Difference between revisions of "OWASP Top 10 Privacy Risks Project"

Why is this project only about web applications and not about any kind of software?

Web applications can easily collect data from users without their permission or informing them about the usage of their data. Trackers and cookies deliberately enable the monitoring of the users behaviour, often for selling those data. That is the reason why this subject is so important, especialy for web applications.

What is the difference between this project and the OWASP top 10?

There are two main differences. First, the OWASP top 10 describes technical risks, that are not primarily affecting privacy. Second, the OWASP top 10 does neither regard intended parts of the software like cookies or trackers nor organisational issues like privacy agreements or profiling.

Why should companys and other organisations be concerned about privacy risks?

Privacy risks may have serious consequences for an organisation, such as:

   perceived harm to privacy;
   a failure to meet public expectations on the protection of personal information;
   retrospective imposition of regulatory conditions;
   low adoption rates or poor participation in the scheme from both the public and partner organisations;
   the costs of redesigning the system or retro-fitting solutions;
   collapse of a project or completed system;
   withdrawal of support from key supporting organisations due to perceived privacy harms; and/ or
   failure to comply with the law, leading to:
       enforcement action from the regulator; or
       compensation claims from individuals.
   (Source: http://ico.org.uk/pia_handbook_html_v2/html/1-Chap2-2.html)

Volunteers

The Top 10 Privacy Risk list is developed by a team of volunteers. The primary contributors to date have been:

• Florian Stahl
• Stefan Burgmair

Partners

• University of Applied Sciences Munich
• msg systems

As of February 2014, the priorities are:

• Collection of interested participants (building a team) - Q1/2014.
• Draft ideas for top 10-20 privacy risks - Q2/2014.
• Prioritize/rate and improve the list of Top 10 Privacy Risks until end of 2014 (Version 1.0).
• Ongoing improvement / re-rating.

Involvement in the development and promotion of the project is actively encouraged! You do not have to be a security or privacy expert in order to contribute. Some of the ways you can help:

• Answer the questionnaire for identifying and rating the Top 10 privacy list (will be provided soon)
• Tell your colleagues and friends about the project
• Provide feedback and input (feel free to contact us)