IBM and the future of privacy Do the benefits of the electronic age come with a privacy trade off?

1. IBM and the future of privacyDo the benefits of the electronic age come with a privacy trade off? John Martin Security Practice Leader – IBM New Zealand

2. Agenda • Current Trends • Incident after Incident • Data governance • A framework • Privacy • Summary

3. Current Trends • Firm allegedly sold personal data from millions • Laptop loaded with HP employee data stolen from Fidelity • 40,000 BP’s identities stolen – 4 laptops, Cisco, IBM • Google privacy win – first battle • Visa warns software may store PINs • Researchers warn of coming tax scams • The high cost of data loss

4. Information is the lifeblood of our economy Making good use of information and getting value versus protection Private data needs to be secure What policies? Who to share it with? How to share it? Who is going to manage it? Information sharing will grow Is it a natural trade off? Business, government managing data – what is best practices? Incident after incident of data being leaked or compromise or made vulnerable – day by day

5. Privacy at all levels Data governance Must consider the appropriate security & privacy measures for each entity with whom you interact Partners Customers Suppliers • The long-term stability and growth is directly influenced by security and resilience focus across critical areas of the operations • Focusing only on the IT related layers is sub-optimal and does not address the complete security needs Security Strategy Security People Security Process Security Applications & Data Security Security Technology Security Privacy Facilities

6. The information security capability reference model contains eight themes. Information Security Framework Governance Enterprise Information Management & Privacy Privacy Threat mitigation Transaction and data integrity Identity andaccess management Application security Physical security Personnel security

7. Identity Resolution Private Data Data

8. Privacy • Privacy and Information management strategy • Define privacy information strategy • Requirements & compliance process • Incident response Policy, practices and controls • Privacy Impact Assessment • Privacy Audit • Awareness & training • Data, rules and objects • Privacy data taxomony & classification • Privacy business process model • Encryption end to end

9. Q&A – Thank youIBM and the future of privacy Do the benefits of the electronic age come with a privacy trade off?