Information Security Matters: Privacy by Implementation and Execution

When I was in graduate school, I read a lot of scholarly journals. (None of them were as lively nor as useful as the journal you are now reading.) One of the features I loved best was a rousing argument between academics about matters of miniscule interest to the general public. The articles, letters, counterarticles and counterletters were full of high dudgeon, ad hominem attacks and general rapscalliousness.

A few issues back in the ISACA^® Journal, I published two articles about data privacy.^{1, 2} They expressed my skepticism that current privacy laws, especially the EU General Data Protection Regulation (GDPR), would accomplish their stated aims, with particular focus on the concept of “privacy by design.” Not for the first time, I staked out a contrarian position in hopes of stirring up some controversy.

And controversy I got. In a subsequent issue of this Journal, Mr. Ian Cooke begged to differ.³ (You can meet Mr. Cooke a few pages hence, as he, too, is a columnist here.) I want to point out first that Mr. Cooke is in very low dudgeon, is respectful throughout his reply and is in no sense a rapscallion.⁴ I will offer my ripostes in the same spirit.

Replying to Comments

I had said that “data privacy laws should be focused on cases of actual harm.”⁵ Mr. Cooke points out that Facebook is accused of causing genuine harm by “restricting who can view housing-related ads based on their ‘race, colour, national origin, religion,’”⁶ which are sensitive personal data under GDPR. We are in complete agreement, and that sort of misuse of personally identifiable information (PII) is the theme of my second article about organizations that design un-privacy⁷ into their systems. I believe and I have stated that we will achieve greater data privacy across society if we focus attention on breaches that hurt people and not on violations of process and protocol.

I directed some disdain at the inscrutable prose in the “Privacy by Design” section of GDPR⁸ and stated that it was clearly written by a committee. Mr. Cooke rises to the defense of laws written by multiple representatives. My objection is not to writing groups, as such, but to the type of incomprehensible verbiage that they often produce. I am not the first to note that a camel is a horse put together by a committee. On this issue, alas, I believe Mr. Cooke and I fated to disagree.

Most importantly, Mr. Cooke examines whether cyberattacks that resulted in privacy breaches are caused by a failure of design. Here our difference of opinion is foundational and worth exploring in further depth.

Cyberattacks, Privacy and Risk Assessment

I mentioned several such attacks in one of my articles, one of which was the massive breach at Equifax.⁹ I do find it shocking that a company that is in the PII business could be so lax. But were their systems poorly designed in terms of protecting the information in their trust? According to press reports, a good case could be made, inasmuch as Equifax had experienced several successful cyberattacks in the previous year.¹⁰

NO MATTER HOW WELL AN ORGANIZATION’S SYSTEMS ARE DESIGNED AND IMPLEMENTED, THEY RUN ON OPERATING SYSTEMS AND OTHER INFRASTRUCTURE IN WHICH FLAWS ARE IDENTIFIED DAILY.

But without getting into the particulars of this case, about which I have no personal knowledge, let us ask the broader question: Are successful cyberattacks indicative of poor privacy and security design? Based on my experience, I think not. No organization that I have dealt with sets out to have inadequate security. The fact that their security proves to be deficient is often based on a shortfall in risk assessment.

It is well understood that organizations should evaluate the risk to their information resources and apply suitable controls consistent with their understanding of the potential for those resources to be misused. But sadly, there may be a gap between the assessment and the reality. Assessments are extrapolations of known facts into potential outcomes. To the extent that imprecision leads to error, these organizations find themselves exposed.

Banks know that their information is valuable and at risk. So does the military. Yet banks have been severely attacked¹¹ and so have military systems.¹² Surely no one thinks that organizations such as these are incapable of designing security—and by extension privacy—into their systems. Someone was simply able to exploit a shortcoming that a risk assessment did not and could not identify in advance.

Implementation and Execution

Ah, I can hear Mr. Cooke asking me, but how did those weaknesses get there? And I would answer, should he ask, that security was designed properly but not implemented well. And even then, complete implementation of security is impossible. No matter how well an organization’s systems are designed and implemented, they run on operating systems and other infrastructure in which flaws are identified daily. If there were to be a zero-day attack, how could any organization be faulted for failing to anticipate and prevent it?

