Cybersecurity & Privacy: What's Ahead for 2017 - ALA Midwinter 2017
•Download as PPT, PDF•
2 likes•950 views
Library information security and privacy are both fundamental and challenging. Help is coming as Internet leaders push heavier use of encryption, a move that highlights the differences between secure and non-secure online use. How can libraries help prepare and educate users to work within a more difficult Internet environment? How can they inspire more private online behavior in the year ahead? Join the leader of ProQuest’s Information Security Office to discuss emerging issues in cybersecurity and privacy for libraries and information providers. Attendees will get tips for protecting the privacy of your patrons and for educating them on how to use information services securely. This session will also cover the differences between the privacy of consumer services and professional Information services, and best practices for patrons to protect their own personal information as they access public and library resources both in the library and remotely as the footprint of the library expands along with mobile device adoption.
Recommended
More Related Content
What's hot
Viewers also liked
Viewers also liked (20)
Similar to Cybersecurity & Privacy: What's Ahead for 2017 - ALA Midwinter 2017
Similar to Cybersecurity & Privacy: What's Ahead for 2017 - ALA Midwinter 2017 (20)
More from ProQuest
More from ProQuest (17)
Recently uploaded
Recently uploaded (19)
Cybersecurity & Privacy: What's Ahead for 2017 - ALA Midwinter 2017
- 1. ©2016 ProQuest LLC. All rights reserved. Security & Privacy: What’s Ahead for 2017 Library Edition Daniel Ayala (@buddhake) Director, Global Information Security, ProQuest ALA Midwinter 2017 Atlanta, Georgia
- 2. ©2016 ProQuest LLC. All rights reserved.2 First, a story…
- 3. ©2016 ProQuest LLC. All rights reserved. Modern technology is amazing. 3 The sky is the limit… …but there is reason for caution
- 4. ©2016 ProQuest LLC. All rights reserved. Security & privacy go beyond the library 4
- 5. ©2016 ProQuest LLC. All rights reserved.5 Library as Hub of Privacy & Security
- 6. ©2016 ProQuest LLC. All rights reserved. Protect the Systems! Protect the Users! Protect the Data! 6 Device Security
- 7. ©2016 ProQuest LLC. All rights reserved. Protect the Systems! Protect the Users! Protect the Data! 7 Malware Ransomware
- 8. ©2016 ProQuest LLC. All rights reserved. Protect the Systems! Protect the Users! Protect the Data! 8 Phishing
- 9. ©2016 ProQuest LLC. All rights reserved. Protect the Systems! Protect the Users! Protect the Data! 9 Browser Security
- 10. ©2016 ProQuest LLC. All rights reserved. Protect the Systems! Protect the Users! Protect the Data! 10 Mobile Devices
- 11. ©2016 ProQuest LLC. All rights reserved. A few words on 11 P R I V A C Y
- 12. ©2016 ProQuest LLC. All rights reserved.12 USA Patriot Act
- 13. ©2016 ProQuest LLC. All rights reserved.13 USA Freedom Act
- 14. ©2016 ProQuest LLC. All rights reserved.14 Consumer Services Devour Data
- 15. ©2016 ProQuest LLC. All rights reserved.15 Anonymisation & Tor
- 16. ©2016 ProQuest LLC. All rights reserved.16 Personalisatio n
- 17. ©2016 ProQuest LLC. All rights reserved.17 Opt-in vs Opt- Out
- 18. ©2016 ProQuest LLC. All rights reserved.18 Net Neutrality Rollback* *In discussion, not yet submitted for public
- 19. ©2016 ProQuest LLC. All rights reserved.19 ISP Browsing Data Privacy Rollback* *In discussion, not yet submitted for public
- 20. ©2016 ProQuest LLC. All rights reserved. Tools 20 Ghostery (Chrome) – https://www.ghostery.com 1Blocker (Mac/iOS) - http://1blocker.com BuiltWith (Chrome) - https://builtwith.com Malwarebytes - https://www.malwarebytes.com Deep Freeze - http://www.faronics.com/products/deep- freeze/ Tor - https://www.torproject.org Let’s Encrypt (SSL) - https://letsencrypt.org
- 21. ©2016 ProQuest LLC. All rights reserved.21 Shared responsibility for privacy
- 22. ©2016 ProQuest LLC. All rights reserved.22 Transparency
- 23. ©2016 ProQuest LLC. All rights reserved.23 Anonymisation
- 24. ©2016 ProQuest LLC. All rights reserved.24 Options & Informed Consent
- 25. ©2016 ProQuest LLC. All rights reserved.25 Sharing Data w/ Others
- 26. ©2016 ProQuest LLC. All rights reserved.26 Support Anonymous Use
- 27. ©2016 ProQuest LLC. All rights reserved.27 Access to One’s own User Data
- 28. ©2016 ProQuest LLC. All rights reserved.28 Accountability
- 29. ©2016 ProQuest LLC. All rights reserved.29 RA21 RA21’s mission is to align and simplify pathways to subscribed content across participating scientific platforms. RA21 will address the common problems users face when interacting with multiple and varied information protocols. http://www.stm-assoc.org/standards-technology/ra21-resource-access- 21st-century/
