CIPT Flashcards
Accountability
The introduction of technical and organizational measures for appropriate handling of personal data according to the law, which is an idea mentioned in GDPR and the Fair Information Practice Principles.
Abstract
To restrict the level of detail shared when processing personal information.
Access control entry
An element that governs, oversees, or rec-ords access to an object by an identified user in an access control list.
Access control list
A list of access control entries that correspond to an object. This could be either discretionary, meaning controlling access, or system, meaning monitoring ac-cess via security event log or audit trail.
Active Data Collection
When an end user purposely provides information, usually through web forms, text boxes, check boxes, or radio buttons.
AdChoices
A Digital Advertising Alliance program that pro-motes awareness and choice for online adver-tising. Participating DAA members’ websites need an icon near their advertisements or the bottom of their pages. Users set preferences for behavioral advertising by clicking on the icon.
Adequate level of protection
Confirmation that a data transfer accounts for the rule of law and legislation, respect for human rights, data protection rules, professional rules and security measures, data subject rights, independent supervi-sory authorities, and any international commitments.
Advanced encryption standard
An encryption algorithm that the US government us-es for security sensitive non-classified material. NIST selected this algorithm in 2001 to replace the Data Encryption Standard (DES).
Adverse action
Any business, credit, or employment action that affects consumers negatively, such as denying or can-celing credit, insurance, employment, or promotion. A credit transaction where the consumer accepts a counteroffer would not count.
Agile development model
As opposed to the plan-driven development model, this process for software system and product design integrates new system requirements during the literal creation of the system, where specific portions are developed one at a time. The Scrum Model is one ex-ample.
Algorithm
A mathematical instruction applied to a set of data.
Anonymization
The process by which individually identifiable data is changed so that it can no longer be related back to any individual without affecting the usability of the data.
Anonymous information
Data that is not related to an identified or an identifi-able natural person, nor can it be combined with oth-er information to re-identify persons. Being made un-identifiable, it is not in scope for the GDPR.
Anthropomorphism
The act of placing human characteristics or behaviors on non-living things.
Anti-discrimination laws
Indications of special classes of personal data. If these exist based on a class or status, it is likely that the personal information is subject to more prescrip-tive data protection regulation.
Application or field encryption
The ability to encrypt certain regions of data, particu-larly sensitive data including health-related infor-mation.
Application-layer attacks
Attacks that take advantage of flaws in network server applications, which are present in applications such as web browsers, e-mail server software, and network routing software. Patches and updates to applications can help protect against such attacks.
Appropriation
Adopting one identity for another person’s uses.
Asymmetric encryption
A type of data encryption using two distinct but relat-ed keys to encrypt data: a public key for other par-ties, and a private key only for the first party. You need both keys to decrypt the data.
Attribute-based access control
A permission model for access control made by review-ing attributes given to users, data, and the context of requested access.
Audit trail
A track or record of electronic activity used for mon-itoring or validation in tracking customer activity or investigating cybercrimes.
Authentication
Determining whether an entity is who it claims to be.
Authorization
The process for deciding if the user should have access to a specific resource like an information asset or sys-tem containing and validating the identity of the user. The criteria could include things like organizational role, security clearance, and applicable law.
Automated decision making
The process of making a determination apart from human involvement.
Basel III
An inclusive list of reform measures created by the Basel Committee on Banking Supervision to build up the regulation, supervision, and risk management of the banking sector.
Behavioral advertising
Advertising targeted at individuals based on observa-tions about their activity over time, likely done via au-tomated processing of personal data, or profiling.
Big data
Large sets of information that organizations may collect due to the expansion of the amount and availability of data. It’s also referred to as “the three V’s”: volume, variety, and velocity, referring to the amount of data, the type of data, and the speed at which data can be processed.
Biometrics
Data that relates to the physical or behavioral charac-teristics of a person, for example fingerprints, voice, or handwriting. This is considered a special category of data with processing only permitted in certain cir-cumstances under GDPR.
