Privacy for Tech Startups
Barcelona KnowledgeNet June, 18 - 2014
#iappbcn
IAPP Presentation
• Marc Gallardo: Why is Privacy important for a Startup?• Jay Libove: Practical Information Security controls for Startups• Victor Roselló: New Privacy Principles for Startups
PART 1: Keynotes
• Marta Ruiz (Air Products) • Tiago Henrique (opscaling, gnuine)• Ferran Julià (Undertile)
PART 2: Panel
Q & A session
Program
IAPP Presentation
Founded in 2000
Over 15,000 members in 83 countries
Largest privacy association in the world
IAPP Europe – created to address the specific needs of European data protection professionals – counts almost 2,000 members
IAPP
Members’ opportunities
EDUCATE NETWORK CERTIFY
Educational resources
IAPP publications keep members up to date on the latest privacy and data protection news worldwide.
Online community
IAPP Privacy List
Web Conferences
Social Buzz
Blogs and Website
Resource Center
Samples, Tools and Templates
Privacy Research
Career Center
IAPP Articles and Presentations
Privacy Glossary
Data Protection Authorities
Privacy Discussions
Connecting the industry
More than a professional association, the IAPP provides a home for privacy professionals around the world to share experiences—working to promote career readiness and improve job effectiveness
Setting the industry standard
IAPP certification is the global standard for privacy and data protection professionals. • Launched nearly 10 years ago, the CIPP has become the preeminent
credential in the field of privacy and educates on privacy laws and regulations (variants /US, /E, /CA, /G)
• The CIPM training demonstrates how to embed privacy into an organization through process and technology
• The CIPT is the world’s only privacy certification designed for IT, security and engineering pros
Privacy for Tech Startups In short, think of privacy as a good opportunity to win trust among users and customers
Common attitude of startup founders
Privacy and Data Security is usually not a priority from the start !
Respecting Privacy and safeguarding data is a core value and a trust enabler for your customers & investors
Privacy attitudes of consumers
• The need to protect personal data online is a consumer priority against the benefits of convenient online services
EMC Privacy Index - June 12, 2014
15.000 consumers from 15 countries
Three Paradoxes emerged:
• “We want it all” • “Take no action” • “Social Sharing”
Viewpoints on privacy vary by persona
Be proactive & go beyond compliance
• Make privacy top of mind: consumers do care and investors are concerned
• Know your data
• Be fully transparent: - Simplify the language- Use ‘transparency statements’- Do as your privacy notice says
• Secure your data and train your people
Practical Information Security controls for Startups
Or, how to get some useful Data Protectionwhile helping your business …
Practical Approach to Privacy
• We have a bad habit in Spain– DP viewed as legal exercise, not business enabler*– L.O.P.D. trailer on website is (not) enough
• .. And as much as imitation is the sincerest form of flattery…• So, why would you bother? †• Focus on business: Do security and get compliance
– Don’t do “compliance for compliance’s sake”– Do well with practical DP, and if/when you have a problem, you
have some defence• Information Security is a part of Privacy/DP, necessary but not
sufficient
Organizational
• Don’t put privacy/DPO in your Legal department *• Make sure your outside counsel understands your
business! **• Do have an internal IT leader• Have department heads meet regularly, as a group,
with your privacy leader (cross-pollenate disciplines)• Fund professional memberships and
training/certifications (such as my CISSP, CIPP, CISM) †
Policies, Procedures* (philosophy)
• Privacy by Default/ Privacy by Design (operationalize)• Privacy Impact Assessments (operationalize)• Limit your IT Footprint, & only buy what you’ll use• Re-Use, standardise – don’t reinvent †
– Open source, commercial Libraries– OWASP libraries– Commercial Emailer services
• Stay on Supported Versions
Policies, Procedures* (philosophy, cont’d)
• Use 2-Factor/ Multi-Factor/ Strong/ Two-Step authentication wherever practical
• Leverage Amazon AWS IAM and similar• Know Before You Go (learn before using, especially
OAuth)• Insurance (general business, also “Cyber”)*• Procedures, Checklists for when people leave your
company• Change Management
Awareness
• People, Process and Technology– Acceptable Use Policy
• Subscribe everyone in your company to– SANS OUCH*, and/or– CyberHeist† newsletter, and/or– Front Page of the New York Times, El Mundo, …
• Test your people– Phishing email test– Not just .EXE attachments, but .PDF, even . JPG, .MP3*– USB drive left sitting around with autorun binary on it, …
• Check your Credit Card & Bank statements carefully
USB phishing test
• Particularly if your company is Ayatollah, Inc.
