CHAPTER 2: The Role of IT Privacy Flashcards
What is privacy notice
an external instrument that informs consumers, suppliers, business partners and individuals about the organization’s information privacy practices, values and commitments.
what is privacy policies
internal statements designed to communicate best privacy practices and what information handling guidelines to follow, and when, for those within an organization.
What are the legal and industry requirements regarding privacy notices that organizations should be aware of
o privacy policies: internal statements designed to communicate best privacy practices and what information handling guidelines to follow, and when, for those within an organization.
o Security policies: Adequate privacy protection of personal information is contingent on the quality of an internal security policy.
What is the purpose of security policies
prevents unauthorized or unnecessary access to corporate data or resources, including intellectual property, financial data and personal information.
what are the ways that measures are put in place to secure data.
o data schema: A data schema is used to separate customer information. It formulates all the constraints to be applied on the data, defines its entities and the relationships among them.
o data retention: A data schema is used to separate customer information. It formulates all the constraints to be applied on the data, defines its entities and the relationships among them.
o Data retention: Laws and regulations may require data to be stored for a specific amount of time.
o data deletion: When data is no longer needed, remove data and any derivatives from the system, ensuring that recovery methods are also removed
What is the purpose of data inventory in privacy IT
o Keeping an inventory of data, helps to protect privacy adequately. This means knowing what data is collected, how it is handled, where it is stored, and how it is classified.
o Analyzing and interpreting data so that it can be classified and organized into information categories is an essential step.
what are the categories of data inventory (type of assets)
o information assets: Customer and employee data as well as backup copies of data stored either on-site or off-site
o physical assets: Servers, workstations, laptops, portable storage devices, backup media, paper files
o intellectual property: software code, trade secrets
What are the 4 types of data classification in privacy IT
o Confidential: Information that should remain secure and private: customer information, employee Social Security numbers, payment account information
o Internal use: Business information intended for internal use only: company contact directories, business plans, sales forecasts, proprietary software codes
o Public: Information that can be safely shared with the public: physical address, marketing materials, customer service information
What is the purpose of contracts and agreements in organizations
o When collected data is shared with third-party vendors, it should be handled in accordance with the commitments made to the data subject and data owner regardless of where their personal information is located or how it is used.
o Third-party contracts should be detailed with clear expectations of how data is to be managed while in their possession as well as the roles and responsibilities of vendors.
What is privacy impact assessment (PIA)
o A privacy impact assessment (PIA) is an analysis of how personal information is handled throughout the data life cycle within an organization.
o A PIA ensures that organizations apply legal, regulatory and policy requirements regarding privacy, assesses privacy risks, and methods of risk mitigation
What are the examples of architecture in information security
Client-server architecture: the client refers to a program that runs on a local computer, while the server is a program that runs on a remote computer. This architecture allows storing data on the client side for the purpose of completing a transaction.
Service-oriented architecture: decouples services from the large-scale servers. It allows designers to replicate services across multiple machines
Plug-in-based architecture: Plug-in based architecture extends a user’s experience with a website via the use of an app platform, usually owned by a third party
What is the comprehensive organizational design in privacy IT
enterprise architecture
What is privacy incidents
any event that can affect the confidentiality, integrity or availability of the data
o When personally identifiable information is involved, then it is a privacy incident
o all data incidents are personal data incidents
List the elements of an effective incident response plan
Discovery: Actively monitoring system activity or suspicious changes to system activity is essential in detecting an incident that could lead to a breach.
Containment: A response plan should contain guidance on how to terminate an ongoing incident while preserving any evidence of the affected data and origin of the incident. Containment is key to stopping the threat before more damage is done. Do not wipe system logs. Remove and preserve affected systems from the network
Analyze and notify: For data breaches and other types of privacy incidents, notification laws vary among jurisdictions. To be prepared, an organization should know what their notification obligations are in such an event
Repercussions: Fines, lawsuits and nonmonetary repercussions often follow privacy incidents or breaches.
Prevention: Privacy incidents can be used as a learning tool to address holes in security and privacy procedures, review privacy policies to identify weaknesses and train employees as needed.
Third parties: Personal information in the hands of a third party, still falls under the responsibility of the organization in the event of a breach, including provisions that describe the expectations and obligations of the vendor should an incident occur.
What are the two systems development life cycle
Securely provision ,operate and maintain,) Protect and defend, and Protect and defend
