ENISA activities in the area of Privacy & Trust

Transcription

1 ENISA activities in the area f Privacy & Trust Rdica Tirtea 2 nd December 1 st ISACA Athens Chapter Cnference

2 Overview Intrductin & cntext f the wrk Abut ENISA activities Activities related t privacy & trust 2010 activities n privacy and data prtectin tpics Onging activities Future activities Final remarks / Instead f cnclusins 2

3 Abut ENISA (Eurpean Netwrk and Infrmatin Security Agency) Created in 2004 Lcated in Heraklin / Greece Arund 30 Experts Centre f expertise Supprts EU institutins and Member States Facilitatr f infrmatin exchange EU institutins, public sectr & private sectr Has an advisry rle the fcus is n preventin and preparedness fr NIS tpics 3

4 Activities The Agency s principal activities are as fllws: Advising and assisting the Cmmissin and the Member States n infrmatin security. Cllecting and analysing data n security practices in Eurpe and emerging risks. Prmting risk assessment and risk management methds. Awareness-raising and c-peratin between different actrs in the infrmatin security field.

5 Wrk Streams The 2011 Wrk Prgramme has been structured as three separate wrk streams. These have been chsen s as t ensure cntinuity between the frmer MTPs and the Wrk Streams (WS) f the future strategy. These wrk streams are as fllws: WS1 ENISA as a facilitatr fr imprving cperatin WS2 ENISA as a cmpetence centre fr securing current & future technlgy WS3 ENISA as a prmter f privacy, trust and awareness. 5

6 WS1 Imprving Cperatin The bjective is t supprt EC and the MS in intensifying cperatin between MS in key areas The Wrk Packages in this WS are: Supprting Member States in implementing Article 13a Preparing the next pan-eurpean exercise Reinfrcing CERTs in the Member States Supprting CERT cperatin at the Eurpean level Gd practice fr CERTs t address NIS aspects f Cybercrime 6

7 WS2 Securing Technlgy The verall bjective f the secnd Wrk Stream is t assist the Member States and the Cmmissin in identifying and respnding t security issues related t current and future technlgy The Wrk Packages in this WS are Security & privacy f Future Internet technlgies Interdependencies & intercnnectin Secure architectures & technlgies Early warning fr NIS 7

8 WS3 - Privacy and Trust The majr bjective f the third Wrk Stream is t prmte trust in future infrmatin systems by all sectins f the ppulatin. The Wrk Packages in this WS are: Understanding and analysing ecnmic incentives and barriers t infrmatin security. Deplying privacy and trust in peratinal envirnments. Supprting the implementatin f article 4 f the eprivacy Directive (2002/58/EC). Prmting the establishment f a Eurpean mnth f netwrk and infrmatin security fr all. 8

9 Privacy, Accuntability and Trust Cntext Internet is pen and distributed withut authritative cntrl In terms f privacy a number f challenges are psed Data pllutin - data disseminated withut cntrl and is replicated n multiple servers Cntrary t humans, data lives frever s (nt nly web mail), scial netwrking sites, nline cllabrative spaces (e.g. Ggle dcs) Cntradictry psitins gvernments Demand accuntability, data prtectin, data minimizatin, better privacy prtectin But als mre access cntrl t data, data retentin, lawful interceptin Users Expressing cncerns regarding privacy Sme users willing t drp the cncerns when benefits are ffered

10 Overview f 2010 activities 2010 activities n privacy and data prtectin tpics Data Breach Ntificatin in Eurpe Survey f accuntability, trust, cnsent, tracking, security and privacy mechanisms in nline envirnments Privacy, Accuntability and Trust Challenges and Opprtunities Bittersweet ckies. Sme security and privacy cnsideratins Findings and issues t be further addressed 10

