Abstract
Privacy is being a trending topic in cybersecurity context not only because it is related to current regulations such as GDPR, but also because it has an impact on every citizen within this digitalized world. In fact, there is a huge number of software systems managing or processing information related to individuals in somehow, and therefore software developments producing these systems must consider specific privacy measures. Privacy by design concept and shift left strategies are considering privacy as a special topic to be treated along the software development project. In this context, Very Small Companies are required to modify their development processes for including privacy. This paper provides a modification of the ISO/IEC 29110 basic profile, a set of activities for designing a privacy preserving approach, and the results of applying differential privacy mechanisms with an illustrative example.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
The European Parliament and of the Council: Directive 95/46/EC (General Data Protection Regulation) (2016). https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679
National Institute of Standards and Technology (NIST): Guide to Protecting the Confidentiality of Personally Identifiable Information (PII). https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf
Larrucea, X., Santamaria, I., Fernandez‐Gauna, B.: Managing security debt across PLC phases in a VSE context. J. Softw.: Evol. Process (2019). https://doi.org/10.1002/smr.2214
Hicken, A.: Using static analysis to achieve “secure-by-design” for GDPR. https://blog.parasoft.com/using-static-analysis-to-security-design-in-gdpr. Accessed 23 Apr 2020
Larrucea, X., Santamaria, I., Colomo-Palacios, R.: Assessing source code vulnerabilities in a cloud-based system for health systems: OpenNCP. IET Softw. 13, 195–202 (2019). https://doi.org/10.1049/iet-sen.2018.5294
Larrucea, X., Moffie, M., Asaf, S., Santamaria, I.: Towards a GDPR compliant way to secure European cross border Healthcare Industry 4.0. Comput. Stand. Interfaces 69, 103408 (2020). https://doi.org/10.1016/j.csi.2019.103408
ENISA: Information exchange and communication - What to share. https://www.enisa.europa.eu/topics/national-cyber-security-strategies/information-sharing/isacs-toolkit/tools/build/information-exchange-and-communication/what-to-share. Accessed 30 Dec 2020
Sanchez-Gordon, M.-L., de Amescua, A., O’Connor, R.V., Larrucea, X.: A standard-based framework to integrate software work in small settings. Comput. Stand. Interfaces 54, 162–175 (2017). https://doi.org/10.1016/j.csi.2016.11.009
ISO/IEC: ISO/IEC TR 29110-1:2011. ISO/IEC (2011)
Larrucea, X., O’Connor, R.V., Colomo-Palacios, R., Laporte, C.Y.: Software process improvement in very small organizations. IEEE Softw. 33, 85–89 (2016). https://doi.org/10.1109/MS.2016.42
Larrucea, X., Fernandez-Gauna, B.: A mapping study about the standard ISO/IEC29110. Comput. Stand. Interfaces (2019). https://doi.org/10.1016/j.csi.2019.03.005
Larrucea, X., Santamaría, I.: Correlations study and clustering from SPI experiences in small settings. J. Softw.: Evol. Process 31(1), e1989 (2018). https://doi.org/10.1002/smr.1989
Larrucea, X., Santamaria, I.: Survival studies based on ISO/IEC29110: industrial experiences. Comput. Stand. Interfaces 60, 73–79 (2018). https://doi.org/10.1016/j.csi.2018.04.006
Mesquida, A.-L., Mas, A.: A project management improvement program according to ISO/IEC 29110 and PMBOK (R). J. Softw.-Evol. Process 26, 846–854 (2014). https://doi.org/10.1002/smr.1665
Narayanan, A., Shmatikov, V.: Myths and fallacies of “personally identifiable information.” Commun. ACM 53, 24–26 (2010). https://doi.org/10.1145/1743546.1743558
Sweeney, L.: k-anonymity: a model for protecting privacy. Int. J. Uncertain. Fuzz. Knowl.-Based Syst. 10, 557–570 (2002). https://doi.org/10.1142/S0218488502001648
Xiao, X.: Privacy Preserving Data Publishing (2008)
Gkountouna, O., Angeli, S., Zigomitros, A., Terrovitis, M., Vassiliou, Y.: km-anonymity for continuous data using dynamic hierarchies. In: Domingo-Ferrer, J. (ed.) PSD 2014. LNCS, vol. 8744, pp. 156–169. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-11257-2_13
LeFevre, K., DeWitt, D.J., Ramakrishnan, R.: Mondrian multidimensional k-anonymity. In: 22nd International Conference on Data Engineering (ICDE’06), p. 25. IEEE, Atlanta (2006). https://doi.org/10.1109/ICDE.2006.101
