The Architecture of Privacy

Chapter 4. Information Security: Protecting Data from Unauthorized Access

For the purposes of this book, privacy protection is primarily about regulating authorized access to and use of data. Information security (InfoSec for short, or cybersecurity), which is primarily about stopping unauthorized access to information, is what makes privacy protection possible. Without controlling unauthorized access, building a privacy protection regime for authorized users is moot because any protection that can be easily circumvented is no true protection at all.

Whereas the implementation of privacy and security are concerned with guarding against different threats, they do make use of the same technologies such as encryption, auditing, logging, access controls, separation of concerns, alerting, active monitoring, and investigation. It could therefore be quite understandable for an organization that has not thought extensively about the underlying distinctions to mistake privacy for security. But an architecture is an arrangement of things to constitute a whole with desired properties, and the desired properties for protecting privacy and for securing against unauthorized access are not the same. Each requires unique design considerations.

If your organization does not have a dedicated information security team, get one. If your organization already has a dedicated InfoSec team, bring them into the design process early. As the experts on your network security, they will have invaluable advice ...