowship Finance Centralisation IT Security Strategy
The Education Fellowship Finance Centralisation IT Security Strategy Introduction This strategy outlines the security systems in place to optimise, manage and protect The Education Fellowship data and
CYBER SECURITY POLICY For Managers of Drinking Water Systems
CYBER SECURITY POLICY For Managers of Drinking Water Systems Excerpt from Cyber Security Assessment and Recommended Approach, Final Report STATE OF DELAWARE DRINKING WATER SYSTEMS February 206 Kash Srinivasan
I. Introduction to Privacy: Common Principles and Approaches
I. Introduction to Privacy: Common Principles and Approaches A. A Modern History of Privacy a. Descriptions and definitions b. Historical and social origins c. Information types i. Personal and non-personal
How To Manage Web Content Management System (Wcm)
WEB CONTENT MANAGEMENT SYSTEM February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training The McAfee Web Gateway Administration course from Education Services provides an in-depth introduction
Permeo Technologies WHITE PAPER. HIPAA Compliancy and Secure Remote Access: Challenges and Solutions
Permeo Technologies WHITE PAPER HIPAA Compliancy and Secure Remote Access: Challenges and Solutions 1 Introduction The Healthcare Insurance Portability and Accountability Act (HIPAA) of 1996 has had an
Glossary of Key Terms
and s Branch Glossary of Key Terms The terms and definitions listed in this glossary are used throughout the s Package to define key terms in the context of. Access Control Access The processes by which
SURVEILLANCE AND PRIVACY
info sheet 03.12 SURVEILLANCE AND PRIVACY Info Sheet 03.12 March 2012 This Information Sheet applies to Victorian state and local government organisations that are bound by the Information Privacy Act
Website Privacy Policy Statement. 1519 York Rd Lutherville, MD 21093. We may be reached via email at julie@juliereisler.com.
Website Privacy Policy Statement This website juliereisler.com is operated by Empowered Living, LLC and this policy applies to all websites owned, operated, controlled and otherwise made available by Company,
PortWise Access Management Suite
Create secure virtual access for your employees, partners and customers from any location and any device. With todays global and homogenous economy, the accuracy and responsiveness of an organization s
State of Oregon. State of Oregon 1
State of Oregon State of Oregon 1 Table of Contents 1. Introduction...1 2. Information Asset Management...2 3. Communication Operations...7 3.3 Workstation Management... 7 3.9 Log management... 11 4. Information
IAPP Privacy Certification
IAPP Privacy Certification Program Introduction to the Certification Foundation copyright 2011, IAPP Overview Each candidate who seeks an IAPP privacy certification for the very first time must complete
THE BLUENOSE SECURITY FRAMEWORK
THE BLUENOSE SECURITY FRAMEWORK Bluenose Analytics, Inc. All rights reserved TABLE OF CONTENTS Bluenose Analytics, Inc. Security Whitepaper ISO 27001/27002 / 1 The Four Pillars of Our Security Program
Data collection architecture for Big Data
Data collection architecture for Big Data a framework for a research agenda (Research in progress - ERP Sense Making of Big Data) Wout Hofman, May 2015, BDEI workshop 2 Big Data succes stories bias our
Johnson Controls Privacy Notice
Johnson Controls Privacy Notice Johnson Controls, Inc. and its affiliated companies (collectively Johnson Controls, we, us or our) care about your privacy and are committed to protecting your personal
Maruleng Local Municipality
Maruleng Local Municipality. 22 November 2011 1 Version Control Version Date Author(s) Details 1.1 23/03/2012 Masilo Modiba New Policy 2 Contents ICT Firewall Policy 1 Version Control.2 1. Introduction.....4
ICANWK406A Install, configure and test network security
ICANWK406A Install, configure and test network security Release: 1 ICANWK406A Install, configure and test network security Modification History Release Release 1 Comments This Unit first released with
Identity Provisions for Cloud Services: Applying OASIS SOA Reference Model
Identity Provisions for Cloud Services: Applying OASIS SOA Reference Model Presented by: Dr Michael Poulin Member & Co editor at SOA RM TC Member of AASCIT (American Association for Science and Technology)
Security from the Ground Up eblvd uses a hybrid-asp model designed expressly to ensure robust, secure operation.