11 Data Breach Ntificatins - cntext Review f eprivacy Directive (2002/58/EC) Article 4 In the case f a persnal data breach, the prvider f publicly available electrnic cmmunicatins services shall, withut undue delay, ntify the persnal data breach t the cmpetent natinal authrity. ENISA activities 2010 Review f current practices amng MS 2011 Cnsultatin wrkshp n DBN (24th January) 2011 Technlgical guidelines fr implementatin f Art. 4

12 Data Breach Ntificatins technlgical guidelines (I) Target Cmpetent authrities (DPAs and thers) Telecm peratrs (and ther sectrs players) Objectives Practical and usable definitin f a breach Criteria fr determining a breach Natinal and pan-eurpean appraches Apprpriate technlgical prtectin measures Identificatin and assessment f risks f breaches Prcedures f ntificatin 12

13 Data Breach Ntificatins technlgical guidelines (II) ENISA respnsibilities Prviding advice t EC Cllabrating with Art.29 WP, EDPS Areas cvered by the study Planning and preparatins Detectin and assessment f data breaches Ntificatin prcedures Gathering f evidence, frensics analysis Review and imprvement Rles and respnsibilities 13

14 Survey f mechanisms in nline envirnments. Remarks (I) Privacy in nline envirnment; defining persnal data given current cntext f data mining Clear privacy principles and persnal data definitins valid in an evlving nline envirnment shuld be prmted Privacy enhancing technlgies and a user centric apprach t privacy need t be encuraged. Best practice studies shuld be prepared and disseminated Cnsent and privacy plicies Mre transparency by rganizatins n hw they handle persnal data is needed The way privacy plicies are displayed and the issues regarding the changes f plicies need further cnsideratin; alternatives t lengthy privacy plicies shuld be available t infrm the user Cnsent prvided fr a certain privacy plicy must nt be transferred t anther (changed) versin f privacy plicy withut clear understanding and acceptance f the user 14

15 Survey f mechanisms in nline envirnments. Remarks (II) Prfiling and tracking Strage time. Data shuld nt be stred frever Data minimizatin Persnal data as a cmmercial asset; transfer f persnal data between prviders and utside EU In line with the EU apprach, ENISA cnsiders privacy t be a basic Human Right Ecnmic effects f the use f persnal data n bth cnsumers and prviders and these effects shuld be analyzed better understanding the effects and the risks culd allw fr slutins fr prtecting cnsumers privacy The legal framewrk in 27 EU MS regarding the transfer f persnal data shuld be surveyed; differences in legislatin can encurage transfer f persnal data t cuntries where the legal requirements allw fr less privacy prtectin The legal framewrk fr transfer f persnal data utside EU shuld be als analysed; equal treatment and same enfrcement shuld exist fr EU users persnal data independent f the lcatin f cntrllers/prcessrs inside r utside EU 15

16 Privacy, Accuntability and Trust study. Findings (I) Prmte technlgies and initiatives addressing privacy Data minimizatin, privacy enhancing technlgies and privacy by design cncepts shuld be well understd and prmted in an effrt t prevent rather than cure evaluatin f existing targeted (cnstructed n certain assumptins) slutins in the real envirnment supprting the uptake f research result in the peratinal envirnment Research n infrmatin accuntability technlgy shuld be prmted, aimed at the technical ability t hld infrmatin prcessrs accuntable fr their strage, use and disseminatin f third-party data Supprting infrmed user cnsent in a transparent and user friendly manner i.e. using transparent privacy plicies with icns A multidisciplinary apprach that cnsiders educatin, plicy legal and technlgical aspects shuld be supprted 16

17 Privacy, Accuntability and Trust study. Findings (II) Raise the level f awareness and educatin regarding privacy Cncepts such as privacy certificatin culd be supprted; this wuld allw labeling sites and services accrding t their prfiling activity the risks assciated t prfiling and tracking, i.e. frm ecnmic perspective, shuld be assessed (disseminatin f such studies shuld be supprted) Supprt plicy initiatives in the field and the revisin prcess f Data prtectin directive Clear legal prvisins limiting behavir tracking and prfiling shuld be prmted. Prmting clear definitins and guidelines in the field, by raise awareness n the data mining techniques and their pssibilities t de-annymize data and prfiles (linking this way infrmatin that initially are nt cnsidered persnal data). 17