Even if perfect implementation were possible, perfect execution cannot be, because execution relies on fallible human beings. Security systems that undergird privacy will never be foolproof because the world contains too many fools. Yes, an organization could design systems that anticipate dumb people doing dumb things, but too many breaches are due to the failings of otherwise smart people. And that is not to mention the unscrupulous and avaricious among us. Errors will occur and personal information will be disclosed because of failures of trust as well as deficiencies of security.

Time Pressure

As I wrote in the Un-Privacy article, it is the exigencies of the market that lead to poor privacy over personal information. There is tremendous pressure to get software to the market as quickly as possible. As it is, too much software is delivered that does not do what it is supposed to do; it is probably too much to ask that it not do what it is not supposed to do, that is, disclose PII.

It is not only commercial software that makes privacy by design difficult to implement and execute. Agile development, so popular these days, creates challenges in complying with GDPR and other privacy requirements. In my opinion, Agile undervalues documentation, which makes it difficult for auditors and privacy specialists to determine whether and how privacy has been designed into a system.¹³ While I am not saying that Agile is the enemy of privacy, I do believe that it is one more factor that mitigates against implementing adequate privacy in system development.

So, Mr. Cooke, we both agree that privacy by design is an admirable objective. Everybody ought to do it, but then everyone also ought to live in virtue and abhor sin. I am in favor of both privacy and virtue, but I remain dubious about their achievement.

Endnotes

¹ Ross, S. J.; “Why Do We Need Data Privacy Laws?” ISACA^® Journal, vol. 5, 2019, https://www.isaca.org/archives
² Ross, S. J.; “Un-Privacy by Design,” ISACA Journal, vol. 6, 2019, https://www.isaca.org/archives
³ Cooke, I.; “In Defense of Privacy by Design,” ISACA Journal, vol. 3, 2020, https://www.isaca.org/archives
⁴ Each of us submits our articles four months before they are published, so this conversation is occurring in slow motion, although Mr. Cooke and I did speak in March 2020.
⁵ Op cit Ross, 2019, “Why Do We Need Data Privacy Laws?”
⁶ Op cit Cooke
⁷ This is a neologism if ever there was one, but it suits the purpose. If it is not a proper English word, it ought to be. It’s my word and I’m sticking with it.
⁸ Intersoft Consulting, Art. 25 GDPR, Data Protection by Design and by Default, European Union, 2016, https://gdpr-info.eu/art-25-gdpr/
⁹ Siegel Bernard, T.; T. Hsu; N. Perlroth; R. Lieber; “Equifax Says Cyberattack May Have Affected 143 Million in the U.S.,” The New York Times, 7 September 2017, https://www.nytimes.com/2017/09/07/business/equifax-cyberattack.html?searchResultPosition=8
¹⁰ Ibid.
¹¹ Cowley, S.; N. Perlroth; “Capital One Breach Shows a Bank Hacker Needs Just One Gap to Wreak Havoc,” The New York Times, 30 July 2019, https://www.nytimes.com/2019/07/30/business/bank-hacks-capital-one.html
¹² Baron, K.; “Attacks on DOD Networks Soar as Telework Inflicts ‘Unprecedented’ Loads,” Defense One, 16 March, 2020, https://www.defenseone.com/threats/2020/03/attacks-dod-networks-spike-telework-brings-unprecedented-loads/163812/
¹³ Foomany, F. H.; M. Miri; N. Mohammed; “A Tagging Approach to PIAs in Agile Software Development,” International Association of Privacy Professionals (IAPP), 13 December 2017, https://iapp.org/news/a/a-tagging-approach-to-pias-in-agile-software-development/

Steven J. Ross, CISA, AFBCI, CISSP, MBCP

Is executive principal of Risk Masters International LLC. Ross has been writing one of the Journal’s most popular columns since 1998. He can be reached at stross@riskmastersintl.com.