Meer over William Stallings

William Stallings

Information Privacy Engineering and Privacy by Design

Name: Information Privacy Engineering and Privacy by Design
Author: William Stallings

Understanding Privacy Threats, Technology, and Regulations Based on Standards and Best Practices

Specificaties

E-book, blz. | Engels

Pearson Education | 2019

ISBN13: 9780135278376

Rubricering

Pearson Education e druk, 2019 9780135278376

Verwachte levertijd ongeveer 9 werkdagen

68,19

In winkelwagen

Samenvatting

Organisations of all kinds are recognising the crucial importance of protecting privacy. Their customers, employees, and other stakeholders demand it. Today, failures to safeguard privacy can destroy organisational reputations — and even the organisations themselves. But implementing effective privacy protection is difficult, and there are few comprehensive resources for those tasked with doing so. In Information Privacy Engineering and Privacy by Design, renowned information technology author William Stallings brings together the comprehensive and practical guidance you need to succeed. Stallings shows how to apply today’s consensus best practices and widely-accepted standards documents in your environment, leveraging policy, procedures, and technology to meet legal and regulatory requirements and protect everyone who depends on you. Like Stallings’ other award-winning texts, this guide is designed to help readers quickly find the information and gain the mastery needed to implement effective privacy.
Coverage includes: Planning for privacy: approaches for managing and controlling the privacy control function; how to define your IT environment’s requirements; and how to develop appropriate policies and procedures for it Privacy threats: Understanding and identifying the full range of threats to privacy in information collection, storage, processing, access, and dissemination Information privacy technology: Satisfying the privacy requirements you’ve defined by using technical controls, privacy policies, employee awareness, acceptable use policies, and other techniques Legal and regulatory requirements: Understanding GDPR as well as the current spectrum of U.S. privacy regulations, with insight for mapping regulatory requirements to IT actions

The full text downloaded to your computer

With eBooks you can: search for key concepts, words and phrases make highlights and notes as you study share your notes with friends

eBooks are downloaded to your computer and accessible either offline through the Bookshelf (available as a free download), available online and also via the iPad and Android apps.

Upon purchase, you will receive via email the code and instructions on how to access this product.

Time limit

The eBooks products do not have an expiry date. You will continue to access your digital ebook products whilst you have your Bookshelf installed.