18 Ckies. Sme security and privacy cnsideratins Ckies, als knwn as HTTP (Hypertext Transfer Prtcl) ckies Useful in the stateless brwser server HTTP interactin t keep the state are generated and mdified by the server, stred by the brwser and transmitted between brwser and server at each interactin. Extensively used Privacy cncerns Ability t identify and track users Security cncerns Vulnerabilities i.e. due t setting Legal framewrk Allws fr interpretatin Cllectin f data frm ckies 78% in ENISA survey 73% bth persistent and nnpersistent ckies 9% nly persistent 18% nly nn-persistent 18

19 Overview Intrductin & cntext f the wrk Abut ENISA Activities related t privacy & trust 2010 activities n privacy and data prtectin tpics Data Breach Ntificatin in Eurpe Survey f accuntability, trust, cnsent, tracking, security and privacy mechanisms in nline envirnments Privacy, Accuntability and Trust Challenges and Opprtunities Bittersweet ckies. Sme security and privacy cnsideratins Onging activities Future activities Final remarks 19

20 Areas f (pssible) interventin On-line services, applicatins and transactins can assure benefits and cmpetitive advantage fr citizens and EU ecnmy The EU requires Advcating and fstering a Pan-Eurpean apprach t privacy Prpsing new mdels fr trust-establishment Develping f guidelines fr regulatry review and interpretatin Areas f (pssible) interventin Infrmatin/Educatin - Peple have t be aware and educated! Plicy maker Order t remve cntents Prmte availability f subscriptin based services in additin t free Avid nline service prviders lck-in by fstering user prfile prtability Implement Data Breach Ntificatin; Technlgy Limit data pllutin (e.g. minimal disclsure) Limit cntent s lifetime (e.g. ephemeral cmmunicatin) Limit data leakage by design (privacy by design) 20

21 Privacy & Trust in ENISA 2011 Wrk Prgramme WPK Deplying Privacy & Trust in Operatinal Envirnments Outcme (Q4 2011) Reprt n minimal disclsure and ther principles supprting privacy and security requirements Reprt n trust and reputatin mdels. Evaluatin and guidelines Study n mnetizing privacy WPK Supprting the implementatin f the eprivacy Directive (2002/58/EC) Activities linked t Digital Agenda Plicy dimensin FI Initiative Research dimensin

22 Sme prpsal fr 2012 Activities in cllabratin with EC (DG JUS, etc), supprting actins f the Digital Agenda fr the EU WPK 4.3: Supprting the develpment f secure, interperable services WPK Security gvernance Supply Chain Integrity Art 4, DBN cntinuatin WPK Supprting the develpment f secure, interperable services State f the art f certificatin schemes in the EU and beynd. Explring the feasibility f implementing a pan-eurpean scheme fr trustmarks Privacy-by-design, prmting PETs and their pssible ecnmic benefits, smart metering and privacy 22

23 Privacy is a human right Everyne has the right t respect fr his private and family life, his hme and his crrespndence. Article 8 f The Eurpean Cnventin n Human Rights adpted by states member f The Cuncil f Eurpe Everyne has the right t the prtectin f persnal data cncerning them. Article 16, The Treaty f Lisbn, The Treaty n the Functining f the Eurpean Unin states Everyne has the right t the prtectin f persnal data cncerning him r her [..] Such data must be prcessed fairly fr specified purpses and n the basis f the cnsent f the persn cncerned r sme ther legitimate basis laid dwn by law. Everyne has the right f access t data which has been cllected cncerning him r her, and the right t have it rectified. Article 8, the Charter f Fundamental Rights f the Eurpean Unin 23

24 Cntact Eurpean Netwrk and Infrmatin Security Agency Science and Technlgy Park f Crete (ITE) P.O. Bx Heraklin - Crete Greece