Difference between revisions of "Summit 2011 Working Sessions/Session073"

Privacy is a growing area of concern in the US, and might have greater awareness & understanding in the EU than security. Should OWASP say more about protecting personal data? Security is just one aspect of data protection, but many data breaches have been the result of application vulnerabilities.

This session will be useful for project leaders, as well as anyone in sectors collecting, processing or storing personal data (e.g. of consumers, citizens and employees).

• Application Security Verification Standard - V9 Data Protection
• Application Security Desk Reference (ASDR) - Vulnerabilities - Privacy Violation

• US Federal Trade Commission (FTC) Preliminary Staff Report on Privacy, 12 December 2010
• European Parliament Asks the European Commission to Protect Online Users from Advertising, 15 December 2010
• Members Appointed to US Privacy and Civil Liberties Oversight Board, 16 December 2010
• Department of Commerce Publishes Green Paper Recommending Creation of a Privacy 'Bill of Rights' for Internet Users, 16 December 2010

Can we map projects (tools and sections in resources) to business drivers such as "privacy"?

Privacy aspects are referred to through the wiki (including projects):

But there is not any central guide, and perhaps what there is, does not have enough depth. ASVS includes a whole verification topic about data protection and the ASDR has a page on privacy as a "vulnerability". The OWASP Top ten 2010 mentions personal data in the context of insecure cryptographic storage, but privacy protection is of course much wider than encrypting data. It is of course much wider than application security:

But is OWASP offering the correct guidance in this area? Should OWASP be doing more?

{{{summit_session_deliverable_name6}}}

{{{summit_session_deliverable_name7}}}

{{{summit_session_deliverable_name8}}}