eblvd enables secure, cloud-based access to a PC or server over the Internet. Data, keyboard, mouse and display updates are transmitted over a highly compressed, encrypted stream, yielding "as good as
Information Technology Policy
Information Technology Policy Security Information and Event Management Policy ITP Number Effective Date ITP-SEC021 October 10, 2006 Category Supersedes Recommended Policy Contact Scheduled Review RA-ITCentral@pa.gov
IT Architecture Review. ISACA Conference Fall 2003
IT Architecture Review ISACA Conference Fall 2003 Table of Contents Introduction Business Drivers Overview of Tiered Architecture IT Architecture Review Why review IT architecture How to conduct IT architecture
Existing Technologies and Data Governance
Existing Technologies and Data Governance Adriaan Veldhuisen Product Manager Privacy & Security Teradata, a Division of NCR 10 June, 2004 San Francisco, CA 6/10/04 1 My Assumptions for Data Governance
Evaluation of different Open Source Identity management Systems
Evaluation of different Open Source Identity management Systems Ghasan Bhatti, Syed Yasir Imtiaz Linkoping s universitetet, Sweden [ghabh683, syeim642]@student.liu.se 1. Abstract Identity management systems
IT Privacy Certification Outline of the Body of Knowledge (BOK) for the Certified Information Privacy Technologist (CIPT)
Page 1 of 6 IT Privacy Certification Outline of the Body of Knowledge (BOK) for the Certified Information Privacy Technologist (CIPT) I. Understanding the need for privacy in the IT environment A. Evolving
SPACK FIREWALL RESTRICTION WITH SECURITY IN CLOUD OVER THE VIRTUAL ENVIRONMENT
SPACK FIREWALL RESTRICTION WITH SECURITY IN CLOUD OVER THE VIRTUAL ENVIRONMENT V. Devi PG Scholar, Department of CSE, Indira Institute of Engineering & Technology, India. J. Chenni Kumaran Associate Professor,
How Microsoft is taking Privacy by Design to Work. Alan Chan National Technology Officer Microsoft Hong Kong 7 May 2015
How Microsoft is taking Privacy by Design to Work Alan Chan National Technology Officer Microsoft Hong Kong 7 May 2015 Agenda Introducing the New Microsoft Microsoft privacy principle Protecting privacy
Network Security. by David G. Messerschmitt. Secure and Insecure Authentication. Security Flaws in Public Servers. Firewalls and Packet Filtering
Network Security by David G. Messerschmitt Supplementary section for Understanding Networked Applications: A First Course, Morgan Kaufmann, 1999. Copyright notice: Permission is granted to copy and distribute
Cesario Di Sarno. Security Information and Event Management in Critical Infrastructures
Cesario Di Sarno Ph.D. Student in Information Engineering University of Naples «Parthenope» Security Information and Event Management in Critical Infrastructures Fai della Paganella 11 Febbraio 2014 Critical
20. Exercise: CERT participation in incident handling related to Article 4 obligations
CERT Exercises Handbook 241 241 20. Exercise: CERT participation in incident handling related to Article 4 obligations Main Objective Targeted Audience Total Duration This exercise provides students with
FTP-Stream Data Sheet
FTP-Stream Data Sheet Problem FTP-Stream solves four demanding business challenges: Global distribution of files any size. File transfer to / from China which is notoriously challenging. Document control
Information Security Basic Concepts
Information Security Basic Concepts 1 What is security in general Security is about protecting assets from damage or harm Focuses on all types of assets Example: your body, possessions, the environment,
UMHLABUYALINGANA MUNICIPALITY FIREWALL MANAGEMENT POLICY
UMHLABUYALINGANA MUNICIPALITY FIREWALL MANAGEMENT POLICY Firewall Management Policy Approval and Version Control Approval Process: Position or Meeting Number: Date: Originator: Recommended by Director
CMB 207 1I Citrix XenApp and XenDesktop Fast Track
CMB 207 1I Citrix XenApp and XenDesktop Fast Track This fast paced course provides the foundation necessary for students to effectively centralize and manage desktops and applications in the datacenter
Did you know your security solution can help with PCI compliance too?
