PbD, a framework that has been around since the 90’s evangelizes a user centric (openness and transparency) approach to privacy, by keeping the user and their data at the center of all things important, theorizes 7 foundational principles to control the effects of information and communication technologies. They are:
Security by design: there are a set of core principles that need to be taken into consideration ahead of a software development life cycle.
Sources: https://dzone.com/articles/9-software-security-design, http://nob.cs.ucdavis.edu/classes/ecs153-2000-04/design.html
We live in a world where breaches of privacy and security are becoming common place. Unfortunately, this comes as no surprise to anyone. But at the same time, organizations embrace technologies (and rightfully so) that cause us to willingly give up some control of our data and resources (such as cloud computing). Organizations face so much competitive pressure, privacy and security can become an afterthought until such a time a breach has occurred or when a compliance standard is imposed on them.
It is common for organizations to follow a cadence of proactive inspection of the security posture when imposed via compliance and regulatory requirements, in other words forced to do so to avoid penalties and fines. Others focus on it because of a breach or an event having occurred. Finally, there are those that are proactive in nature and seek actively to maintain a current security posture.
The reality is that security compliance regulations standards are a good way of protecting your organization and the privacy of the individuals involved with the organization even if you are not necessarily mandated regulations. It’s just good practice because it promotes adherence to security and privacy guidelines that will expose some of the basic requirements that enable good privacy and security measures.
For example, one of the key activities that would occur while assessing an organization's compliance with the GDPR regulations is discovery and classification of data assets and the systems that control such data. This should be treated as good practice and enabled by default. A big problem that most companies grapple with is the uncontrolled growth of data/storage in the environment and not having any kind of visibility into it. There are estimates that this ROT data (Redundant, Obsolete & Trivial) constitutes somewhere between 70 and 80% of the total data stored in the environment. This undoubtedly has real cost implications to it because historically, the solution was to throw more hardware into the environment once a capacity threshold has been reached. There are also operational and security implications, because if you don’t know what you have, you are likely not to take appropriate security measures.
Regulations such as GDPR (and several others) are good way to gain control over the security posture of your environment as it promotes some of the required design principles and forces organizations to look inwards proactively. For all of your Security/Compliance and GDPR needs, please visit us at www.solutions-ii.com/security!