Specificaties

ISBN13:9780135278376

Taal:Engels

Bindwijze:e-book

Uitgever:Pearson Education

Inhoudsopgave

Preface     xxii PART I:  OVERVIEW     1 Chapter 1:  Security and Cryptography Concepts     2 1.1 Cybersecurity, Information Security, and Network Security     2     Security Objectives     3     The Challenges of Information Security     5 1.2 Security Attacks     6     Passive Attacks     8     Active Attacks     8 1.3 Security Services     10     Authentication     10     Access Control     11     Data Confidentiality     11     Data Integrity     11     Nonrepudiation     12     Availability Service     12 1.4 Security Mechanisms     12 1.5 Cryptographic Algorithms     13     Keyless Algorithms     14     Single-Key Algorithms     14     Two-Key Algorithms     15 1.6 Symmetric Encryption     15 1.7 Asymmetric Encryption     17 1.8 Cryptographic Hash Functions     20 1.9 Digital Signatures     22 1.10 Practical Considerations     23     Selection of Cryptographic Algorithms and Key Lengths     23     Implementation Considerations     24     Lightweight Cryptographic Algorithms     24     Post-Quantum Cryptographic Algorithms     25 1.11 Public-Key Infrastructure     25     Public-Key Certificates     25     PKI Architecture     27 1.12 Network Security     29     Communications Security     29     Device Security     30 1.13 Key Terms and Review Questions     30     Key Terms     30     Review Questions     31 1.14 References     31 Chapter 2:  Information Privacy Concepts     32 2.1 Key Privacy Terminology     32 2.2 Privacy by Design     35     Privacy by Design Principles     35     Requirements and Policy Development     37     Privacy Risk Assessment     37     Privacy and Security Control Selection     39     Privacy Program and Integration Plan     40 2.3 Privacy Engineering     41     Privacy Implementation     44     System Integration     44     Privacy Testing and Evaluation     45     Privacy Auditing and Incident Response     45 2.4 Privacy and Security     46     Areas of Overlap Between Security and Privacy     46     Trade-Offs Between Security and Privacy     48 2.5 Privacy Versus Utility     48 2.6 Usable Privacy     49     Users of Privacy Services and Functions     50     Usability and Utility     50 2.7 Key Terms and Review Questions     50     Key Terms     50     Review Questions     51 2.8 References     51 PART II:  PRIVACY REQUIREMENTS AND THREATS     53 Chapter 3:  Information Privacy Requirements and Guidelines     54 3.1 Personally Identifiable Information and Personal Data     55     Sources of PII     57     Sensitivity of PII     58 3.2 Personal Information That Is Not PII     59 3.3 Fair Information Practice Principles     63 3.4 Privacy Regulations     66     European Union     66     U.S. Privacy Laws and Regulations     67 3.5 Privacy Standards     68     International Organization for Standardization (ISO)     69     National Institute of Standards and Technology     77 3.6 Privacy Best Practices     88     Information Security Forum (ISF)     88     Cloud Security Alliance (CSA)     90 3.7 Key Terms and Review Questions     91     Key Terms     91     Review Questions     91 3.8 References     92 Chapter 4:  Information Privacy Threats and Vulnerabilities     94 4.1 The Evolving Threat Environment     95     Overall Impact of Advances in Technology     95     Repurposing Collected Data     96     Means of Collection of PII     96 4.2 Privacy Threat Taxonomy     97     Information Collection     98     Information Processing     98     Information Dissemination     98     Invasions     99 4.3 NIST Threat Model     100 4.4 Threat Sources     105 4.5 Identifying Threats     106 4.6 Privacy Vulnerabilities     108     Vulnerability Categories     108     Location of Privacy Vulnerabilities     109     National Vulnerability Database and Common Vulnerability Scoring System     110 4.7 Key Terms and Review Questions     114     Key Terms     114     Review Questions     115 4.8 References     116 PART III:  TECHNICAL SECURITY CONTROLS FOR PRIVACY     117 Chapter 5:  System Access     118 5.1 System Access Concepts     119     Privileges     119     System Access Functions     120     Privacy Considerations for System Access     121 5.2 Authorization     122     Privacy Authorization     123 5.3 User Authentication     124     Means of Authentication     125     Multifactor Authentication     126     A Model for Electronic User Authentication     127 5.4 Access Control     129     Subjects, Objects, and Access Rights     130     Access Control Policies     131     Discretionary Access Control     131     Role-Based Access Control     133     Attribute-Based Access Control     135 5.5 Identity and Access Management     140     IAM Architecture     140     Federated Identity Management     142 5.6 Key Terms and Review Questions     144     Key Terms     144     Review Questions     145 5.7 Reference     145 Chapter 6:  Malicious Software and Intruders     146 6.1 Malware Protection Activities     147     