Did you know your security solution can help with PCI compliance too? High-profile data losses have led to increasingly complex and evolving regulations. Any organization or retailer that accepts payment
Migrating to vcloud Automation Center 6.1
Migrating to vcloud Automation Center 6.1 vcloud Automation Center 6.1 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a
CLOUD FRAMEWORK & SECURITY OVERVIEW
CLOUD FRAMEWORK & OVERVIEW From small businesses to the largest Fortune 500 Enterprises, customers trust the irise cloud infrastructure when collaborating to define and design their applications. This
EUCIP - IT Administrator. Module 5 IT Security. Version 2.0
EUCIP - IT Administrator Module 5 IT Security Version 2.0 Module 5 Goals Module 5 Module 5, IT Security, requires the candidate to be familiar with the various ways of protecting data both in a single
I. System Activities that Impact End User Privacy
I. System Activities that Impact End User Privacy A. The Information Life Cycle a. Manual processes i. Interaction ii. Data entry b. Systems i. Operating and file ii. Database iii. Applications iv. Network
MAXIMUM DATA SECURITY with ideals TM Virtual Data Room
MAXIMUM DATA SECURITY with ideals TM Virtual Data Room WWW.IDEALSCORP.COM ISO 27001 Certified Account Settings and Controls Administrators control users settings and can easily configure privileges for
VMware Mirage Web Manager Guide
Mirage 5.1 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document,
Service Line Warranties of Canada PRIVACY STATEMENT
Service Line Warranties of Canada PRIVACY STATEMENT We at Service Line Warranties of Canada ( us, our we, or Company ) consider the protection of your personal information to be a priority when you visit
FIVE KEY CONSIDERATIONS FOR ENABLING PRIVACY IN HEALTH INFORMATION EXCHANGES
FIVE KEY CONSIDERATIONS FOR ENABLING PRIVACY IN HEALTH INFORMATION EXCHANGES The implications for privacy and security in the emergence of HIEs The emergence of health information exchanges (HIE) is widely
PRIVACY IMPLICATIONS FOR NEXT GENERATION SIEMs AND OTHER META-SYSTEMS
PRIVACY IMPLICATIONS FOR NEXT GENERATION SIEMs AND OTHER META-SYSTEMS www.massif-project.eu Dr Andrew Hutchison T-Systems (andrew.hutchison@t-systems.com) MAanagement of Security information and events
GoToMyPC Corporate Advanced Firewall Support Features
F A C T S H E E T GoToMyPC Corporate Advanced Firewall Support Features Citrix GoToMyPC Corporate features Citrix Online s advanced connectivity technology. We support all of the common firewall and proxy
McAfee Next Generation Firewall (NGFW) Administration Course
McAfee Product Education McAfee Next Generation Firewall (NGFW) Administration Course The McAfee NGFW Administration course from Education Services provides attendees with hands-on training on the design,
FTA Computer Security Workshop. Secure Email
FTA Computer Security Workshop Secure Email March 8, 2007 Stan Wiechert, KDOR IS Security Officer Outline of Presentation The Risks associated with Email Business Constraints Secure Email Features Some
Dynamism and Data Management in Distributed, Collaborative Working Environments
Dynamism and Data Management in Distributed, Collaborative Working Environments Alexander Kipp 1, Lutz Schubert 1, Matthias Assel 1 and Terrence Fernando 2, 1 High Performance Computing Center Stuttgart,
COMMISSION OF THE EUROPEAN COMMUNITIES COMMISSION RECOMMENDATION. of 12.5.2009
COMMISSION OF THE EUROPEAN COMMUNITIES Brussels, 12.5.2009 C(2009) 3200 final COMMISSION RECOMMENDATION of 12.5.2009 on the implementation of privacy and data protection principles in applications supported
Remote Access Platform. Architecture and Security Overview
Remote Access Platform Architecture and Security Overview NOTICE This document contains information about one or more ABB products and may include a description of or a reference to one or more standards
Assessment & Monitoring
Cloud Services Shadow IT Risk Assessment Report Assessment & Monitoring Shadow IT Analytics & Business Readiness Ratings with Elastica CloudSOC & Audit November, 204 Based on all data sources from October,
Semantic based Web Application Firewall (SWAF V 1.6) Operations and User Manual. Document Version 1.0
Semantic based Web Application Firewall (SWAF V 1.6) Operations and User Manual Document Version 1.0 Table of Contents 1 SWAF... 4 1.1 SWAF Features... 4 2 Operations and User Manual... 7 2.1 SWAF Administrator
BRING YOUR OWN DEVICE
BRING YOUR OWN DEVICE Legal Analysis & Practical TIPs for an effective BYOD corporate Policy CONTENTS 1. What is BYOD? 2. Benefits and risks of BYOD in Europe 3. BYOD and existing Policies 4. Legal issues