Blackmail
The threat of sharing a person’s information against their wishes.
An
Breach disclosure
An organization must notify regulators and/or vic-tims of incidents that have impacted the confidenti-ality and security of personal data. This transparen-cy mechanism brings light to operational failures, helps mitigate harm, and assists in the identification of causes of failure.
Breach of confidentiality
Sharing a person’s personal information in spite of a promise otherwise.
Bring your own device
Allowing employees to use their own personal compu-ting device for work.
Browser fingerprinting
Differentiating between users from the instance of their browsers, which store information about webpages visited, making each unique due to ac-cess time and order.
Caching
Saving local downloaded copies so that there’s no need to keep downloading content, which should be prohibited on pages that display personal infor-mation.
California Online Privacy Protection Act
This act requires that all websites targeted to California citizens must provide a privacy statement to visitors with an easy-to-find link. Websites that collect personal data from individuals under 18 years of age must per-mit those children to delete their data. Websites are required to inform visitors of which Do Not Track mechanisms they support, if any.
CCTV
An acronym for “closed circuit television” which has become shorthand for any video surveillance sys-tem. These can be hosted via TCP/IP networks and accessed remotely, and the footage very easily shared.
Chat bots
Automated intelligence that mimics human interac-tions and can be used for simple customer requests and interactions.
Children’s Online Privacy Protection Act (COPPA)
Choice
U.S. federal law applying to operators of commercial websites and online ser-vices either directed to children under the age of 13 or known to collect per-sonal information from children under the age of 13. Operators are required under this law to post a privacy notice on the website, provide notice about collection practices to parents, obtain verifiable parental consent before col-lecting personal information of children, give parents the choice about wheth-er their child’s personal information will be shared with third parties, provide parents with rights to access, delete, and opt out of future collection or use of the information, and maintain the confidentiality, security and integrity of children’s personal information.
Choice
The concept that consent must be freely provided and data subjects have a true choice whether to provide personal data, without which it is unlikely the consent would be considered valid under GDPR.
Ciphertext
Data that is encrypted.
Cloud computing
Provisioning information technology services online from a third-party supplier or by a company for its in-ternal users. The services could be things like software, infrastructure, platforms, or hosting, with applications like email or data storage.
Code audits
The analysis of source code’s discovery of flaws, se-curity breaches, or violations in the technology eco-system.
Code reviews
Reports organized by code authors with a reader, moderator, and privacy specialist.
Collection limitation
The fair information practices principle which says that there should be limits in the collection of personal da-ta, where data should be gathered by fair and lawful means with the knowledge or consent of the data sub-ject.
Communications privacy
The class of privacy that encompasses protection of the means of correspondence, including mail, phone conversations, and email.
Completeness arguments
Assertions used to confirm compliance with privacy rules and policies in the design of new software sys-tems, where privacy rules are compared to the re-quirements used for a software system. This accounts for necessary technical safeguards and prohibits de-sign that would violate privacy regulations.
Computer forensics
Searching an information system for relevant clues after a compromise of security.
Concept of operations
An outline for the functionality of a software product or system as used in plan-driven development models to project design and implementation.
Confidentiality
The principal that data should be protected against unauthorized or unlawful processing.
Consent
The confirmation of an individual’s agreement to the collection, use, and disclosure of their personal data. There are two thoughts on this: opt-in (making an affirmative action) and opt-out (implied by lack of ac-tion).
Content delivery network
The servers containing the visible elements of a web page which would be signaled for those elements. In advertising, a general ad server would be signaled after a webpage is requested and search for information on the user trying to access the webpage.
Context aware computing
When a device adapts to its environment by changing location, video, audio, or brightness.
Context of authority
Resource access control on a network depends on the context in which the employee connects to the net-work.
Contextual advertising
Advertising using content from a visited webpage or user query. It’s a widely used form of online targeted advertising.