Li, X., Zhou, Z.: A generalization model for multi-record privacy preservation. J. Ambient. Intell. Humaniz. Comput. 11(7), 2899–2912 (2019). https://doi.org/10.1007/s12652-019-01430-y
Machanavajjhala, A., Kifer, D., Gehrke, J., Venkitasubramaniam, M.: L-diversity: privacy beyond k-anonymity. ACM Trans. Knowl. Discov. Data 1(1), 3 (2007). https://doi.org/10.1145/1217299.1217302
Li, N., Li, T., Venkatasubramanian, S.: t-Closeness: privacy beyond k-anonymity and l-diversity. In: 2007 IEEE 23rd International Conference on Data Engineering, pp. 106–115. IEEE, Istanbul (2007). https://doi.org/10.1109/ICDE.2007.367856
Dwork, C.: Differential privacy. In: Bugliesi, M., Preneel, B., Sassone, V., Wegener, I. (eds.) ICALP 2006. LNCS, vol. 4052, pp. 1–12. Springer, Heidelberg (2006). https://doi.org/10.1007/11787006_1
Chen, S., Fu, A., Shen, J., Yu, S., Wang, H., Sun, H.: RNN-DP: a new differential privacy scheme base on recurrent neural network for dynamic trajectory privacy protection. J. Netw. Comput. Appl. 168, 102736 (2020). https://doi.org/10.1016/j.jnca.2020.102736
Sánchez, D., Domingo-Ferrer, J., Martínez, S., Soria-Comas, J.: Utility-preserving differentially private data releases via individual ranking microaggregation. Inf. Fus. 30, 1–14 (2016). https://doi.org/10.1016/j.inffus.2015.11.002
Friedman, A., Schuster, A.: Data mining with differential privacy. In: Proceedings of the 16th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining - KDD ’10, p. 493. ACM Press, Washington, DC (2010). https://doi.org/10.1145/1835804.1835868
Chen, R., Mohammed, N., Fung, B., Desai, B., Xiong, L.: Publishing set-valued data via differential privacy. Proc. VLDB Endow. 4(11), 1087–1098 (2011). https://doi.org/10.14778/3402707.3402744
Garfinkel, S., Abowd, J.M., Martindale, C.: Understanding database reconstruction attacks on public data. Commun. ACM 62, 46–53 (2019). https://doi.org/10.1145/3287287
Wirth, R.: CRISP-DM: towards a standard process model for data mining. In: Proceedings of the Fourth International Conference on the Practical Application of Knowledge Discovery and Data Mining, pp. 29–39 (2000)
Huber, S., Wiemer, H., Schneider, D., Ihlenfeldt, S.: DMME: data mining methodology for engineering applications – a holistic extension to the CRISP-DM model. Procedia CIRP. 79, 403–408 (2019). https://doi.org/10.1016/j.procir.2019.02.106
Härting, R.-C., Sprengel, A.: Cost-benefit considerations for data analytics - an SME-oriented framework enhanced by a management perspective and the process of idea generation. Procedia Comput. Sci. 159, 1537–1546 (2019). https://doi.org/10.1016/j.procs.2019.09.324
Dwork, C., McSherry, F., Nissim, K., Smith, A.: Calibrating noise to sensitivity in private data analysis. In: Halevi, S., Rabin, T. (eds.) TCC 2006. LNCS, vol. 3876, pp. 265–284. Springer, Heidelberg (2006). https://doi.org/10.1007/11681878_14
Rodríguez-Barroso, N., et al.: Federated learning and differential privacy: software tools analysis, the Sherpa.ai FL framework and methodological guidelines for preserving data privacy. Inf. Fus. 64, 270–292 (2020). https://doi.org/10.1016/j.inffus.2020.07.009
Rubinstein, B.I.P., Aldà, F.: Pain-free random differential privacy with sensitivity sampling. arXiv:1706.02562 [cs, stat] (2017)
Johnson, C.S., Badger, M.L., Waltermire, D.A., Snyder, J., Skorupka, C.: Guide to cyber threat information sharing. National Institute of Standards and Technology (2016). https://doi.org/10.6028/NIST.SP.800-150
Acknowledgements
This work has been partially supported by the Basque Government (SPRI) project called “Trustind - Creating Trust In The Industrial Digital Transformation” (KK-2020/00054) and by the “SPEAR” project (H2020).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2021 Springer Nature Switzerland AG
About this paper
Cite this paper
Larrucea, X., Santamaria, I. (2021). Dealing with Privacy for Protecting Information. In: Yilmaz, M., Clarke, P., Messnarz, R., Reiner, M. (eds) Systems, Software and Services Process Improvement. EuroSPI 2021. Communications in Computer and Information Science, vol 1442. Springer, Cham. https://doi.org/10.1007/978-3-030-85521-5_34
Download citation
DOI: https://doi.org/10.1007/978-3-030-85521-5_34
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-85520-8
Online ISBN: 978-3-030-85521-5
eBook Packages: Computer ScienceComputer Science (R0)