NPC Speaker Series - Security and Privacy in Processing

these are 20,000 own the topic assigned to me is the minimum standard test for the European privacy in processing this is the gist of the compliance of the entire solution in terms of latest regulatory function as a commission is we have any idea how it plays a big process nowadays in the digital economy this is a specific piece of strategic importance because in social economics and the governmental activities production of filter is very enormous with the adoption of cloud computing Internet of Things big data as well as the interconnectivity using the 5g Network the production of personal information is soaked in oil knows that it has more benefits than a liability for all stakeholders so in other words the greatest concern nowadays is the use of data in who-ville process the visa Delta the sorts of things are and how willingness we are in terms of propagating that we know that is being used so for this afternoon's presentation has we based my minimal standards on the name a key privacy management accountability network so this we prevent the maintenance of information security program based on the legal interest assessment involving these attachments you will notice that there are the word the first word there there is the word maintain and integrated so in the word maintain that's an assumption that all of your organization's do have the existing program will come up with the privacy but then say integrate integrate bits of privacy issue your existing policy let's start with liquid optional basically data privacy risk into security versus attested a senator is attachment enables an organization to identify threats and associated vulnerabilities which have the potential to negatively impact the business the security area tested against all the partners and computer systems within the organization including those who collect processes for entrance with visa normally your spectacle organizations you have your security assessment however integrating data privacy will enable you to further explore the possibility of having a more specific curve guideline when it comes to data privacy second integrate data privacy import information security policy an organization who have their security policies you have our quality policy but we in integrating data privacy it requires a it explains the whole in the while but not how the processing of pizza so our security policy source or high-level statements which to our exciting directions of and support for information security it's supported by standards I ignite and oppression of the figures which explain in details how to execute against the policy requirements so how do you guys have happen integrate the data privacy into your security policy first identified who the persons who will be the key role in the protection of the data privacy within the organization it also explains why this data has to be protected in its authority within the organization next maintain technical security measures I am pretty sure that most of the advantages here have their own security measures like firewalls intrusion detection system improves and prevention systems and so on and so forth so if you maintain a few limping security measures if they've got organizations to attack from experience and internal risk the technical security measures one piece of hardware in software controls organizations use to provide ultimate intersection physicist sent in application some in terms of the technical security measured equals the battery then take measures to increase personal data as mentioned earlier there are several encryption methods encryption of the encryption methods that we use like for example the Advanced Encryption standard to five clicks which we mean by three T cells why we use internationally however there are sent there are several encryption standards that do not conform with in with the right information security that's doesn't have for example above data is what encrypted using by aes-256 but technically the concept about Egyptians that there's a certain algorithm that will be applied to the Delta so that's for you to be able to process it as in radius you need to depreciate but what if the inside database which because it's a real equipment and decryption so what is your remedy for that so you're summing success another security for encryption is that you break the data into half separated it say for example the name address firstly is the other parts of the person that information and apply two different algorithms for the encryption of things are in that field the other half of stolen or ha so definitely it will not be correlated to the other half of the entire design ok so do not you take your data as a whole encrypt your data if slicing since a procedure to restrict access to personal information after the personal basis restricted employees and user specific business needs this includes controls the user provisioning like a being verifying and initial user profile imagine a company which is all the types of employees have their access to the database including adding the music and modifying information I'm sure most of both of those annotations here have this have this occurs later privacy policy that allow only certain kind of individuals which has easy access for certain level of access to the be the pub so now personal information education of unit ensures that once the fault which will exist which could present a security for private area this privacy management affinity will focus on the private a specific aspect of managing the personal data fell aside for managing the network managing the software can also integrate data properties of corporate security policy which includes the physical presences and hard assets of the company it includes the use of CCTV security guard protected by up barriers plus access controls other techniques of a such physical asset and in addition there should be certain levels of security system security package inside the vicinity of your since prospective organization next maintain human resource security measures get includes the training and awareness program and the company organization must must must have in order for you to have adequate environmental calculator privacy starts in hiring people and in terms of this hiring of people you have a you should help a Apple Genius Langley in awareness program especially on data privacy they imagine a an employee in a company Omar Pasha supposing a discreet card then somebody asked him so if if I can enter to display the technical side of my part in the absence of a training and awareness program probably be still employees might be able to have access to that particular person who may be enemy soldiers or simply just want to get into with the hamper the premises yes II think I think the privacy for business complain disciplined in organization maintains a beat to continue to plan that identifies organizations for sure the internal external threats defines how the organization recovers from a visa dissolve entity confidentiality and integrity of personal data imagine organization got burned in a fire then what after your facility ensures however you get your beta we will get the program so you get the hardware software how your so how do you restore everything in terms of business community facility processes so it's very important that contains a plan for business not sticking to the dimensions in order to is in order from you super safe being travelinv organization net its maintain a data loss prevention strategy based on observations properly this basal observation control process esophageal observers of them to the protection of sensitive information in all ways for the additional spoken be of these that means to prevent an automatic closure of these are in France and by providing metadata into practice and penetration when sample you have a base our you have a base are in one class village L square halogen olives the basic base and splitted smoothly for being step to the right of our heroes various persons then it's also that these are a better example agrees with the is the remember our card for freaking shoppers once it's wipe over card who wouldn't know sanika photography beta pinot noir achievement data in what information are being received by a recipient of this data that should be the collectively the main purpose for these if differentiation of data the visibility in a traditional disability with the disability in terms of a bailer subject we will get to know how your days as being sent to other parties with or outside organizations next pull back regular sensitive data security for cure basis organization security risk assessment a very odd expressions organization security posture from DuckTales you should identify those are abilities and once they identify the vulnerability the boldero narrative should become a trail so they are the center fielder to the floor vulnerable to be hunt forward classify these are correct neighbors where organization program in the end correct after the organization fashion vulnerability strategy so stepping is part of this penetration testing is also part of a visa process and if you detect one should apply is a success Angeles based on the existing security quality of the organization lastly is what's the question very big air maintain a security certificate or an organization services and agency the Swiss is a qualified third party provider independence the Cobra security availability property integrity person in charity and privately also ISO 27001 or 27,000 using the snaps second assurance let your compliance is a regulation with the management of the natural biological ethos which is somehow an assurance that you're partially compliant as mentioned earlier by a Deputy Commissioner Jodi mapa so even at the height of open 7,001 to the right way to support work ensure the security of an organization however absolutely secure it is set aside to develop a core sort of climate information and protecting it for a strong - commitment we information security individual ownership and responsibility for information security and lastly effective information security education and awareness in summary the maintenance of information security life on the house the personal needs as being preferred to to protect its integrity and availability in general when you sum up with your maintenance program information security should member three things first there should be a policy then a policy term it means down imposed standards and standards everything does impose procedures okay so we're just mentioned by our third exam we will entertain questions after let us search ends of deception thank you very much you

Channel: National Privacy Commission

Views: 916

Rating: 5 out of 5

Keywords: Data Security, Privacy, National Privacy Commission, Filipino Rights, Digital Age, Security Risks, Government, Law, Philippines, Digital, Information, Processing, Security

Id: DimbFiEKfgQ

Length: 13min 41sec (821 seconds)

Published: Tue May 23 2017