Contextual integrity
A way of ranking potential privacy risks in software systems and products considering how the product or system compares to consumer expectations. If a product or system differs from expectations, it’s possible that the consumer may perceive a privacy harm.
Cookie
A small text file stored on a client machine to be re-trieved by a web server. These keep track of the end user’s browsing activities and pool individual requests into sessions. They also allow users to stay signed in. Types include first party, third party, session, and per-sistent. Consent is required before collecting.
Coupling
The connection between objects within a technology ecosystem which controls the flow of information. Fo-cusing makes objects depend on the connection to other objects, while loosening eases the dependency, isolating processing to a specific group of classes and reducing the chance of accidentally re-purposing infor-mation.
Cross-site scripting
Code input by malicious web users into web pages that other users will view.
Cryptography
Hiding information, usually by transforming it with encryption, such as digital signature, or non-repudiation.
Cryptosystem
The information required to encrypt and decrypt a particular message, most often the encryption algorithm and the security key.
Customer access
A customer’s right to access, review, correct, and de-lete the personal information collected about them.
Customer data integration
The combination and management of all customer in-formation, a key element of customer relationship management.
Customer information
As opposed to employee information, this is data concerning the clients of private-sector organizations, healthcare patients, and the general public in relation to public-sector agencies.
Cyberbullying
Releasing a person’s private information or re-characterizing the individual online.
Dark patterns
Habitual means to mislead individuals into sharing personal information.
Data aggregation
Combining data sets to analyze trends while maintaining individual privacy using groups of individuals with similar characteristics. The data set needs to come from a large number of individuals, be broadly categorized, and exclude data unique to a single individual.
Data breach
The unauthorized collection of computerized data that interrupts the security, confidentiality, or integrity of personal information maintained by a data col-lector.
Data centers
Facilities where data and critical systems are stored and managed, either centralized for one organization’s data management needs or operated by a third-party provider.
Data controller
The natural or legal person, public authority, agency or any other body who alone or together decides the intentions and means of personal data processing.
Data elements
A piece of data with a distinct definition which can’t be whittled down further. Examples include date of birth, numerical identifier, or location coordinates. In isolation these may not be considered personal data but they would be when combined.
Data flow diagrams
A graphical depiction of how data flows in an information system and how the system runs to fulfill its purpose. These would be used by systems analysts creating information systems and management recreating the flow of data within organizations.
Data loss prevention
A term for the strategy to keep end users from sharing sensitive information with external ineligible sources and the software systems that help control what data end users can transfer.
Data masking
The means of de-identifying, anonymizing, or other-wise obscuring data to retain the structure but re-move the sensitivity of the content to create a data set for training or software testing.
Data matching
Comparing personal data collected from multiple sources to make decisions about the identified individuals.
Data minimization
The idea that data controllers would simply collect and process personal data that is relevant, necessary, and adequate to fulfill the specified purposes.
Data processing
Any operation or set of operations performed on personal data including alteration, collection, recording, restriction, storage, use, retrieval, disclosure, dissemination, combination, organization, erasure, or destruction, whether by automated means.
Data processor
The natural or legal person public authority, agency or other body not employed by the controller who processes personal data as instructed by the controller.
Data Protection Authority
Independent public authorities that oversee the application of data protection laws in the EU through guidance on data protection issues and complaints made by individuals of GDPR violations. One per EU member state with extensive enforcement power to impose fines of up to 4% of a company’s global annual revenue.
Data quality
The fair information practices principle that says personal data should be relevant, accurate, up-to-date, and complete. Four questions to consider: does it meet the business needs; is it accurate; is it complete; and is it recent?
Data recipient
The natural or legal person, public authority, agency, third party, or another body getting personal data by disclosure. This would not apply to public authorities getting personal data in the context of an EU or member state law inquiry.
Data schema
All of the constraints, entities, and relationships used to separate customer information.
