ISC2 CISSP (Certified Information Systems Security Professional)Security Architecture and EngineeringMedium
A healthcare organization is developing a new patient record system. They need to ensure that the system design inherently protects patient privacy throughout the entire data lifecycle, from collection to deletion, without requiring extensive add-on security features. Which design principle is being emphasized here?
- APrivacy by Design
- BDefense in Depth
- CSecurity by Obscurity
- DLeast Privilege
Show answer & explanationAnswer & explanation
Correct answer: A. Privacy by Design
Privacy by Design (PbD) is a principle that advocates for the inclusion of privacy considerations into the design and operation of information systems, networked infrastructure, and business practices, from the outset. It ensures privacy is proactively embedded, not reactively added.
Why the other options are wrong
- B. Defense in Depth uses multiple layers of security, which is a security strategy, not a privacy-focused design principle.
- C. Security by Obscurity relies on hiding implementation details, which is not a robust security principle.
- D. Least Privilege grants minimal necessary access, a security principle, but not the overarching design philosophy for privacy.
Privacy by Design (PbD)
A framework for embedding privacy principles into the design and operation of information technologies, networked infrastructure, and business practices.
- Developed by Ann Cavoukian in the 1990s.
- Emphasizes proactive rather than reactive privacy measures.
- One of the seven foundational principles is 'Privacy Embedded into Design'.
Memory trick: Design for Privacy, not as an afterthought.