Embracing Microsoft Vista for Enhanced Network Security
Embracing Microsoft Vista for Enhanced Network Security Effective Implementation of Server & Domain Isolation Requires Complete Network Visibility throughout the OS Migration Process For questions on this
Qlik Sense Enabling the New Enterprise
Technical Brief Qlik Sense Enabling the New Enterprise Generations of Business Intelligence The evolution of the BI market can be described as a series of disruptions. Each change occurred when a technology
Introduction to the Mobile Access Gateway
Introduction to the Mobile Access Gateway This document provides an overview of the AirWatch Mobile Access Gateway (MAG) architecture and security and explains how to enable MAG functionality in the AirWatch
ECSA EuroCloud Star Audit Data Privacy Audit Guide
ECSA EuroCloud Star Audit Data Privacy Audit Guide Page 1 of 15 Table of contents Introduction... 3 ECSA Data Privacy Rules... 4 Governing Law... 6 Sub processing... 6 A. TOMs: Cloud Service... 7 TOMs:
CONTENTS. PCI DSS Compliance Guide
CONTENTS PCI DSS COMPLIANCE FOR YOUR WEBSITE BUILD AND MAINTAIN A SECURE NETWORK AND SYSTEMS Requirement 1: Install and maintain a firewall configuration to protect cardholder data Requirement 2: Do not
Domain Name System. Proper use reduces intranet administration costs. Architecture DNS. Service. Flexible Scalable Extensible
Domain Name System Proper use reduces intranet administration costs Architecture Flexible Scalable Extensible Service Standard Robust Efficient DNS Affordable Reliable Predictable The Internet continues
Website Privacy Policy Statement
Website Privacy Policy Statement This website ( CRSF Website ) is operated by Cal Ripken, Sr. Foundation, Inc. ( Company ) and this policy applies to all websites owned, operated, controlled and otherwise
Remote Services. Managing Open Systems with Remote Services
Remote Services Managing Open Systems with Remote Services Reduce costs and mitigate risk with secure remote services As control systems move from proprietary technology to open systems, there is greater
Privacy & Big Data: Enable Big Data Analytics with Privacy by Design. Datenschutz-Vereinigung von Luxemburg Ronald Koorn DRAFT VERSION 8 March 2014
Privacy & Big Data: Enable Big Data Analytics with Privacy by Design Datenschutz-Vereinigung von Luxemburg Ronald Koorn DRAFT VERSION 8 March 2014 Agenda? What is 'Big Data'? Privacy Implications Privacy
White paper September 2009. Realizing business value with mainframe security management
White paper September 2009 Realizing business value with mainframe security management Page 2 Contents 2 Executive summary 2 Meeting today s security challenges 3 Addressing risks in the mainframe environment
Cloud Security:Threats & Mitgations
Cloud Security:Threats & Mitgations Vineet Mago Naresh Khalasi Vayana 1 What are we gonna talk about? What we need to know to get started Its your responsibility Threats and Remediations: Hacker v/s Developer
ΕΠΛ 674: Εργαστήριο 5 Firewalls
ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized
Are You Prepared for a HIPAA Audit? 7 Steps to Security Readiness GUIDE BOOK
Are You Prepared for a HIPAA Audit? 7 Steps to Security Readiness GUIDE BOOK Are You Ready? For nearly four years, official HIPAA compliance audits have been on hold. The Department of Human Services (HHS)
Digital Identity & Authentication Directions Biometric Applications Who is doing what? Academia, Industry, Government
Digital Identity & Authentication Directions Biometric Applications Who is doing what? Academia, Industry, Government Briefing W. Frisch 1 Outline Digital Identity Management Identity Theft Management
6. AUDIT CHECKLIST FOR NETWORK ADMINISTRATION AND SECURITY AUDITING
6. AUDIT CHECKLIST FOR NETWORK ADMINISTRATION AND SECURITY AUDITING The following is a general checklist for the audit of Network Administration and Security. Sl.no Checklist Process 1. Is there an Information
How To Manage Security On A Networked Computer System
Unified Security Reduce the Cost of Compliance Introduction In an effort to achieve a consistent and reliable security program, many organizations have adopted the standard as a key compliance strategy
FERPA: Data & Transport Security Best Practices
FERPA: Data & Transport Security Best Practices April 2013 Mike Tassey Privacy Technical Assistance Center FERPA and Data Security Unlike HIPAA and other similar federal regulations, FERPA does not require
Follow the trainer s instructions and explanations to complete the planned tasks.
