Manejo de privacidad

1. Managing Privacy RiskManaging Trust? Víctor Chapela – Sm4rt Nathaly Rey – ISMS Forum Spain

2. Privacy Origin Human Rights The right to a dignified life Legal order independence Universal Declaration of Rights (1942) Right to intimacy Information self-determination / Privacy

3. What do we understand by Privacy? Having control over my personal information The ability to limit: Who keeps it What can be done with it Purposes of use

4. Privacy in the World

5. Legal and Institutional Frameworks International: Standardization efforts European: Under revision US: Consumer Protection approach Canada: Sector based approach Latin America: European Model? Others

6. Privacy Regulatory Overview EU USA EU“light” Hábeas Data Four Main Groups

7. Universally Accepted Privacy DirectivesMadrid Conference: Privacy and Data Protection Authorities of the 5 continents

8. Principles Lawfulness and fairness Purpose specification Openness (Information) Proportionality Data quality Accountability

9. Legitimacy of Processing Consent Sensitive Data Provision of processing services International transfers

10. Rights Access Rectify Delete Opposition

11. Monitoring and Liability

12. Proactive Measures

13. Chief Privacy Officer What is a Chief Privacy Officer? Which is his place in the organization? Solid knowledge and ample experience Certified Data Privacy Professional

14. Risk Management 14

15. Risk Management Audit Independence Qualified expert

16. Privacy Impact Analysis

17. Mexico’s Privacy Law ü ü ü ü ü

18. Specific Aspects and Challenges Specific Aspects Financial Data Auto-regulation Criminal charges Fines up to US $2.8M Challenges Privacy Notice: proof Strategy for compliance Privacy Awareness

19. Link between Privacy and Security

20. Why isPrivacy agrowing concern?

21. How can we understand Digital Risk?

22. 3 Types ofDigital Risk Accidental Opportunistic Intentional 3. Intentional

23. Intentional Digital Risk = Threat x Vulnerability

24. Threat hasincreasedgeometrically!

25. Vulnerabilities areincreasing exponentially!!

26. Digital Risk = Threat x Vulnerability Threat

27. Perceived Risk is Reduced

28. We all feel anonymous!This is true for criminals as well…

29. Without risk we all become lawbreakers!

30. By reducing the risk of breaking the law, everyone’s risk has grown

31. Profitability = Return / Risk

32. We are arriving at a new balance Profit Risk

33. Much more illegal money to be made!

34. Threathasincreasedgeometrically

35. Digital Risk = Threat x Vulnerability Vulnerability

36. Wehavelost Control

37. Computers used to be deterministic

38. Our digitalWorld hasbecome Undeterministic

39. Computers have become so complex they are not predictable any more

40. We rebootas a way to return to a known state

41. In chaotic systems we can only predict the first fewiterations

42. Networks increase complexity

45. 36 Nodes 630 Connections 2,783,137,628,160 Sockets

46. Moredevices = even moreconnections

47. Connections Grow Exponentially

48. Network connection growth creates Value

49. Butitalso increases Complexity

50. Complexity andUnpredictability increaseFrustration

51. Risk As well as

52. How doesDigital Risk affectPrivacy?

53. Reduced Privacy risk perception

54. TheNature of Privacy Risk isnot new

55. Privacy Risk hasincreased because of4 aspects

56. 1. Speed

57. It use to take days or weeks for information to be shared

58. Now it is instantaneous!

59. 2. Dispersion

60. The same people that would keep our secrets…

61. … are now becoming digital information broadcasters

62. Every single tweet is received in average by over 487 people The most retweeted message was received by more than 24 million accounts

63. 3. Persistence

64. We used to easily control, restrict access and destroy physical copies of our personal data

65. Source: http://www.civic.moveon.org/facebook/chart/

66. 4. Clustering

67. Our files used to be difficult toaccess

68. Now it is all clusteredandavailable worldwide

69. Therefore, if you were caught at an inconvenient state…

70. …your girlfriend would have immediate access…

71. … as well as all her friends…

72. …probably, forever!

