Difference between revisions of "IoTSec:Privacy Label explanation"
From its-wiki.no
Josef.Noll (Talk | contribs) |
Josef.Noll (Talk | contribs) |
||
| Line 6: | Line 6: | ||
<span style="color:#009000">Open issues | <span style="color:#009000">Open issues | ||
| − | * access control (authentication) - transparency of authentication level | + | <span style="color:#009000">* access control (authentication) - transparency of authentication level |
| − | * maintenance and update</span> | + | <span style="color:#009000">* maintenance and update</span> |
A++ | A++ | ||
| − | * no data are shared | + | <span style="color:#009000">* no data are shared |
A+ | A+ | ||
A - Very high | A - Very high | ||
| − | * | + | * <span style="color:#009000"> restricted use of data to purpose only (particular service) |
* supplier should bear the risk of incidents, e.g. they rathe than I get penalised when things go wrong - equivalent to finansavtaleloven | * supplier should bear the risk of incidents, e.g. they rathe than I get penalised when things go wrong - equivalent to finansavtaleloven | ||
* if device is stolen - nobody else | * if device is stolen - nobody else | ||
B | B | ||
| + | * <span style="color:#009000"> specify the data to be collected, re-use for statistical data only, ensured integrity | ||
* customizable access control, eg.. add stronger authentication or consent requirements | * customizable access control, eg.. add stronger authentication or consent requirements | ||
* must be able to trade off the various security requirements, e.g. confidentiality agains availability - i.e. I want flexibility | * must be able to trade off the various security requirements, e.g. confidentiality agains availability - i.e. I want flexibility | ||
| Line 27: | Line 28: | ||
C | C | ||
| + | * <span style="color:#009000"> data are collected without control (GPS+activity+heart rate), re-use only for statistical, encrypted storage | ||
| + | |||
* must be possible to withdraw consent - and that this results in all relevant information being deleted - and proof of deletion | * must be possible to withdraw consent - and that this results in all relevant information being deleted - and proof of deletion | ||
D | D | ||
| + | * <span style="color:#009000"> data are collected, transparency of re-use | ||
* Data is not sold without consent/knowledge | * Data is not sold without consent/knowledge | ||
* transparency - I get told about the criteria that the supplier has used in their information classification | * transparency - I get told about the criteria that the supplier has used in their information classification | ||
| Line 36: | Line 40: | ||
E | E | ||
| + | * <span style="color:#009000"> collected data, no transparency of re-use | ||
| + | |||
* in compliance with GDPR | * in compliance with GDPR | ||
* if data is stolen, I will get told | * if data is stolen, I will get told | ||
| Line 42: | Line 48: | ||
F - Failure | F - Failure | ||
| + | * no privacy, no control of data, ''everyone can see'' | ||
* nothing , no expectations | * nothing , no expectations | ||
| + | |||
| + | Group 2: | ||
| + | |||
| + | strong, | ||
| + | |||
| + | medium, | ||
| + | |||
| + | weak | ||
| + | |||
| + | |||
| + | * data | ||
| + | * control functionality | ||
| + | * security techniques | ||
| + | * accountability | ||
| + | * access to data | ||
Revision as of 14:35, 20 November 2017
| Security in IoT for Smart Grids | |||||||
|---|---|---|---|---|---|---|---|
|
|
Four areas
- which data are collected
- sharing to my phone, my cloud, public cloud,...
- data communication integrity and storage
- further distribution of data, ownership of data, further processing
Open issues * access control (authentication) - transparency of authentication level * maintenance and update
A++ * no data are shared
A+
A - Very high
- restricted use of data to purpose only (particular service)
- supplier should bear the risk of incidents, e.g. they rathe than I get penalised when things go wrong - equivalent to finansavtaleloven
- if device is stolen - nobody else
B
- specify the data to be collected, re-use for statistical data only, ensured integrity
- customizable access control, eg.. add stronger authentication or consent requirements
- must be able to trade off the various security requirements, e.g. confidentiality agains availability - i.e. I want flexibility
- compliance with other standards - and this be listed (information requirement) - clipper compatible
- anonymity of my interaction with the supplier
- customer can control with how the information is transferred and used by a third party
C
- data are collected without control (GPS+activity+heart rate), re-use only for statistical, encrypted storage
- must be possible to withdraw consent - and that this results in all relevant information being deleted - and proof of deletion
D
- data are collected, transparency of re-use
- Data is not sold without consent/knowledge
- transparency - I get told about the criteria that the supplier has used in their information classification
- Information is only used for its legitimate purpose
E
- collected data, no transparency of re-use
- in compliance with GDPR
- if data is stolen, I will get told
- notification if DSO is hacked
F - Failure
- no privacy, no control of data, everyone can see
- nothing , no expectations
Group 2:
strong,
medium,
weak
- data
- control functionality
- security techniques
- accountability
- access to data