CERT Exercises Toolset 171 20. Exercise: CERT participation in incident handling related to Article 4 obligations 20.1 What will you learn? During this exercise you will learn about the rules, procedures
Executive Summary Alabama s Comprehensive Information Security Program
Executive Summary Alabama s Comprehensive Information Security Program For years and years, Alabama s approach to information security had been one of institutionalized decentralization. Each functional
GoodData Corporation Security White Paper
GoodData Corporation Security White Paper May 2016 Executive Overview The GoodData Analytics Distribution Platform is designed to help Enterprises and Independent Software Vendors (ISVs) securely share
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam Version 4.1 QUESTION NO: 1 Which of the following devices would be used to gain access to a secure network without affecting network connectivity? A. Router
Paladin Computers Privacy Policy Last Updated on April 26, 2006
Paladin Computers Privacy Policy Last Updated on April 26, 2006 At Paladin Computers ( Service Provider ), we respect our Users and Clients right to privacy with regards to the use of their email and our
Solutions to Trust. NEXThink V5 What is New?
Solutions to Trust NEXThink V5 What is New? HIGHLIGHTS What is New? ITSM: IT services analytics in real-time Analytics and product usability Security Analytics for all web & cloud applications Product
EU Policy on RFID & Privacy
EU Policy on RFID & Privacy Developments 2007, Outlook 2008 Andreas Krisch http://www.edri.org/ http://www.unwatched.org/ 24C3, 30.12.2007 European Digital Rights (EDRi) Umbrella
MANAGED FILE TRANSFER: 10 STEPS TO SOX COMPLIANCE
WHITE PAPER MANAGED FILE TRANSFER: 10 STEPS TO SOX COMPLIANCE 1. OVERVIEW Do you want to design a file transfer process that is secure? Or one that is compliant? Of course, the answer is both. But it s
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security
Rajan R. Pant Controller Office of Controller of Certification Ministry of Science & Technology rajan@cca.gov.np
Rajan R. Pant Controller Office of Controller of Certification Ministry of Science & Technology rajan@cca.gov.np Meaning Why is Security Audit Important Framework Audit Process Auditing Application Security
Security FAQs (Frequently Asked Questions) for Xerox Remote Print Services
Security FAQs (Frequently Asked Questions) for Xerox Remote Print Services February 30, 2012 2012 Xerox Corporation. All rights reserved. Xerox and Xerox and Design are trademarks of Xerox Corporation
Summary of the Dutch Data Protection Authority s guidelines for the Data Breach Notification Act
Summary of the Dutch Data Protection Authority s guidelines for the Data Breach Notification Act On 1 January 2016, the Dutch Data Breach Notification Act will enter into force. The Dutch DPA issued Guidelines
Security Issues in Cloud Computing
Security Issues in Computing CSCI 454/554 Computing w Definition based on NIST: A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources
vcenter Support Assistant User's Guide
vcenter Support Assistant 5.5 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions
Information Technology General Controls Review (ITGC) Audit Program Prepared by:
Information Technology General Controls Review (ITGC) Audit Program Date Prepared: 2012 Internal Audit Work Plan Objective: IT General Controls (ITGC) address the overall operation and activities of the
Information security controls. Briefing for clients on Experian information security controls
Information security controls Briefing for clients on Experian information security controls Introduction Security sits at the core of Experian s operations. The vast majority of modern organisations face
CLOUD SECURITY: THE GRAND CHALLENGE
