Adding a Privacy Focus to Security Reviews for Integrated Data Systems

Author

Rodriguez, B., Cottrell, S., & Tiderman, L.

Organization

Data Integration Support Center

Description

Essential as they are for understanding many critical aspects of a data system, mandated security reviews tend to operate with a particular—and narrow—definition of security that limits their ability to give a full picture of how well an IDS is able to protect the privacy of those whose personal information it contains. This paper explains those limits and recommends that a mandated security review be augmented by an enhanced system review whose more encompassing focus on privacy can help improve the security-and-privacy posture of a data system.