- 30. ©2016 ProQuest LLC. All rights reserved. Balance 30 Security & Privacy Utility
- 31. ©2016 ProQuest LLC. All rights reserved. Foundational thinking31 Data will always be collected Collection != Privacy Violation Serve the user/patron! Set principles for use & sharing If you collect it, use it wisely and get rid of it when you’re done! TRUST!(but verify)
- 32. ©2016 ProQuest LLC. All rights reserved. Give patrons/users the information, options to make smart, well-informed privacy decisions32
- 33. ©2016 ProQuest LLC. All rights reserved. Security & privacy go beyond the library 33 Give patrons/users the information, options to make smart, well-informed privacy decisions
- 34. ©2016 ProQuest LLC. All rights reserved.34 HTTP S 11 Available Now, +5 More Soon All new ProQuest products, HTTPS only HTTPS only - later this summer http://www.proquest.com/blog/pqblog/2017/Why-Those-HTTPS-Messages-Mean- Something-to-You-.html
- 35. ©2016 ProQuest LLC. All rights reserved.35 http://www.proquest.com/blog/pqblog/2017/Why-Those-HTTPS-Messages-Mean- Something-to-You-.html ProQuest platform (search.proquest.com) ProQuest Dialog (search.proquest.com/professional) ProQuest Administrator Module (PAM) Legacy RefWorks The New RefWorks Ebook Central ProQuest Research Companion Pi2 Drug Safety Triager Alexander Street Platform (search.alexanderstreet.com) Alexander Street Academic Video Store (search.alexanderstreet.com/store) Alexander Street Admin Portal NOW!
- 36. ©2016 ProQuest LLC. All rights reserved.36 http://www.proquest.com/blog/pqblog/2017/Why-Those-HTTPS-Messages-Mean- Something-to-You-.html Pivot eLibrary CultureGrams SIRS HeritageQuest Online ProQuest Congressional (congressional.proquest.com) SOON!
- 37. ©2016 ProQuest LLC. All rights reserved.37 Privacy PolicyFull Update Coming SoonWhat data is collected How it is used With whom it is sharedEU/USA Privacy Shield Compliant
- 38. ©2016 ProQuest LLC. All rights reserved.38 When it comes to privacy and accountability, people always demand the former for themselves and the latter for everyone else. – David Brin
- 39. ©2016 ProQuest LLC. All rights reserved. Resources & Credits NISO Consensus Framework to Support Patron Privacy in Digital Library and Information Systems - http://www.niso.org/topics/tl/patron_privacy/ ALA Code of Ethics - http://www.ala.org/advocacy/proethics/codeofethics/codeethics ALA Library Privacy Guidelines for e-book Lending and Digital Content Vendors - http://www.ala.org/advocacy/library-privacy- guidelines-e-book-lending-and-digital-content-vendors STM RA21 - http://www.stm-assoc.org/standards-technology/ra21-resource- access-21st-century/ 39
- 40. ©2016 ProQuest LLC. All rights reserved.40 Q&A
Editor's Notes
- Devise appropriate access to data Least privilege Revisit rights frequently Encrypt it! Both in motion and at rest Log all the access, and review the logs regularly Audit your suppliers to your standards Educate the users that use the data Trust, but verify Be ready for a compromise It’s not IF it’s WHEN Protect the data as though you guarantee it will be taken Incident response & communications plan beforehand!
- Devise appropriate access to data Least privilege Revisit rights frequently Encrypt it! Both in motion and at rest Log all the access, and review the logs regularly Audit your suppliers to your standards Educate the users that use the data Trust, but verify Be ready for a compromise It’s not IF it’s WHEN Protect the data as though you guarantee it will be taken Incident response & communications plan beforehand!
- Devise appropriate access to data Least privilege Revisit rights frequently Encrypt it! Both in motion and at rest Log all the access, and review the logs regularly Audit your suppliers to your standards Educate the users that use the data Trust, but verify Be ready for a compromise It’s not IF it’s WHEN Protect the data as though you guarantee it will be taken Incident response & communications plan beforehand!
- Devise appropriate access to data Least privilege Revisit rights frequently Encrypt it! Both in motion and at rest Log all the access, and review the logs regularly Audit your suppliers to your standards Educate the users that use the data Trust, but verify Be ready for a compromise It’s not IF it’s WHEN Protect the data as though you guarantee it will be taken Incident response & communications plan beforehand!
- Devise appropriate access to data Least privilege Revisit rights frequently Encrypt it! Both in motion and at rest Log all the access, and review the logs regularly Audit your suppliers to your standards Educate the users that use the data Trust, but verify Be ready for a compromise It’s not IF it’s WHEN Protect the data as though you guarantee it will be taken Incident response & communications plan beforehand!
