Chapter 5 - Privacy Operational Lifecycle - Protect

Question 1

What are the 7 foundational principles of PbD

Answer 1

1. Proactive not reactive
2. Privacy as the default
3. Privacy embedded into design
4. Full functionality - positive sum not zero sum
5. End to end security
6. Visibility and transparency
7. Respect for user privacy

Question 2

What is data protection by design and default?

Answer 2

This is the GDPR standard under Article 25 and recital 78. It is similar to PbD

Question 3

What does Data Protection by Design and Default mandate?

Answer 3

Taking into account state of the art, organisations should implement appropriate technical and organisational measures in order to implement data protection principles. This could include pseudonymisation, transparency, enabling data subject to monitor processing, etc

Question 4

What are the GDPR Principles

Answer 4

Lawfulness, fairness and transparency
Purpose limitation
Data minimisation
Accuracy
Storage limitation
Integrity and confidentiality
Accountability

LPD ASIA

Question 5

What are the aims of information security practices

Answer 5

To ensure information is kept with confidentiality, integrity and availability (CIA).

Question 6

What are listed InfoSec risk as highlighted by Security Boulevard

Answer 6

1. Cloud based
2. Insider threads
3. End point threats
4. Deep fakes
5. Living off the land attacks
6. Ransomware
7. Phishing
8. Malvertising
9. Social media attacks
10. IoT

Question 7

What are the categories of InfoSec controls

Answer 7

1. Preventative
2. Detective
3. Corrective

And

1. Physical
2. Administrative
3. Technical

Question 8

What are the key InfoSec control measures

Answer 8

1. Policies
2. Org structure
3. Asset management
4. Access control
5. Cryptography
6. Physical security and controls
7. Operational security
8. Systems acquisition and maintenance
9. Communications security
10. Supplier relationships
11. Compliance program

Question 9

What are 3 key differences between data privacy and Information Security?

Answer 9

1. Infosec concerned about confidential information mostly, whereas data privacy concerned with PII even if public (ie phone booth)
2. Data privacy with wider set of responsibilities outside of just security
3. At times infosec tools can become overly invasive and limit privacy

Question 10

What are the basic principles for RBAC

Answer 10

1. Segregation of duties
2. Least privilege
3. Need to know access

Question 11

What are the principles behind user access management

Answer 11

1. Unique ids (no group emails)
2. Credentials for ID (ie 2FA)
3. Access tied to role
4. Formal process for granting and removing
5. Password management
6. User account review
7. User responsibility
8. Good security practice
9. Clean desk policy

Question 12

What 4 areas do technical controls to implement privacy measures fall into

Answer 12

1. Obfuscation
2. Minimisation
3. Security
4. PETs