73. So yes, privacy is a growing concern And not only at a reputational level

74. Privacy is always a risk for INDIVIDUALS An organization’s risk always translates to individual stakeholder risks Employees get fired Users or customers are damaged Shareholders lose money

75. Two types of Privacy Intimacy Identity

76. Intimacy Ethnic origin or race Health Religious, philosophical and moral beliefs Syndicate affiliation Political views Sexual preference

77. Identity Name and address e-Mail Location Biometrical readings Payment card number User and password Behavioral information

78. Two types of Privacy Intimacy Perception <- Trust Regulation Compliance Identity Perception <- Trust Information Value

79. The most valuable piece of our personal information is our Identity

80. Most valuable, for others!

81. 2009 Data Breach Investigations Report Verizon Business RISK Team

82. 98% Payment Card Data

83. 1.5% Other Personal Information

84. Information posted for Sale Rank % Information 23% CVV2 Numbers 18% Credit Card Numbers 15% Credit card expiration dates 12% Addresses 11% Phone numbers 6% Email addresses 5% PIN for credit or debit cards 4% Social Security numbers 4% Full names 2% Dates of birth http://www.symantec.com/business/theme.jsp?themeid=threatreport

86. How was this data stolen?

87. 2/3 Hacking

88. 1/3 Malware

89. Malware

90. Hacking

91. 79% SQL Injection

95. Credit or Debit Cards

96. and OnlineBanking

97. Personal Information

98. Are both part of IdentityTheft

99. Over100billion per year in losses

100. 300% yearly growth rate

101. Two types of Privacy Intimacy Privacy Regulation Risk Management Identity Value Based Risk Management

102. They are divided into two groups: Redundancy Availability? Business Impact BIA Filters andAuthentication Confidentiality and Integrity? Market Value IVA

103. Information Value Analysis Information Risk= Impact x Probability Impact is determined by estimatingEconomic Value Probabilityismeasured by calculating Potential Connections

104. How tocalculateinformation value?

105. Intentionality Information Assets Information User Profiles Potential Losses Possible Attacks High Risk Nodes EconomicValue Access to High Risk Nodes Attacker Profit Known Attacks

107. We need to accept Risk Potential moves are infinite

108. Highly Dynamic Environment

109. Theboard changes daily

110. ThePieceschange daily

111. Therules change daily

112. Players change daily

113. TheEnd justifies theMeans In preventing Intentional Risk nothing less than securing allvectors is enough

114. Defense must be Optimized

115. Optimize Speed

116. Optimize Resources

117. Value Management Method Possible Incidents Real Incidents Applicable Incidents Recurring Incidents Measurement of Added Value Prioritized Incidents

118. This is how we estimate threatandImpact

119. How are probability andVulnerabilitycalculated?

120. Assets& Account Profiles

121. Assets & Account Profiles

122. COBIT Risks EfectividadEficienciaConfidencialidadIntegridadDisponibilidadCumplimientoConfiabilidad Business Requirements AplicacionesInfraestructuraInformaciónPersonas DOMINIOS PROCESOSACTIVIDADES IT Resources IT Processes Nodes Connections

123. Types ofNodes Information User Connection Information Node User Node Transfer Process Store Consult

124. NodeGrouping User Profiles

125. Graph Segmentation

126. Connection Measurement

127. Redundancy Availability? Business Impact Assets Filters andAuthentication Confidentiality and Integrity? Market Value Assets Accounts

128. Monitoring is also Required Availability? Business Impact Monitoring & Response Assets Confidentiality and Integrity? Market Value AssetsProfiles

129. Identity is the key to better risk management

130. Default Close Default Open Availability Confidentiality

131. Focus controls on main risks

132. Determinewhich nodes tomonitor

133. Redundancy Activos Monitoring Filtering &Authenticacion Risk Operation Center

134. RiskAnalysis

135. Always R1 Weak password storage protocol R5 R2 R2 Absence of robust password policy R3 Absence of data entry validation for web applications R3 R4 Possible Probability R1 R6 R4 Existing applications with vulnerable remote support R5 Weak wireless ciphered communication protocol R6 Absence of operating system security configuration Almost never Very high Insignificant Medium Impact Main Risks

136. Quick Hits High S1 S2 Password Policy S5 S4 S2 Migration of wireless communication protocol Strategic Quick Hits S6 S3 S1 Strategic S7 S3 Security configuration guidelines for applications Moderate Positive Impact of Implementation S4 Security configuration guidelines for operating systems Not Viable Nice To Have S5 Migration of passwords storage protocols S6 Secure application development process Minimum S7 Migration of remote support protocol Minor Medium Major Effort Action Plan

