Business cases internet 30 use cases

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Todd Fitzgerald, CISSP, CISM, CISA, CRISC, CGEIT, CIPP/US/E/C, CIPM,
PMP, ISO27001, ITILv3f
O...

#RSAC
4. Privacy Program Design
3. Privacy Laws and Common Principles
1. Why Should Security Officers Care About
Privacy?
...

#RSAC
1. What Is The Phishing Threat Today?
Why Should Security Officers
Care About Privacy?

#RSAC
We Face Privacy Choices Daily

#RSAC
The CISO Job Description
Job description:
This position will represent the information protection program of the’ re...

#RSAC
…Continued
Direct senior security personnel in order to achieve the security initiatives • Participate in the inform...

#RSAC
Contains Many Privacy References!
Job description:
This position will represent the information protection program o...

#RSAC
Direct senior security personnel in order to achieve the security initiatives • Participate in the information secur...

#RSAC
The Fortune 1000 Is Investing in Privacy and
Values Relationships To Information Security
Source: Benchmarking Priva...

#RSAC
The 2018 CISO Evolution
• Plan path away from
operations
• Refine risk management
processes to business
language
• W...

#RSAC
The New CISO will Need to Know Privacy
1990s-2000 2000-2003 2004-2008 2008-2014 2015-20+
Non Existent
Security=Logon...

#RSAC
The security officer is increasingly dealing with
privacy concerns beyond the 'privacy principles'
Lack of global tr...

#RSAC
PRIVACY IS DEAD… OR IS IT ?
13
Privacy Is Completely And Utterly Dead, And We Killed It
- Forbes, 8/19/14
Privacy Is...

#RSAC
© 2011 Tamara J. Erickson and Moxie Insight.
U.S. Dept of Labor (Date Range 1946-64, 1965-79
Each generation
approac...

#RSAC
The Workforce Composition Is Shifting
Source: Deloitte Research/UN Population Division, It’s 2008: Do You Know Where...

#RSAC

#RSAC
1. What Is The Phishing Threat Today?
Privacy Laws and Common
Principles

#RSAC
Early Privacy Laws and Regulations
18
Year Milestone
1890 "The Right to Privacy" Warren and Brandeis
1947 Article 12...

#RSAC
Privacy Coverage Varies Across Countries
19
Source: Forrester Research, 2015 privacy Heat Map, Forbes 10/15/15 (rela...

#RSAC
Laws Vary in Approach
20
Sectoral Laws (US)
PIPEDA (Canada)
Comprehensive (EU)
Co-Regulatory (AU)
Australia Federal ...

#RSAC
2016 Saw Much Activity with Emerging EU/US
Privacy Laws
21
General Data
Protection
Regulation
EU/US Privacy
Shield
(...

#RSAC
Organization for Economic Co-operation and
Development (OECD) Privacy Principles
22
Collection Limitation
Data Quali...

#RSAC
OECD- 1. Collection Limitation Principle
23
There should be limits to the collection of personal data
and any such d...

#RSAC
OECD- 2. Data Quality Principle
24
Personal data should be relevant to the purposes for
which they are to be used, a...

#RSAC
OECD- 3. Purpose Specification Principle
25
The purposes for which personal data are collected
should be specified n...

#RSAC
OECD- 4. Use Limitation Principle
26
Personal data should not be disclosed, made
available or otherwise used for pur...

#RSAC
OECD- 5. Security Safeguards Principle
27
Personal data should be protected by reasonable
security safeguards agains...

#RSAC
OECD- 6. Openness Principle
28
There should be a general policy of openness about
developments, practices and polici...

#RSAC
OECD- 7. Individual Participation Principle
29
Right to
obtain
confirmation
DATA STORED
REASONABLE
TIME
REASONABLE
M...

#RSAC
OECD- 8. Accountability Principle
30
A data controller should be accountable for complying
with measures which give ...

#RSAC
1. What Is The Phishing Threat Today?
The Language of Privacy

#RSACPrivacy Language Can Be Foreign To Business
Environment…
• Principles need to be
communicated in business
context
• C...

#RSAC
EU Defines Personal Data
"Personal data shall mean any information relating to an identified or
identifiable natural...

#RSAC
Personal Information Elements
Name Gender Age DOB
Marital Status Citizenship Nationality
Languages
Spoken
Veteran St...

#RSAC
Sources of Personal Information
35
Public Records
• Real estate
• Criminal
• Varies
State/National/Local
level
Publi...

#RSAC
Sensitive Personal Information
EUROPE UNITED
STATES
36
• Racial or Ethic Origin
• Political opinion
• Religious or p...

#RSAC
Data Protection Roles
37
Data
Protection
Authority
Data
Controller
Data
Subject
Data
Processor
• Enforcement
• Repor...

#RSAC
Privacy Policy and Notice
Privacy Policy – Internal statement
directing employees
Privacy Notice- statement to data
...

#RSAC
Privacy Consent
• Processed unless data
subject objects
• Box pre-checked to accept
or check box to opt-out
OPT-OUT
...

#RSAC
OPT-IN or OPT-OUT ?
A. DO YOU WANT TO RECEIVE ADDITIONAL
INFORMATION?
 YES  NO
B.  CHECK BOX IF YOU DO NOT WANT T...

#RSAC
1. What Is The Phishing Threat Today?
Privacy Program Design

#RSAC
Privacy Information Life Cycle
Collection Use Retention Disclosure
42
• Limits
• Lawful and fair
means
• Consent
• I...

#RSAC
Privacy By Design – 7 Principles
1.
PROACTIVE
PREVENTATIVE
2. PRIVACY
BY
DEFAULT
3.
EMBEDDED
IN
DESIGN
4.
POSITIVE-S...

#RSAC
1.
PROACTIVE
PREVENTATIVE

#RSAC
2.
PRIVACY BY
DEFAULT

#RSAC
3.
EMBEDDED IN
DESIGN

#RSAC
4.
POSITIVE SUM
NOT ZERO-
SUM

#RSAC
5.
END-TO-END
SECURITY;
LIFECYCLE
PROTECTION

#RSAC
6.
VISIBILITY
TRANSPARENCY

#RSAC
7.
RESPECT FOR
USERS

#RSAC
Privacy Impact Assessment (PIA)
51
• Checklists to ensure
systems evaluated for
privacy risks
• New systems
• Change...

#RSAC
1. What Is The Phishing Threat Today?
Final Thoughts

#RSAC
Data+Privacy+Security+Risk= New Focus
1990s-2000 2000-2003 2004-2008 2008-2014 2015-20+
Non Existent
Security=Logon ...

#RSAC
54
Next week you should:
Schedule a meet n greet with the privacy officer or legal dept.
In the first three months f...

#RSAC
Today We Explored…
55
Why Privacy should be Important to the security officer
8 information OECD Privacy Principles
...

#RSAC
Resources Contributed To By Presenter (Books In
Amazon, B&N, ISC2, EC-Council Website, RSA Bookstore)
56
Information...

#RSAC
Final Thoughts
• Planning and advance communication of
Phishing/awareness campaigns is essential
• Learning must be ...

#RSAC
I leave you with this 60 second view of your next few years figuring out
where all the data is and what privacy regu...

#RSAC
Thank You Very Much For Your Participation!
Todd Fitzgerald, CISSP, CISM, CISA, CRISC, CGEIT,
CIPP/US/E/C, CIPM, PMP...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 59 Ad

View on Slideshare

1 of 59 Ad