Techie Things To Do
• Change default passwords!• Encrypt everywhere where it’s easy to do
– Disks, Android & iOS mobile devices– Network traffic (Web SSL, VPN)– Wi-Fi infrastructure– VoIP / SIP gateways
• do Backups*,**• run Anti-Virus• have Vulnerability awareness/ perform Patching
Techie Things To Do (cont’d)
• UAC, sudo – Don’t compute as Root!• install Microsoft EMET• if you create Windows code, opt-in to
– DEP, SEHOP, SafeSEH, ASLR• buy (and use!) a UTM appliance• enable Logging (& direct to different server)*• consider subscribing to Anti-DDoS protection• give your CFO a separate computer to do on-line banking…
Patching, Vulnerability awareness(desktop/client)
• Windows – WSUS, InTune *
• Secunia SmallBusiness* (beta), LANDesk Patch Manager*, BeyondTrust Retina free 256-IP edition
• Deploy everything you can with auto-updating– More attacks come against apps today than against
platforms– But make sure you trust the software vendor†
• Choose commonly used, actively maintained products
Patching, Vulnerability awareness(server)
• Canonical (ubuntu) Landscape*, RedHat Network*
• Qualys free online vulnerability scan• Auto-updating may not be appropriate
(but vulnerability management is still critical)
• Have a Test environment– Use it for testing patches too
Some Great Free Tools
• LastPass † (Freemium model)• Android, iOS Device Encryption*• WSUS• NTP• SSH, RDP• Microsoft EMET• Windows Firewall, Linux iptables
More Great Free Tools
• OWASP code libraries (ESAPI)• File Vault 2, TrueCrypt, BitLocker*, Windows
8.1 Device Encryption †
• Google Mobile Device Management• EFF’s “HTTPS Everywhere” (Firefox, Chrome,
Opera)**
… and some Not-So-Great “Free” tools
• Pirated software is NEVER a good idea– It’s illegal, and it should go without saying that you
should not do illegal things– You don’t others to steal YOUR stuff– Pirated software very often comes with “extras”
• Viruses, Trojan horses• Back doors, Spyware
Synergies
• Use the Cloud †– AWS EC2 ELB, etc provides
security front-end– Cloud SaaS (anti-virus,
IT management; convergedservices – buy one, moreavailable for small add-on cost)
– Backup (Mozy*, Carbonite, …)
Targeted Training
• Developers – to avoid common tech errors– Re-review the OWASP Top 10 every year– Send one or two top developers to SANS training
• Marketing – to avoid creepy/annoying uses– Meet with people like your presenters today
• Data Protection Official (IAPP CIPP, CIPM, CIPT!)
Human Things to To
• Use Bookmarks/Favorites– no typos, can include https:// explicitly
New Privacy principles for Tech Startups
So, what’s next?
• Data protection by design & by default (art. 23).
• Security of processing (art. 30).
• Data breach notification to DPA (art. 31) & to DS (art. 32).
• Data Protection Impact Assessment (art. 33).
• Data Protection Officer (art. 35).
GDPR “new” principles
DP by design •Data controller and processor.• At the time of purposes and means determination.• Appropriate and proportionate technical and organizational measures.• Ensure data subject rights.• Entire lifecycle.• Accuracy, confidentiality, integrity, physical security and deletion of personal data.
DP by default• No personal data processing beyond the minimum necessary for a predetermined purpose.
Data protection by design & by default
• A level appropriate to the risks. Nature of processing and of personal data (DPIA). • Integrity, confidentiality, availability and resilience of systems.• Reliable Back up process.• Sensitive information?• PII only accessed by authorized personnel.• PII protected against accidental or unlawful destruction.
Security of processing
To DPA • No undue delay.• Nature of breach (categories and number of PII affected).• DPO contact details.• Measures recommended to mitigate effects.• Consequences.• Describe measures taken to mitigate effects.• Document and public register.
To DS• Notification to DS in case of adverse affect to personal data and privacy.• Comprehensive and clear plain language.
Breach notification to DPA and DS
• Analyze potential risks (more than 5000 DS in 12-month period, sensitive PII).• Description of processing operations and purposes of processing.• Proportionality in relation to purposes.• Risks to DS rights.• How to minimize PII to be processed.• Security measures.• Data retention period.• DP by design and by default.• Categories and recipients of personal data.• Data transfers to third countries.• Context of data processing.
Data Protection Impact Assessment
• More than 5000 DS in 12-month period.• Regular and systematic monitoring of DS.• Special categories of PD.• Inform and advise controller of processor.• Monitor and implement policies, train staff and audit.• DP by design and by default.• Data breaches.• DPIA.• Co-operate with DPA.• At least two years term. Might be reappointed. Employee or external contractor.
Data Protection Officer
Panel
Presentation
1.- Privacy as a competitive advantage
2.- Preparing for a data breach
3.- Supplier governance
4.- S.O.S. Compliance Team
Thank you!
Recommended