Government Ware: GovWare Singapore September 29, 2010 CLOUD SECURITY: THE GRAND CHALLENGE Glen Gooding Asia Pacific Security Leader IBM Corporation ggooding@au1.ibm.com Rest safe: Google saves the day
Basics of Internet Security
Basics of Internet Security Premraj Jeyaprakash About Technowave, Inc. Technowave is a strategic and technical consulting group focused on bringing processes and technology into line with organizational
PRIVACY POLICY. To start, it is important for you to know two definitions that are key to understanding our programs and privacy practices:
PRIVACY POLICY At Brand Loyalty International B.V., or any of its subsidiaries or affiliates, including IceMobile, Merison and Edison companies, all Companies (, we, us, or our ), we advise on, implement,
Agenda. How to configure
dlaw@esri.com Agenda Strongly Recommend: Knowledge of ArcGIS Server and Portal for ArcGIS Security in the context of ArcGIS Server/Portal for ArcGIS Access Authentication Authorization: securing web services
Were there other system changes not listed above? No 3. Check the current ELC (Enterprise Life Cycle) Milestones (select all that apply)
Date of Approval: October 9, 2015 PIA ID Number: 1448 A. SYSTEM DESCRIPTION 1. Enter the full name and acronym for the system, project, application and/or database. AIMS Centralized Information System,
CLOUD STORAGE SECURITY INTRODUCTION. Gordon Arnold, IBM
CLOUD STORAGE SECURITY INTRODUCTION Gordon Arnold, IBM SNIA Legal Notice The material contained in this tutorial is copyrighted by the SNIA. Member companies and individual members may use this material
Automate PCI Compliance Monitoring, Investigation & Reporting
Automate PCI Compliance Monitoring, Investigation & Reporting Reducing Business Risk Standards and compliance are all about implementing procedures and technologies that reduce business risk and efficiently
<Choose> Addendum Windows Azure Data Processing Agreement Amendment ID M129
Addendum Amendment ID Proposal ID Enrollment number Microsoft to complete This addendum ( Windows Azure Addendum ) is entered into between the parties identified on the signature form for the
Keyfort Cloud Services (KCS)
Keyfort Cloud Services (KCS) Data Location, Security & Privacy 1. Executive Summary The purposes of this document is to provide a common understanding of the data location, security, privacy, resiliency
Security Whitepaper: ivvy Products
Security Whitepaper: ivvy Products Security Whitepaper ivvy Products Table of Contents Introduction Overview Security Policies Internal Protocol and Employee Education Physical and Environmental Security
The OPEN Manifesto Future City Principles
November 2013 The OPEN Manifesto Future City Principles 2 OPEN Manifesto The Open Manifesto paves the way for a more responsive city that adapts to the needs of its citizens. The success of Glasgow s Open
IT Security. Securing Your Business Investments
Securing Your Business Investments IT Security NCS GROUP OFFICES Australia Bahrain China Hong Kong SAR India Korea Malaysia Philippines Singapore Sri Lanka Securing Your Business Investments! Information
Electronic business conditions of use
Electronic business conditions of use This document provides Water Corporation s Electronic Business Conditions of Use. These are to be applied to all applications, which are developed for external users
Secure Semantic Web Service Using SAML
Secure Semantic Web Service Using SAML JOO-YOUNG LEE and KI-YOUNG MOON Information Security Department Electronics and Telecommunications Research Institute 161 Gajeong-dong, Yuseong-gu, Daejeon KOREA
STRATEGIC POLICY. Information Security Policy Documentation. Network Management Policy. 1. Introduction
Policy: Title: Status: 1. Introduction ISP-S12 Network Management Policy Revised Information Security Policy Documentation STRATEGIC POLICY 1.1. This information security policy document covers management,