GDPR Compliance in Cybersecurity Software: A Case Study of DPIA in Information Sharing Platform

被引：18

作者：

Horak, Martin ^{[1
]}

Stupka, Vaclav ^{[1
]}

Husak, Martin ^{[1
]}

机构：

[1] Masaryk Univ, Inst Comp Sci, Brno, Czech Republic

来源：

14TH INTERNATIONAL CONFERENCE ON AVAILABILITY, RELIABILITY AND SECURITY (ARES 2019) | 2019年

关键词：

Intrusion detection; Information sharing; GDPR; Personal data; Privacy; CSIRT;

D O I：

10.1145/3339252.3340516

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

In this article, we discuss the issues of GDPR's impact on cyber-security software and operations, namely automated information sharing. We illustrate the topic on an example of an intrusion detection alert sharing platform. First, we had to investigate the risks to privacy in the alert sharing platform and ensure its compliance with the GDPR's obligations. Second, fears and uncertainties emerged in the alert sharing community regarding the GDPR and its obligations and, thus, willingness to share the information was negatively impacted. We conducted DPIA to investigate risks related to information sharing in cyber security and dismiss doubts within the community. Although our results suggest that the risks are not high, we point out that the hype around GDPR caused substantial development of the sharing platform. The DPIA helped in a deeper understanding of risks and their management and is a solid argument for information sharing in cyber security under GDPR.

引用

页数：8

共 17 条

[1]

Article 29 Working party, 2017, GUID DAT PROT IMP AS

[2] Network entity characterization and attack prediction [J].

Bartos, Vaclav ;

Zadnik, Martin ;

Habib, Sheikh Mahbub ;

Vasilomanolakis, Emmanouil .

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE, 2019, 97 :674-686

[3] Privacy Risk in Cybersecurity Data Sharing [J].

Bhatia, Jaspreet ;

Breaux, Travis D. ;

Friedberg, Liora ;

Hibshi, Hanan ;

Smullen, Daniel .

WISCS'16: PROCEEDINGS OF THE 2016 ACM WORKSHOP ON INFORMATION SHARING AND COLLABORATIVE SECURITY, 2016, :57-64

[4]

Debar H., 2007, INTRUSION DETECTION

[5]

ENISA, 2014, Standards and tools for exchange and processing of actionable information

[6]

ENISA, 2011, FLAIR SHAR ENC INF E

[7]

ENISA, 2013, Technical Report

[8]

Hellwig Otto, 2018, P 13 INT C AV REL SE

[9]

Husak Martin, 2019, P 14 INT C AV REL SE

[10]

Kacha P., 2014, 18 INT C CIRC SYST C

← 1 2 →