3/1/19
Learning Objectives
Describe the controls that can be used to protect the confidentiality of
sensitive information.
Explain the controls that organization’s use to protect the privacy of personal
information they collect from customers, suppliers, and employees, and
discuss how the Generally Accepted Privacy Principles (GAPP) framework
provides guidance in developing a comprehensive approach to protecting
privacy.
Chapter 9 Discuss how different types of encryption systems work, and explain how
digital signatures provide the means for creating legally-enforceable contracts.
CONFIDENTIALITY AND PRIVACY CONTROLS
Protecting Confidentiality and
Privacy of Sensitive Information Privacy Controls
Identify and classify information to protect Data Masking—Protecting privacy by replacing sensitive personal
• Where is it located and who has access? information with fake data. Also called tokenization.
• Classify value of information to organization
Encryption
• Protect information in transit and in storage
Access controls
• Information Rights Management (IRM)-software that can limit access to specific files or
documents, and can also specify the actions that individuals can perform.
• Data loss prevention (DLP)-Blocks outgoing messages from going out if they contain sensitive
information.
• Digital watermarks –Code imbedded in documents that enables an organization to identify
confidential information that has been disclosed.
Training
1
3/1/19
Generally Accepted Privacy
Privacy Concerns Principles
Management Access
1. Spam-unsolicited e-mail that contains either advertising or ◦ Procedures and policies with assigned ◦ Customer should be able to review,
offensive content. See notes to the slide for guidelines. responsibility and accountability correct, or delete information collected
on them
2. Identity theft-assuming someone’s identity, usually for financial Notice
◦ Provide notice of privacy policies and Disclosure to third parties
gain. practices prior to collecting data
Choice and consent Security
◦ Opt-in versus opt-out approaches ◦ Protect from loss or unauthorized
access
Collection
◦ Only collect needed information. Cookies Quality
are a concern.
Monitoring and enforcement
Use, retention, and disposal ◦ Procedures in responding to complaints
◦ Use information only for stated business ◦ Compliance
purpose. When no longer useful, dispose in a
secure manner.
Encryption Encryption
Preventative control Preventive control
Factors that influence encryption strength: Process of transforming normal
content, called plaintext, into
◦ Key length (longer = stronger) unreadable gibberish called
ciphertext.
◦ Algorithm
Decryption reverses this
◦ Management policies process
◦ Stored securely
2
3/1/19
Types of Encryption
SYMMETRIC ASYMMETRIC
Digital Signatures
Used to create legally binding agreements (two steps to create)
Uses one key to encrypt and decrypt Uses two keys
◦ Public—everyone has access 1. Document creator uses a hashing (similar to encryption, but cannot
Both parties need to know the key ◦ Private—used to decrypt (only known by be undone, if two people has the same document they arrive at the
◦ Need to securely communicate the shared you) same hash) algorithm to generate a hash of the original document
key
◦ Public key can be used by all your trading
◦ Cannot share key with multiple parties, they partners 2. Document creator uses private key to encrypt step 1 above
get their own (different) key from the
organization Can create digital signatures
Virtual Private Network
Securely transmits encrypted data between sender and receiver
◦ Sender and receiver have the appropriate encryption and decryption keys.