Organizational Impact of Big Data on Privacy & Security

Transcription

1 Organizational Impact of Big Data on Privacy & Security Marijn Janssen, Agung Wahyudi Delft University of Technology EdCon Puerto Rico, 12 August 2015

2 OUTLINE 01 Privacy & Security in Organization 02 Big Data Era 03 Big Data Impact on Risks of Privacy & Security 04 Big Data Impact on Benefit of Privacy & Security 05 Balancing benefit and risk Why do we need privacy & security in organization? What big data makes different from just data? Increasing value of big data to any organization Does big data increase the impact of current risk of privacy & security in organization? Does big data create new risks of privacy & security? What benefit of big data in improving privacy and security? How can we balance the benefit and risk of big data on privacy and security? Compliance with Digital Privacy Regulation Privacy-by-design

3 01 Privacy & Security in Organization

4 Major concern on Privacy Source:

5 Impact of privacy & security breach/violation MONEY year #records stolen by year LEGAL IMPLICATION PRIVACY & SECURITY BRAND/VALUE TRUST CUSTOMER BASE Millions Source: tiful.net/visualizations/worldsbiggest-data-breaches-hacks/

6 02 Big Data Era

7 Value of big data to organization HOW WHAT Creating transparency Supporting experimental analysis Assisting in defining market segmentation Supporting real-time analysis and decisions Facilitation computerassisted in products Innovation Acceleration Collaboration New Business Models New Revenue Growth Opportunities

8 03 Big data impact on risks of privacy & security

9 Does big data increase the impact of current risk of privacy & security in organization? Security & privacy issues are magnified by velocity, volume, and variety of big data. VELOCITY Streaming data demands ultra-fast response times from security and privacy solutions VARIETY Various variety of data (structured, semistructured, unstructured) increases many possibilities of threat

10 Risks of big data to privacy & security Violating Privacy Data Security Decision-making based on incomplete data BIG DATA Adverse effect identification of big data to privacy & security

11 Does big data create new risks to privacy & security? New high-priority security & privacy risks that arise in big data era: Secure computations in distributed programming frameworks Scalable and composable privacypreserving data mining and analytics Security best practices for nonrelational data stores Cryptographically enforced access control and secure communication Secure data storage and transaction logs End-point input validation/filtering Granular access control Granular audits Real-time security/compliance monitoring Data provenance Source: CSA Top 10 Big Data Security and Privacy Challenge, 2012

12 04 Big data impact on benefit to privacy & security

13 What benefit of big data in improving privacy & security? Improved Security Enable Personalization & Dialogue with Consumers Preventing Crime; Fraud Detection Better Customer Service Higher Efficiency

14 05 Balancing benefit and risk

15 Balancing benefit(s) & risk(s) Improved security, preventing of crime, better customer service, and higher efficiency Violating privacy, data security, decision-making based on incomplete data

16 Privacy Regulatory Models Comprehensive Laws (or Regulatory Model) General laws govern the collection and use of personal information by public and private sectors and these laws are typically accompanied by an oversight body to ensure compliance (e.g. EU Privacy Regulation) Sectoral laws (targeted model) Countries favor specific sectoral laws that govern specific items, like video rental records or financial privacy, where enforcement is achieved through a range of mechanisms (like regulatory agencies, federal and state statutes, and self-policing) Self-regulation Various forms of self-regulation are employed (e.g. Verisign, TRUSTe, etc.) Consumer regulation Privacy protection is employed by the consumer through the use of commercial digital privacy protection tools (e.g. cookies blockers, encryptions, etc.) Source: Craig, et.al, Privacy and Big Data, O Really Media, 2011 (pp )

17 Compliance with Digital Privacy Regulation Health Information & Portability Accountability Act (HIPAA): consumer rights over their health information and sets rules on who can access and receive health information Gramm-Leach-Bliley (GLB) Act: financial institutions to explain how it collects, shares, and protects customers data via a privacy notice that is annually updated Children s Online Privacy Protection Act (COPPA): all websites that collect information from children under the age of 13 to have an explicit privacy policy, delineates the website owner s responsibilities to protect children s online privacy and safety, as well as the conditions under which the owner must receive verifiable consent from a parent Fail Credit Reporting Act, Telemarketing Sales Rule, Per-Pay-Call Rule, Equal Opportunity Credit Acc European Convention on Human Rights (ECHR) EU Data Protection Directive: 8 principles of personal data protection (Collection Limitation, Data Quality, Purpose Specification, Use Limitation, Security Safeguards, Openness, Individual Participation, Accountability) EU Privacy & Communication Directive: regulate new digital technologies in the treatment of private information as it relates to traffic data, spam, and cookies APEC Privacy Framework (2014) APEC Cross Border Privacy Enforcement Arrangement (CPEA): facilitate information sharing and cooperation between authorities responsible for data and consumer protection in the APEC region Source: Craig, et.al, Privacy and Big Data, O Really Media, 2011 (pp )

18 Privacy-by-Design [1/2] PbD prescribes that privacy be built directly into the design and operation, not only of technology, but also how a system is operationalized (e.g., work processes, management structures, physical spaces and networked infrastructure.). 7 principles of PbD: 1 FULL ATTRIBUTION: Every observation (record) needs to know from where it came and when. There cannot be merge/purge data survivorship processing whereby some observations or fields are discarded DATA TETHERING: Adds, changes and deletes occurring in systems of record must be accounted for, in real time, in sub-seconds. ANALYTICS ON ANONYMIZED DATA: The ability to perform advanced analytics (including some fuzzy matching) over cryptographically altered data means organizations can anonymize more data before information sharing. TAMPER-RESISTANT AUDIT LOGS: Every user search should be logged in a tamper-resistant manner even the database administrator should not be able to alter the evidence contained in this audit log. Source: Cavaoukian, et.al, Privacy by Design in the Age of Big Data, 2012 (pp )

19 Privacy-by-Design [2/2] PbD prescribes that privacy be built directly into the design and operation, not only of technology, but also how a system is operationalized (e.g., work processes, management structures, physical spaces and networked infrastructure.). 7 principles of PbD: 5 FALSE NEGATIVE FAVORING METHODS: The capability to more strongly favor false negatives is of critical importance in systems that could be used to affect someone s civil liberties. 6 SELF-CORRECTING FALSE POSITIVES: With every new data point presented, prior assertions are reevaluated to ensure they are still correct, and if no longer correct, these earlier assertions can often be repaired in real time. 7 INFORMATION TRANSFER ACCOUNTING: Every secondary transfer of data, whether to human eyeball or a tertiary system, can be recorded to allow stakeholders (e.g., data custodians or the consumers themselves) to understand how their data is flowing. Source: Cavaoukian, et.al, Privacy by Design in the Age of Big Data, 2012 (pp )

20 THANK YOU FOR YOUR ATTENTION