Types of Malware     147     The Nature of the Malware Threat     149     Practical Malware Protection     150 6.2 Malware Protection Software     153     Capabilities of Malware Protection Software     153     Managing Malware Protection Software     154 6.3 Firewalls     155     Firewall Characteristics     155     Types of Firewalls     156     Next-Generation Firewalls     163     DMZ Networks     164     The Modern IT Perimeter     165 6.4 Intrusion Detection     166     Basic Intrusion Detection Principles     167     Approaches to Intrusion Detection     167     Host-Based Intrusion Detection Techniques     169     Network-Based Intrusion Detection Systems     169     IDS Best Practices     171 6.5 Key Terms and Review Questions     172     Key Terms     172     Review Questions     173 6.6 References     174 PART IV:  PRIVACY ENHANCING TECHNOLOGIES     175 Chapter 7:  Privacy in Databases     176 7.1 Basic Concepts     178     Personal Data Attributes     179     Types of Data Files     180 7.2 Re-Identification Attacks     183     Types of Attacks     184     Potential Attackers     186     Disclosure Risks     186     Applicability to Privacy Threats     187 7.3 De-Identification of Direct Identifiers     188     Anonymization     189     Pseudonymization     189 7.4 De-Identification of Quasi-Identifiers in Microdata Files     190     Privacy-Preserving Data Publishing     192     Disclosure Risk Versus Data Utility     193     PPDP Techniques     194 7.5 K-Anonymity, L-Diversity, and T-Closeness     196     K-Anonymity     196     L-Diversity     198     T-Closeness     199 7.6 Summary Table Protection     199     Frequency Tables     200     Magnitude Tables     203 7.7 Privacy in Queryable Databases     204     Privacy Threats     205     Protecting Queryable Databases     206 7.8 Key Terms and Review Questions     211     Key Terms     211     Review Questions     212 7.9 References     212 Chapter 8:  Online Privacy     214 8.1 The Online Ecosystem for Personal Data     215 8.2 Web Security and Privacy     217     Web Server Security and Privacy     218     Web Application Security and Privacy     219     Web Browser Security and Privacy     222 8.3 Mobile App Security     224     Mobile Ecosystem     224     Mobile Device Vulnerabilities     225     BYOD Policies     227     Mobile Application Vetting     229     Resources for Mobile Device Security     230 8.4 Online Privacy Threats     231     Web Application Privacy     231     Mobile App Privacy     232 8.5 Online Privacy Requirements     234     Online Privacy Principles     234     Online Privacy Framework     236     Simplified Consumer Choice     241     Transparency of Data Practices     241 8.6 Privacy Notices     242     Notice Requirements     243     Notice Content     243     Notice Structure     246     Mobile App Privacy Notices     246     Privacy Notice Design Space     248 8.7 Tracking     250     Cookies     250     Other Tracking Technologies     253     Do Not Track     254 8.8 Key Terms and Review Questions     254     Key Terms     254     Review Questions     255 8.9 References     255 Chapter 9:  Other PET Topics     258 9.1 Data Loss Prevention     258     Data Classification and Identification     259     Data States     260     DLP for Email     262     DLP Model     263 9.2 The Internet of Things     266     Things on the Internet of Things     266     Components of IoT-Enabled Things     266     IoT and Cloud Context     267 9.3 IoT Security     270     IoT Device Capabilities     270     Security Challenges of the IoT Ecosystem     271     IoT Security Objectives     273 9.4 IoT Privacy     274     An IoT Model     275     Privacy Engineering Objectives and Risks     276     Challenges for Organizations     278 9.5 Cloud Computing     280     Cloud Computing Elements     280     Threats for Cloud Service Users     284 9.6 Cloud Privacy     285     Data Collection     286     Storage     287     Sharing and Processing     290     Deletion     290 9.7 Key Terms and Review Questions     290     Key Terms     290     Review Questions     291 9.8 References     291 PART V:  INFORMATION PRIVACY MANAGEMENT     293 Chapter 10:  Information Privacy Governance and Management     294 10.1 Information Security Governance     295     Information Security Management System     295     Information Security Governance Concepts     295     Security Governance Components     298     Integration with Enterprise Architecture     303     Policies and Guidance     307 10.2 Information Privacy Governance     308     Information Privacy Roles     308     The Privacy Program Plan     312 10.3 Information Privacy Management     315     Key Areas of Privacy Management     316     Privacy Planning     317     Privacy Policy     319 10.4 OASIS Privacy Management Reference Model     322     Privacy Management Reference Model and Methodology (PMRM)     322     Privacy by Design Documentation for Software Engineers     328 10.5 Key Terms and Review Questions     331     Key