Module 2: The role of the technology professional in privacy

Question 1

Privacy policies

Answer 1

Inform employees about privacy, security, data management, and loss prevention
Must be documented, accessible, current, endorsed, and enforced

Question 2

Security Policies

Answer 2

Data classification policies, data schema, data retention, data deletion

Question 3

Data Inventories

Answer 3

Assets: Information, Physical, Intellectual
Classifications: Confidential, Internal use, public

Question 4

Contracts and agreements

Answer 4

Expectations, Obligations, Audits, Compliance

Question 5

Privacy technologists:

Answer 5

Risk analysis, Data separation, Data schemas, Require term acceptance

Question 6

Privacy Impact Assessments

Answer 6

Ensure compliance, assess privacy risk, recommend methods for risk mitigation

Question 7

Transactions for confidential data

Answer 7

Client-server architecture
Service-oriented architecture
Plug-in-based architecture

Question 8

Breach Incident Response:

Discovery

Answer 8

Active monitoring of system activity or suspicious changes, detect tampering
Users can report suspicious activity

Question 9

Breach Incident Response:

Containment

Answer 9

Terminate the ongoing incident and preserve evidence
Ensure containment
Do not wipe system logs
Remove affected systems 
Fully document your investigation 
Have a contingency plan

Question 10

Breach Incident Response:

Analyze and notify

Answer 10

Know data breach notification obligations
Consult legal counsel to advise the response team
Notify individuals and/or public

Question 11

Breach Incident Response:

Repercussions

Answer 11

Media coverage results in decrease in business and loss of consumer trust
Security analyst must report to senior management
Technology person must diagnose the incident, mitigate the issue, and provide information

Question 12

Breach Incident Response:

Prevention

Answer 12

Learning tool: address holes in procedures, review privacy policies to identify weaknesses, train employees

Question 13

Breach Incident Response:

Third parties

Answer 13

Set responsibility of org and expectations/obligations of the vendor regarding personal information

Question 14

Security and privacy in SLDC

Answer 14

Securely provision, operate and maintain, protect and defend, investigate

Question 15

Privacy responsibilities

Answer 15

Risk forecasting, Process support, privacy support, compliance, risk mitigation, maintenance

Question 16

Information governance framework

ITIL

Answer 16

Governed and owned by AXELOS. Provides an overall measurable view of a technology system, service and functionality. ITIL reports on services provided by the technology system and helps organizations use technology to support change and growth. It has limited view of risk management.

Question 17

Information governance framework COBIT

Answer 17

A more comprehensive program that helps with management of technology system that allows for tech governance. Tech governance focuses on the systems, application and support personnel that manage data in a company.