Data Privacy and Security Handout PDF

IT2028 Data Privacy Data security includes a set of standards and different...

IT2028 Data Privacy Data security includes a set of standards and different safeguards and measures that an organization is taking to Personal data refers to any information, whether recorded in a prevent any third party from unauthorized access to digital data material form or not, from which the identity of an individual is or any intentional or unintentional alteration, deletion, or data apparent or can be directly ascertained by the entity holding the disclosure. It focuses on the protection of data from malicious information. attacks and prevents the exploitation of stolen data such as: Privacy concerns the collection and use of data about o Data breach – an unauthorized or unintentional individuals. There are three (3) primary privacy issues: disclosure of confidential information. o Accuracy relates to the responsibility of those who o Cyberattack – the stealing of data or confidential collect data to ensure that the data is correct. information by electronic means, including ransomware o Property relates to who owns the data. and hacking. o Access relates to the responsibility of those who have To achieve this, organizations use tools and technology such as data to control who can use that data. firewalls, user authentication, network limitations, and internal security practices to prevent such access. Data Privacy Versus Data Security Organizations commonly believe that keeping sensitive data secure from hackers means they’re automatically compliant with data privacy regulations Data privacy and data security are often used interchangeably, but there are distinct differences, although sometimes difficult to distinguish between. Whereas security controls can be met without also satisfying privacy considerations, privacy concerns are impossible to address without first employing effective security practices. In other words, security protects data, and privacy protects the identity Privacy and security come down to which data is being protected, how it’s being protected, from whom it’s being protected, and who is responsible for that protection. Security is about protecting data from malicious threats, whereas privacy is about using data responsibly. Data privacy is a part of the data protection area that deals with the proper handling of data, with the focus on compliance with data protection regulations. Data privacy focuses on the rights of individuals, the purpose of Figure 1. Privacy and Security data collection and processing, privacy preferences, and the way organizations govern the personal data of data subjects. It focuses on how to collect, process, share, archive, and delete the data under the law. 01 Handout 1 *Property of STI  [email protected] Page 1 of 2  IT2028 CIA Triad is a model designed to guide an organization’s Aspect of Privacy policies on information security. The elements of the triad are Information privacy is considered an important aspect of considered the three most crucial components of security. The information sharing. With the advancement of the digital age, following are the three (3) elements of data security. personal information vulnerabilities have increased o Confidentiality ensures that data is accessed only by Information privacy may be applied in numerous ways, including authorized individuals. encryption, authentication, and data masking, each attempting o Integrity ensures that information is reliable as well as to ensure that information is available only to those with accurate; and authorized access. o Availability ensures that data is both available and Information privacy includes the regulations required for accessible to satisfy business needs. companies to protect data. And as more data protection regulation grows worldwide, global privacy requirements and demands will also expand and change. Protective measures are geared toward preventing data mining and the unauthorized use of personal information, which are illegal in many parts of the world. Information privacy also relates to different data types, including: o Internet privacy: All personal data shared over the Internet is subject to privacy issues. Most websites publish a privacy policy that details the website's intended use of collected online and/or offline collected data. o Financial privacy: Financial information is particularly sensitive, as it may easily use to commit online and/or offline fraud. o Medical privacy: All medical records are subject to stringent laws that address user access privileges. By Figure 1. CIA Triad law, security and authentication systems are often required for individuals that process and store medical Elements of Data Privacy records. Data privacy encompasses three (3) key elements: o Right of an individual to be left alone and have control over their data o Procedures for proper handling, processing, collecting, References: and sharing of personal data Kumar, G., Saini, DK., Huy Cuong, NH. (2020). Cyber Defense Mechanisms: Security, o Compliance with data protection laws Privacy, and Challenges. CRC Press. Data management – the process of ingesting, storing, Stallings, W. (2019). Information Privacy Engineering and Privacy by Design: organizing, and maintaining the data created and collected by an Understanding privacy threats, technologies, and regulations. Assison-Wesley organization. Professional. Petters, J. Data Privacy Guide: Explanations and Legislation. Retrieved from Data management is at the heart of privacy. Data is a vague https://www.varonis.com/blog/data-privacy/#tips on September 9, 2020 concept and can encompass such a wide range of information. 01 Handout 1 *Property of STI  [email protected] Page 2 of 2