- Ghostery 1Blocker MadeWith Malwarebytes Deepfreeze
- http://www.niso.org/apps/group_public/download.php/16064/NISO%20Privacy%20Principles.pdf http://www.ala.org/advocacy/library-privacy-guidelines-e-book-lending-and-digital-content-vendors Shared Privacy Responsibilities Transparency and Facilitating Privacy Awareness Security Data Collection and Use Anonymization Options and Informed Consent Sharing Data with Others Notification of Privacy Policies and Practices Supporting Anonymous Use Access to One’s Own User Data Continuous Improvement Accountability
- http://www.niso.org/apps/group_public/download.php/16064/NISO%20Privacy%20Principles.pdf http://www.ala.org/advocacy/library-privacy-guidelines-e-book-lending-and-digital-content-vendors Shared Privacy Responsibilities Transparency and Facilitating Privacy Awareness Security Data Collection and Use Anonymization Options and Informed Consent Sharing Data with Others Notification of Privacy Policies and Practices Supporting Anonymous Use Access to One’s Own User Data Continuous Improvement Accountability
- http://www.niso.org/apps/group_public/download.php/16064/NISO%20Privacy%20Principles.pdf http://www.ala.org/advocacy/library-privacy-guidelines-e-book-lending-and-digital-content-vendors Shared Privacy Responsibilities Transparency and Facilitating Privacy Awareness Security Data Collection and Use Anonymization Options and Informed Consent Sharing Data with Others Notification of Privacy Policies and Practices Supporting Anonymous Use Access to One’s Own User Data Continuous Improvement Accountability
- http://www.niso.org/apps/group_public/download.php/16064/NISO%20Privacy%20Principles.pdf http://www.ala.org/advocacy/library-privacy-guidelines-e-book-lending-and-digital-content-vendors Shared Privacy Responsibilities Transparency and Facilitating Privacy Awareness Security Data Collection and Use Anonymization Options and Informed Consent Sharing Data with Others Notification of Privacy Policies and Practices Supporting Anonymous Use Access to One’s Own User Data Continuous Improvement Accountability
- http://www.niso.org/apps/group_public/download.php/16064/NISO%20Privacy%20Principles.pdf http://www.ala.org/advocacy/library-privacy-guidelines-e-book-lending-and-digital-content-vendors Shared Privacy Responsibilities Transparency and Facilitating Privacy Awareness Security Data Collection and Use Anonymization Options and Informed Consent Sharing Data with Others Notification of Privacy Policies and Practices Supporting Anonymous Use Access to One’s Own User Data Continuous Improvement Accountability
- http://www.niso.org/apps/group_public/download.php/16064/NISO%20Privacy%20Principles.pdf http://www.ala.org/advocacy/library-privacy-guidelines-e-book-lending-and-digital-content-vendors Shared Privacy Responsibilities Transparency and Facilitating Privacy Awareness Security Data Collection and Use Anonymization Options and Informed Consent Sharing Data with Others Notification of Privacy Policies and Practices Supporting Anonymous Use Access to One’s Own User Data Continuous Improvement Accountability
- http://www.niso.org/apps/group_public/download.php/16064/NISO%20Privacy%20Principles.pdf http://www.ala.org/advocacy/library-privacy-guidelines-e-book-lending-and-digital-content-vendors Shared Privacy Responsibilities Transparency and Facilitating Privacy Awareness Security Data Collection and Use Anonymization Options and Informed Consent Sharing Data with Others Notification of Privacy Policies and Practices Supporting Anonymous Use Access to One’s Own User Data Continuous Improvement Accountability
- http://www.niso.org/apps/group_public/download.php/16064/NISO%20Privacy%20Principles.pdf http://www.ala.org/advocacy/library-privacy-guidelines-e-book-lending-and-digital-content-vendors Shared Privacy Responsibilities Transparency and Facilitating Privacy Awareness Security Data Collection and Use Anonymization Options and Informed Consent Sharing Data with Others Notification of Privacy Policies and Practices Supporting Anonymous Use Access to One’s Own User Data Continuous Improvement Accountability
- At the foundation of everything, we have some guiding principles that we worked with as we developed our approach: Some data will always be collected; it’s the nature of online services. Collection alone does not equal violation of user privacy, especially if explicit approval to use is given by the user. The underlying primary goal is to assist the missions of the researcher, library or author in achieving their missions. Guiding principles will define the rules of data collection, use and sharing. If you collect it, use it wisely, protect it and get rid of it when you don’t need it any longer.
- In March 2016 Apple product keynote, a section was devoted to privacy of data A Reuters article1 released at the same time chronicled the internal ”privacy czar” review and scrutiny process within Apple Apple has employed a similar review process prior to data being collected and/or used Apple has been clear about their commitment to privacy [1] http://www.reuters.com/article/us-apple-encryption-privacy-insight-idUSKCN0WN0BO