137. Procesos Gente Tecnología Policies and Configuration Guidelines S3 Security configuration guidelines for applications S4 Security configuration guidelines for operating systems Governance S1 Password policy Processes and Roles S1 Superior Technologies User controls S7 S8 S0 S9 Migration of remote support protocols Network controls S5 Migration of password storage protocols S2 Migration of wireless communication protocols S2 Host controls S4 S5 Recommendations for Sustainability Application controls S3 4 S7 S8 Secure change process administration Data level controls S9 Risk administration process S0 Vulnerability patches and updates process S6 Secure application development process Recommendations

138. Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Risk Administration Implementation Secure application development implementation Vulnerability patches and updates process administration Secure change process administration Migration to robust remote support protocols Migration of wireless communication protocol Migration of password storage Password policy Security configuration guidelines for operating system Security configuration guidelines for applications 2010 2011 Mitigation Roadmap

139. Demystifying the Privacy Implementation Process Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

140. Business Process Analysis Business Process Analysis Data Lifecycle Inventory Identification of applicable Law Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

141. Business Process Analysis Stakeholder Information acquisition Types of data Internal and external data flows Purpose of treatment Information systems and security measures Retention policies Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

142. Data Lifecycle Inventory Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

143. Privacy Legal & Regulatory Requirements (PIA) 1. Legal & Regulatory Contracts Clauses Privacy notices Authorizations Jurisdictions Other regulations Money laundering Sectorial Etc. Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

144. Privacy Legal & Regulatory Requirements (PIA) 2. Technical Authentication & authorization Access control Incident log Removable media and document management Security copies Recovery tests Physical Access Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

145. Privacy Legal & Regulatory Requirements (PIA) 3. Organizational Data privacy officer Roles and responsibilities Policies, procedures and standards Notifications to authorities Audits Compliance and evidence Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

146. Legal & Regulatory Data Categories High Risk Syndicate Affiliation Health Sexual life Beliefs Racial Origin Medium Risk Financial Profile Personal Fines Credit Scoring Tax Payment Information Basic Risk Personal Identifying Information Employment Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

147. External Economic Data Value (IVA) Black Market Value Sale price News Value Newspaper Magazines Television Competition Market Value Brand Value Political Value Authorities Fines Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

148. Data Value Categories Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

149. Asset Inventory Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

150. Policy Generation How should this data be: generated? stored? transferred? processed? accessed? backed-up? destroyed? monitored? How should we react and escalate an incident or breach? How will we punish compliance? Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

151. Controls, Standards & Procedures Business Process Analysis Data Lifecycle Inventory Controls are defined and mapped for each policy level Technical Standards Procedures Compensatory Controls Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

152. Controls, Standards & Procedures Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

153. Implementation & Audit Business Process Analysis Data Lifecycle Inventory BestPractices Laws and Regulations Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory PROCESSES Policy Generation APPLICATIONS PEOPLE Controls Controls, Standards, Procedures Evidence Implementation & Audit I.ACT D.SEG LOPD SOX LSSI ASSETS NETWORKS COMUNIC. CONTRACT

154. Implementation & Audit Business Process Analysis Data Lifecycle Inventory Data Value (IVA) Legal & Regulatory Requirements (PIA) Data Categories Data Categories Asset Inventory Policy Generation Controls, Standards, Procedures Implementation & Audit

155. RegulatoryRisk Management Types Impact Fines Reputation Image Good Corporative Governance Laws and norms Indemnities Client Forfeits Internal Operative Improvement Contracts Risk Management Competitive Difference Business Continuity Guarantee Standards and Codes Stockholder trust Corporative Culture Fight Internalfraud Internalpolicies 155

156. How can Privacy Risks be classified? Economic Operational Reputational Competition

157. Quick tips Doing International Business What to watch out for? Localization Local regulations Due diligence Audit Monitoring Contact with authorities Jurisdiction

158. Non compliance TOP 5 Employee awareness Lack of transparency Third parties Intercompany data flows Collection of unnecessary information

159. Two types of Privacy Intimacy Privacy Regulation Compliance Identity Information Value Risk Management

160. 3 Main Aspects of Privacy Legal Organizational Technical

161. Privacy is not only about Compliance! Through Privacy we guarantee individual rights. By doing so, we increase stakeholder trust and increase our competitiveness.

162. Privacy Risk Management: Stakeholders Trust Management “Trust is the belief that a person or group will be able or willing to act an adequate and predictable manner under certain situations.”

163. Thank you! Víctor Chapela Nathaly Reyvictor@sm4rt.com nrey@ismsforum.es