Downloaded 32 times
![INTERESTING FOR DISABLING GOOGLE ANALYTICS
<?php if (!array_key_exists('HTTP_DNT', $_SERVER) || 1 !== (int) $_SERVER[‘HTTP_DNT’]): ?>
<!-- show your Google Analytics Script Here -->
<?php endif ?>](https://image.slidesharecdn.com/privacybydesign-171121142701/85/Privacy-by-design-46-320.jpg)
![REGULAR
EXPRESSIONS
cat server.log | sed -r 's/([0-9]+).([0-9]+)
.([0-9]+).([0-9]+)/1.xxx.xxx.4/g' -](https://image.slidesharecdn.com/privacybydesign-171121142701/85/Privacy-by-design-65-320.jpg)
Uploaded byMichelangelo van Dam
Privacy by design
The document emphasizes the importance of privacy by design in software development, highlighting recent data breaches that resulted in significant personal and financial consequences for individuals. It offers practical advice for protecting user data, including minimizing data collection, implementing strong password management, and encrypting communication and storage. The document also stresses the need for transparency and respect for user trust, advocating for measures like anonymization and better access management to enhance data privacy.
More Related Content
Similar to Privacy by design
Privacy by design
- 1. PRIVACY BY DESIGN Startby thinking privacy first
- 2. MICHELANGELO VAN DAM ➤Web Application Architect ➤ CEO In2it ➤ President PHPBenelux ➤ Coach at CoderDojo ➤ Open source contributor ➤ Conference speaker
- 3. WHY IS PRIVACYIMPORTANT? ➤ Human right ➤ Too much data already collected ➤ Information is everywhere ➤ Individuals have become the product
- 6. LATEST BREACHES THATIMPACTED PEOPLE’S LIVES
- 7. LATEST BREACHES THATIMPACTED PEOPLE’S LIVES Equifax (2017) 143 Million accounts hacked financial exposure (credit), credit card data & personal information
- 8. LATEST BREACHES THATIMPACTED PEOPLE’S LIVES Equifax (2017) 143 Million accounts hacked financial exposure (credit), credit card data & personal information Ashley Madison (2015) 37 Million accounts hacked extorsion, divorces, suicides
- 9. LATEST BREACHES THATIMPACTED PEOPLE’S LIVES Equifax (2017) 143 Million accounts hacked financial exposure (credit), credit card data & personal information Ashley Madison (2015) 37 Million accounts hacked extorsion, divorces, suicides OPM (2015) 21 Million US government personnel foreign assets, informant data, addictions & relationship issues
- 11. YOUR ADVERSARIES Who’s afteryour data?
- 12. VIRUSES Automated scripts tosteal data
- 13. SCRIPT KIDDIES Using freetools and often have no clue what they’re doing
- 14. SOFTWARE ENGINEERS These people arenew to security and try out things they have learned
- 15. PROFESSIONALS They are thesecurity experts!
- 16. COMPETITION They’re after yoursecret sauce
- 17. NATION STATES They mightalready be inside …
- 18. EMPLOYEES They have allthe access!
- 19. WHAT IF A serviceI use has been breached?
- 22. HOW TO PROTECTPRIVACY? Time to step up and give trust back to your customers
- 23. DON’T COLLECT ALL THETHINGS! Keep it to a bare minimum
- 24. LIMIT EXPIRATION Don’t keeplonger than needed
- 25. SEPARATE Keep private informationsomewhere different from other (business) data
- 26. DON’T EXPOSE Keep privatedata hidden from views
- 27. SOME EXAMPLES Technical thingsyou can do right now!
- 28. PASSWORD MANAGEMENT ➤ Don’tstore data access passwords in common repository ➤ Don’t keep passwords in environment variables* ➤ Make use of an Identity Management System to manage ➤ SSH keys ➤ API keys ➤ DSN’s ➤ Public keys (*) Why not use environment variables: diogomonica.com
- 29. HASHICORP VAULT ➤ Toolfor managing secrets ➤ vaultproject.io ➤ Secures, stores and controls ➤ access tokens ➤ passwords ➤ certificates ➤ API keys ➤ … others ➤ Access Control ➤ Key Rolling ➤ Configurable lease time ➤ Audit logs ➤ Open Source
- 30.