Data subject
An identified or identifiable natural person about whom the organization has personal information.
Declared data
Personal information shared on a social network or website.
Deep learning
A subset of artificial intelligence and machine learning where tasks are performed repeatedly with increasing layers of data.
Demographic advertising
Online advertising based on an individual’s age, height, weight, geographic location, or gender.
Design patterns
Shared solutions to recurring problems which enhance program code maintenance by applying a common mental measure.
Design thinking process
A five-phase process of empathize, define, ideate, pro-totype, and tested, used alongside value-sensitive de-sign.
Differential identifiability
Establishing rules that limit the confidence that an in-dividual has assigned to an aggregated value.
Digital Advertising Alliance
A non-profit organization that creates standards for consumer privacy, transparency, and control in online advertising and enforces the self-regulatory standards created by the Digital Advertising Alliance including AdChoices.
Digital fingerprinting
Using log files to identify a website visitor, mostly for security and system maintenance purposes. A log file is typically made up of the IP address, a time stamp, the URL of the requested page, a referrer URL, and the visitor’s web browser, operating system, and font preferences.
Digital rights management
Overseeing access to and use of digital information and devices after sale. Usually done using access con-trol (denial) technologies for defending copyrights and intellectual property, claims that may be considered controversial because they prevent users from lawful use of the information and devices.
Digital signature
A means of ensuring the legitimacy of an electronic document, such as an e-mail, text file, spreadsheet or image file, so that anything added afterward makes it invalid.
Directive on privacy and electronic communications act 2002/58EC
A policy directive for the EU Member States recognizing how cookies help modern websites function and the user’s right to opt out. It was amended by the Cookie Directive 2009/136EC, which added a requirement for all websites using tracking cookies to obtain user consent unless the cookie is “strictly necessary.”
Disassociability
Reducing connections between data and individuals as much as possible in relation to the system opera-tional requirements.
Discretionary access control
A type of access control that permits the owner of an object to approve access to a computer-based information system.
Distortion
Disseminating false or incorrect information about someone.
Demilitarized Zone Network
A firewall configuration to protect local area net-works with a number of computers acting as a broker for traffic between the LAN and the external network.
Do Not Track
A potential policy allowing consumers the right to opt out of web tracking, in the same vein as the existing US Do-Not-Call Registry.
E-commerce websites
Websites offering online ordering, which allows access to information related to user purchases and payments for targeted advertising.
Electronic communications data
Defined by the ePrivacy Directive to include the content of a communication, traffic data, and location data.
Electronic communications network
Things that would fall under this definition include net-works used for radio and television broadcasting; trans-mission systems, switching or routing equipment, and other resources that send signals by electromagnetic means; electricity cable systems; fixed and mobile terrestrial networks; and cable television networks.
Electronic communications service
Any service allowing users to send or receive wire or electronic communications.
Electronic surveillance
Digital monitoring, such as location-based services, stored communications, or video surveillance.
Encryption
Obscuring information so that it can’t be read without a key or other specific knowledge, usually with a cryptographic scheme.
Encryption key
A cryptographic algorithm used on plain text to mask value or used on encrypted text to make it plain again.
End-user license agreement
A contract made between the user and the software application owner where the user promises to pay for the use of the software and comply with any restrictions.
Enterprise architecture
An abstract outline or blueprint of the structure and operation of an organization, usually in an effort to achieve current and future goals.
EU Data Protection Directive
The first EU-wide legislation protecting personal data use and privacy which was adopted in 1995 and re-placed by GDPR in 2018.
Exclusion
Denying an individual knowledge about or participation in data processing.
Exposure
Sharing information that would normally be kept private, including physical details about bodies.
Extensive markup language
Also referred to as XML, this markup language allows for the transport, creation, retrieval and storage of files from tags that identify the contents. The content of a web page is described in terms of the data produced as opposed to how it should be displayed, which is done in HTML.
