The KnowledgeNet speech in Boca Raton went really well. I got some great positive feedback. In fact it was suggested that I propose to give the speech (or a similar one) at one of the IAPP’s national conferences. In addition, my preparation for the speech spurred my interested in several areas which I hope to explore, both within this blog and outside of it.
The first, in trying to develop a simple PbD (Privacy by Design) example, I ran into the issue of protecting emails while still supplying the system with contact information. Some people use one time email services (like Mailinator). However, these have several potential downfalls, primary of which the email service can read your email and secondly, for some, you can only get email once. I’m going to return to this subject when I have some time to do some more investigation. I know there are other services out there that might fit the bill, I just need to find an innovative solution to this problem.
Another issue that I found is that privacy professionals really need to be versed in cryptography. They don’t need to actually know how the cryptography works, they just need to know about the capablities so they can demand those of their product development teams. Things like zero knowledege proofs, homomorphic encryption, hasing. I’m going to try and write an e-book about this but I think first I write each chapter (on a different technology as a blog post).
Still another issue that raised its head is the concept of provable audit-ability. Most auditor just have to take the IT professional’s word that certain information/systems are secure. Take for example, a developer who makes a backup of production data on an orphan server. Nobody knows about it except the developer. Nobody audits the access controls on that box because they don’t even know about it. How is an audit supposed to find it? The concept of provable audit-ability goes to proving with mathematical certainty that nobody tampered with or has access without authorization. It’s doable, if organizations are willing to consider privacy by design rather than privacy by accident. Currently auditors say “we think we’re secure” but they really don’t know and they can’t know until a breach occurs and it’s too late.
Giving this speech has put a lot on my mind and there are many more blog posts to make in the coming weeks. Let’s hope I can find time to put the pen to paper, so to speak.