- 33. USE A TEAMPASSWORD MANAGER
- 34. GIVE 2FA TOEVERYONE!
- 35. POP QUIZ &WIN A YUBICO KEY!
- 36. AUDIT TRAILS WITHMIDDLEWARE & CQRS ➤ Log access to data ➤ Automate anonymising of privacy data ➤ Automate encryption of privacy data
- 37. …AND DON’T FORGETTO ENCRYPT YOUR STORAGE & COMMUNICATIONS! App Data Storage File Storage Log Storage Backup Storage Public - private key exchange| encrypted data storage
- 38. WHAT YOU CAN DONOW! Simple steps towards more privacy
- 39. RESPECT DNT HEADERS Yourusers have chosen to opt-out
- 42. Accept: text/html,application/xhtml+xml,application/xml;q=0.9 Accept-Encoding: gzip,deflate, br Accept-Language: en-GB,en;q=0.8,en-US;q=0.6,nl;q=0.4 Cache-Control: max-age=0 Connection: keep-alive DNT: 1 Host: www.example.com Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (<script>alert(‘Filter Input, Escape Output’);</script>)
- 43. Accept: text/html,application/xhtml+xml,application/xml;q=0.9 Accept-Encoding: gzip,deflate, br Accept-Language: en-GB,en;q=0.8,en-US;q=0.6,nl;q=0.4 Cache-Control: max-age=0 Connection: keep-alive DNT: 1 Host: www.example.com Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (<script>alert(‘Filter Input, Escape Output’);</script>)
- 46. INTERESTING FOR DISABLINGGOOGLE ANALYTICS <?php if (!array_key_exists('HTTP_DNT', $_SERVER) || 1 !== (int) $_SERVER[‘HTTP_DNT’]): ?> <!-- show your Google Analytics Script Here --> <?php endif ?>
- 47. REMOVE THE “DATA” fromviews and interfaces
- 49. What’s wrong withthis picture?
- 50. Why display fullname details?
- 51. Why display emailaddresses?
- 52. Why display phonenumbers?
- 53. REDUCE ACCESS TODETAILS If a user has other ways to communicate with your clients, remove the visible display of common data elements like full names, email and shipment addresses and phone numbers.
- 55. Do you seethe difference?
- 56. Not full namedisplay
- 57.
- 59. SAME FUNCTIONALITY, BUTKEEPS DATA HIDDEN ➤ Prevents accidentally exposing email and phone numbers (e.g. during a call) ➤ Hides details from end-user, but functionality is still provided ➤ Sending out an email uses build-in mail client ➤ Making calls uses a phone middleware used in the company ➤ Gives clear audit trail on who accessed what
- 62. NOT 100% PROTECTION,BUT… ➤ We remove the personal one-on-one communication with customers ➤ We add better access management on customer communication ➤ Full audit trail now possible as communication stays in-application ➤ Less chance for data loss as contact details are kept away from users
- 63. BLOCKCHAIN Immutable, verifiable ledgerfor all transactions
- 64. AUTOMATE Anonymisation and DataLeakage Prevention
- 65. REGULAR EXPRESSIONS cat server.log |sed -r 's/([0-9]+).([0-9]+) .([0-9]+).([0-9]+)/1.xxx.xxx.4/g' -
- 66. DATA LOSS PROTECTION (DLP) Prevent leakageon company level
- 67.
- 68. EMAIL MARKETING My contactlist is the lifeline of our business!!!
- 69. CONTACT DATA Opt-in ,always
- 70. NOT OPT-IN /dev/null isthe place to be
- 71. RECAP ➤ Users givedata in trust: respect that ➤ Ensure private data is kept to a minimum and removed from view ➤ Protect your data by anonymization and remove from view interfaces ➤ Know that security is not enough: if you don’t have it, it can’t be stolen!
- 72.
- 73. in it2PROFESSIONAL PHPSERVICES Michelangelo van Dam Zend Certified Engineer contact@in2it.be - www.in2it.be - T in2itvof - F in2itvof Consulting Automation Training