Privacy in Computing Legal & Ethical Issues in Computer …Security Information Security Management …and Security Controls Week-9

Privacy in Computing What is privacy? Individual Control of personal information Right to declare certain information sensitive Privacy has a cost: giving – or not giving – certain information may have affect how we are treated Computerization did not invent privacy problems, nor will it solve them

Privacy in Computing Basic qualities/dimensions/tenets of privacy Consent of information collection Limited use Limited period of retention Limited disclosure Protection of collected information against inappropriate use Controlled access, logging Monitoring of use, logging Policies cannot be weakened once data items are collected.

Privacy in Computing Anonymity, pseudonymity, multiple identities Anonymity - meaning "without a name" or "namelessness". Pseudonymity - is a state of disguised identity.

Principles and Policies Fair information policies. Privacy Laws – Which Country nternational.org/repo rts/nepal

Authentication Of an: Individual Identity Attribute Anonymization Delivering unique identities from anonymized data Work of Anderson, Sweeney. In 2000, she showed that 87 percent of all Americans could be uniquely identified using only three bits of information: ZIP code, birthdate, and sex.uniquely identified using only three bits of information

Data Mining Privacy-preserving data mining Tradeoff between anonymity and identification for good purpose Joining databases on common data values Aggregating for study of trends, connections The overall goal of the data mining process is to extract information from a data set and transform it into an understandable structure for further use.

Privacy on the Internet Finance Web payments Credit cards Anonymous payments Retained relationships Cookies Site logins Payments in cases of mutual distrust Impersonation Unannounced relationships (tracking)

Privacy on the Internet Tracking Web bugs Keystrokes logging Spyware and Adware hijacking

Secure No sender assurance; little ability to track the origin of a message Insecure channels Monitoring Anonymous and r ers Spoofing, spam

Emerging Technologies Examples RFID – Radio-frequency identification Definition Uses Misuses Electronic voting Far election principles Contrast to fairness of paper ballot, mechanical voting techniques Internet voting Voice over IP

Legal and Ethical Issues in Computer Security This is a very broad topic – some topics for class discussion based on case studies are: Determining current and national laws concerning personal privacy and computer records, computer fraud, or hacking, given that laws change frequently Review recent prosecutions of computer crime cases to see what laws where used for this prosecution

Legal and Ethical Issues in Computer Security How to address the international aspect of computer crime – i.e. when a criminal in one country commits a crime against a computer in another country - Whose law is broken? - Whose police and courts have jurisdiction? - How should the crime be investigated? - What if the transaction is passed through

Information Security Management and Security Controls Key area relating to ISO/IEC code of practice for information security management and security controls in terms of: general principles, best practice recommendations, established guidelines and any specific issues within this area

Thank You !