Terms     331     Review Questions     331 10.6 Reference     332 Chapter 11:  Risk Management and Privacy Impact Assessment     334 11.1 Risk Assessment     335     Risk Assessment Process     335     Risk Assessment Challenges     339     Quantitative Risk Assessment     340     Qualitative Risk Assessment     342 11.2 Risk Management     346     NIST Risk Management Framework     347     ISO 27005: Information Security Risk Management     348     Risk Evaluation     351     Risk Treatment     352 11.3 Privacy Risk Assessment     353     Privacy Impact     356     Likelihood     361     Assessing Privacy Risk     363 11.4 Privacy Impact Assessment     365     Privacy Threshold Analysis     365     Preparing for a PIA     366     Identify PII Information Flows     367     Identify Potential User Behavior     367     Determine Relevant Privacy Safeguarding Requirements     368     Assess Privacy Risk     368     Determine Risk Treatment     368     The PIA Report     369     Implement Risk Treatment     370     Review/Audit Implementation     370     Examples     371 11.5 Key Terms and Review Questions     371     Key Terms     371     Review Questions     372 11.6 References     372 Chapter 12:  Privacy Awareness, Training, and Education     374 12.1 Information Privacy Awareness     376     Awareness Topics     377     Awareness Program Communication Materials     378     Awareness Program Evaluation     379 12.2 Privacy Training and Education     380     Cybersecurity Essentials     380     Role-Based Training     381     Education and Certification     383 12.3 Acceptable Use Policies     384     Information Security Acceptable Use Policy     384     PII Acceptable Use Policy     386 12.4 Key Terms and Review Questions     386     Key Terms     386     Review Questions     387 12.5 References     387 Chapter 13:  Event Monitoring, Auditing, and Incident Response     388 13.1 Event Monitoring     388     Security Event Logging     389     Security Event Management     391     Event Logging Related to PII     392 13.2 Information Security Auditing     393     Data to Collect for Auditing     394     Internal and External Audits     395     Security Audit Controls     396 13.3 Information Privacy Auditing     398     Privacy Audit Checklist     398     Privacy Controls     400 13.4 Privacy Incident Management and Response     401     Objectives of Privacy Incident Management     401     Privacy Incident Response Team     402     Preparing for Privacy Incident Response     403     Detection and Analysis     405     Containment, Eradication, and Recovery     406     Notification to Affected Individuals     407     Post-Incident Activity     408 13.5 Key Terms and Review Questions     409     Key Terms     409     Review Questions     410 13.6 References     410 Part VI:  Legal and Regulatory Requirements     411 Chapter 14:  The EU General Data Protection Regulation     412 14.1 Key Roles and Terms in the GDPR     413 14.2 Structure of the GDPR     415 14.3 GDPR Objectives and Scope     417     Objectives     417     Scope of the GDPR     418 14.4 GDPR Principles     420     Fairness421     Lawful     422     Transparency     423 14.5 Restrictions on Certain Types of Personal Data     423     Children’s Personal Data     423     Special Categories of Personal Data     424 14.6 Rights of the Data Subject     426 14.7 Controller, Processor, and Data Protection Officer     428     Data Protection by Design and Default     428     Records of Processing Activities     429     Security of Processing     431     Data Protection Officer     431 14.8 Data Protection Impact Assessment     433     Risk and High Risk     433     Determining Whether a DPIA Is Needed     434     DPIA Process     436     GDPR Requirements     438     Criteria for an Acceptable DPIA     439 14.9 Key Terms and Review Questions     441     Key Terms     441     Review Questions     441 14.10 References     442 Chapter 15:  U.S. Privacy Laws     444 15.1 A Survey of Federal U.S. Privacy Laws     445 15.2 Health Insurance Portability and Accountability Act     449     HIPAA Overview     449     HIPAA Privacy Rule     450 15.3 Health Information Technology for Economic and Clinical Health Act     456     Breach Notification     456     Encryption of PHI     457     Data Destruction     459 15.4 Children’s Online Privacy Protection Act     460     General Provisions     460     The COPPA Final Rule     461 15.5 California Consumer Privacy Act     462     Basic Concepts     462     Rights of Consumers     466     Comparison with the GDPR     468 15.6 Key Terms and Review Questions     470     Key Terms     470     Review Questions     470 15.7 References     471 Index     472 Appendix (Online Only): Answers to Review Questions

Uw winkelwagen

Information Privacy Engineering and Privacy by Design

Understanding Privacy Threats, Technology, and Regulations Based on Standards and Best Practices

Samenvatting

Specificaties

Inhoudsopgave

Rubrieken

Populaire producten

Personen

Trefwoorden