Privacy Analysis Worksheet

We have been engaged in business for some time, and have been very successful, however we need to re-examine our network configuration and infrastructure and identify that our network defenses are still reliable, before we make any changes. We need to take a hard look at our current configuration of host, services and our protocols within our organization. Data from a large number of penetration tests in recent years show most corporate networks share common vulnerabilities. Many of these

Data Protection Act 1998 – gives individuals the right to know what information is held about them, and those that processes personal information must comply with eight principles, which makes sure that personal information is fairly and lawfully processed; processed for limited purposes; adequate, relevant and not excessive; accurate and up to date; not kept for longer than is necessary; processed in line with your rights; secure; not transferred to other countries without adequate protection;

As human beings and citizens of the world, everyone values their privacy. It is a right that is often looked over and taken for granted by most. Since the beginning of time, there have been concerns about individuals’ rights to privacy and their personal information remaining confidential. Our founding fathers had concerns about this which is why, “…this right has developed into

The main intent is to protect individuals against misuse or abuse of information about them.”

And there's yet another permutation here, whether or not you have a reasonable expectation in the privacy of data that other people are storing about you - if someone has your SSN or medical information in their database, do you have a reasonable expectation of privacy in that information remaining private? Medical is an easy answer, HIPAA basically defines your expectations for you. SSNs, DOBs, other PII? Not quite as clear cut, at least here in the

Companies should develop a control that requires that routine vulnerability assessment of their customer facing web sites, network infrastructure, and associated systems (such as database systems). Vulnerability assessment can help identify potential weaknesses to systems and also provide a sort of feedback to the organization’s IT department on their current operational policy and security posture. The cost of performing a routine vulnerability assessment is considerably less than that of an actual data breach.

Penetration testing is the attempt to identify security weaknesses within the IT infrastructure of an

The misuse or failure to secure Personally Identifiable Information can lead to the information being leaked, stolen, and/or misplaced. When Personally Identifiable Information is leaked it is somewhere where anyone can access the information, an example of this would be Personally Identifiable Information that was published in public record such as a court appearance or traffic ticket. When Personally Identifiable Information is misplaced it is susceptible to being stolen or misused. The misplacement of Personally Identifiable Information is of particular concern in the Information Technology industry where if Personally Identifiable Information is misplaced in, say a database, it could be accessed by people that are not are not supposed to be able to see the data or by people that do not have a “need to know” or authorized to see the data. Theft of Personally Identifiable Information is of particular concern because the people, thieves, are trying to access the Personally Identifiable Information for criminal intentions such as identity theft which has been steadily on the rise since the begging of the “computer age”. Identity theft can lead to lost time and money related to securing bank accounts and credit cards and the longer the identity theft goes unnoticed the consequences become more prolific. The identity thieves can assume ones entire identity and open up new

1. Why is risk mitigation and filling in critical security gaps an important next step after the security assessment is performed?

Phase 6 - conduct a vulnerability assessment according to NIST SP 800-115: Technical Guide to Information Security Testing;

I have decided to write a research paper on the importance of protecting personally identifiable information (PII) in Information Technology. PII is a critical, but often overlooked skill requirement for IT professionals. The subject of PII data is of vital importance to me since I work with PII data frequently and must be prepared to handle it correctly and ethically, less risk the violation of privacy law. In addition to satisfying the necessary requirements for a research paper, the intention of this paper are to provide:

Implement a security training program for IT employees and any employee manipulating customer sensitive data

There are five major areas which trigger privacy matters in the area of public sector employment: background

Personal information can consist of anything from a home address, telephone number, social security number, income, credit card history, etc, any piece of information that can be tied to a distinct individual. Once personal

PRIPARE consists of a consortium of 11 partners with strong links with the privacy community (data protection authorities and policy makers, privacy advocacy organizations, technology, engineering). In order to prepare for the longer term adoption by industry, a representative advisory board will be set up. The project duration is 24 months”