RSA Conference Europe 2013 - When Security Met Privacy

This year’s RSA Conference Europe is themed around how ‘Big Data Transforms Security,’ requiring support from and feeding into the corporate security function. The tone was set by one quotation from RSA’s CEO Art Coviello in his welcoming keynote, where he proclaimed that “Anonymity is the enemy of privacy.” In other conference sessions, the implications of processing personal information have come up time and again as flashpoints between the security and privacy communities – but are these disciplines really poles apart?

In his keynote, Coviello went on to explain that in his opinion anonymity is used by digital adversaries to misuse data without fear of being caught or prosecuted. That’s fighting talk for privacy advocates, who would of course argue that anonymity is a critical privacy tool, which must be interpreted in subtle and granular ways: zero-knowledge proofs, anonymous attributes and pseudonymous interactions are applications of anonymity which preserve privacy without impeding business objecties or putting data at risk. But within the corporate user environment, which is RSA’s customer heartland, the argument holds sway and few employees would have an expectation of privacy that extends to anonymity in their working environment.

Not all of the keynote was quite so contentious, and Coviello used the analogy of privacy and security functions as opposite magnetic poles, which can attract each other when aligned, and can form a powerful bond. It’s a lofty ambition, but for many organisations the security and privacy functions still exist in a state of polar repulsion, with security and privacy teams located in different divisions, serving different masters for different outcomes. Privacy functions in particular, hidden away from the sharp end of business delivery in the likes of compliance or legal teams, too often retain a risk-averse culture and a tendency to say ‘no’ when confronted with a challenging business objective.

Unfortunately, for organisations which suffer this bipolar management of personal information, the nexus between security and privacy is too often in incident management, as the Privacy Officer and Security Officer fight over who should have secured the missing personal data asset, and what to do about its loss. The result is that everyone loses, including the individuals whose data has been leaked or misused, and the security and privacy functions remain in conflict, confined to reacting to incidents rather than taking proactive control of processing risks.

If organisations are to exploit big data, then privacy and security functions need to align to create a shared understanding of risk throughout every part of the project lifecycle. Business cases and change requests should be checked not only for security compliance, but also to ensure that they meet corporate risk appetites in the handling of personal information, as well as legal and sectoral responsibilities for data protection. A truly aligned security and privacy operation should feature co-location of delivery teams, both reporting to a single responsible officer who can identify and resolve problems before they boil over, but equally can ensure that risk decisions take into account both security and privacy needs.

The RSA Conference will of course remain the preserve of the information security community, but with this level of focus on privacy needs, it’s likely to become a compelling event for privacy professionals too – and that can only be a good thing for personal data risk management.

[Declaration of interest: I am a member of the RSA Conference Europe programme committee]