Module IV·Article III·~1 min read
Data Protection and Privacy: Technical Measures
Cybersecurity and Risk
Turn this article into a podcast
Pick voices, format, length — AI generates the audio
Privacy by Design
The principle of “privacy by default”: data protection must be built into the system from the start, not added later. Seven principles of Ann Cavoukian: proactivity; privacy by default; embedded into design; full functionality; end-to-end security; visibility and transparency; respect for the user.
Technical Measures for Data Protection
Encryption: at-rest (data in storage) and in-transit (data in transmission). AES-256 for storage, TLS 1.3 for transmission. The “golden rule”: encrypt everything possible.
Tokenization: replacement of sensitive data (card number) with a random token. Even in the event of a leak, the token is useless without the key.
Anonymization and pseudonymization: reversible (pseudonymization) and irreversible (anonymization) removal of identifying features. GDPR distinguishes: anonymous data is not regulated, pseudonymized data is regulated.
Data Masking: replacement of real data in non-production environments. Developers see realistic but fictitious data.
Identity & Access Management (IAM)
IAM — who has access to what. Principles: least privilege; separation of duties (one person cannot create a payment AND approve it); regular access review; immediate deprovisioning upon termination.
PAM (Privileged Access Management): management of privileged accounts (administrators, DBA). The highest-risk accounts are under special control.
Practical Task
The company stores clients’ personal data (names, addresses, payment data) in a MySQL database. Conduct a basic technical audit: (1) Is the database encrypted at-rest? (2) Who has direct access to the database? Does this comply with the least privilege principle? (3) How is data transmitted between the application and the database? (4) Is masking implemented in test environments?
§ Act · what next