Privacy
Addison-Wesley Educational Publishers Inc
978-0-321-22409-5 (ISBN)
- Titel ist leider vergriffen;
keine Neuauflage - Artikel merken
When you are on a Web site you don't know well, and you are asked to
complete an online form, if you are like most people you immediately weigh in
your mind issues of how private the information you provide will be kept.
Studies have shown that 64% of consumers have left a Web site because of
concerns about privacy, and that online retailers lose $6.2 billion a year in sales
because of privacy issues. Lack of privacy conditions in building an application
or a web site is a liability; conversely, a web site where the consumer feels that
their privacy will be guarded is a competitive advantage. In our securityconscious
world privacy is a topic of concern right up there with identity theft
and spam. Yet until now there has not been one source of information for
developers on how to develop applications and web sites that will take into
consideration privacy concerns. JC Cannon draws upon the experience he has
learned from his role in the corporate privacy group at Microsoft to give
developers a complete guide to including privacy in their development process.
It covers topics such as spam, digital rights management, the Platform for
Privacy Preferences (P3P) project, and protecting database data.
PrivacyAbout the Author J. C. Cannon is a privacy strategist in the Corporate Privacy Group at Microsoft. He works as a technical strategist for the team, focusing on ways to apply technology to applications that will give consumers better control over their privacy and enable developers to create privacy-aware applications. J. C. works closely with Microsoft product groups and Microsoft research, and gives presentations to developers from other companies on building privacy in to their applications. Prior to this role, J. C. was a program manager for Active Directory for two and a half years. In this role, he worked with developers and independent software vendors on integration strategies for Active Directory and applications. He has written several white papers on Active Directory integration, which are on MSDN, and has given presentations on Active Directory integration techniques at major Microsoft conferences. Before coming to Microsoft in 1998, he spent ten years as a software consultant helping companies integrate Microsoft technologies into their applications and businesses. Previous to becoming a consultant, J. C. worked as a software developer for companies in the United States, England, France, and Sweden. J. C. started his career in software in 1979 after ending his six-year career in the U.S. Navy, where he fixed avionics for A6 aircraft. Three of those years were spent working on the flight deck of aircraft carriers. J. C. received his Bachelor of Science degree in mathematics from the University of Texas at Dallas. © Copyright Pearson Education. All rights reserved.
I. PRIVACY FOR EVERYONE.
1. An Overview of Privacy.
Who's Watching Our Data?
Technologies That Communicate with the Internet.
Investigating Applications.
Defining Privacy.
Answering the Call for Privacy.
The Path to Trustworthiness.
The Privacy Mantras.
Valuing Privacy.
Conclusion.
References.
2. The Importance of Privacy-Enhancing and Privacy-Aware Technologies.
The Goal of PATs and PETs: The Constant Pursuit of Anonymity.
Privacy-Enhancing Technologies.
Anonymizers and Pseudonymizers.
History-Clearing Tools.
Popup Blockers.
Antispam.
Spyware.
Cookie Managers.
Secure File Deletion.
Online Privacy Protection Suites.
Privacy-Aware Technologies.
The Importance of Privacy-Aware Solutions.
Finding Business Value in Privacy-Aware Solutions.
Privacy Features.
Privacy Statement.
P3P Integration.
Privacy Settings.
Centralized Privacy Setting Management.
Ability to View Data to Be Transmitted to the Internet.
Clear Tracks and Personal Info.
Documentation of Privacy-Related Data.
Unsubscribe Feature.
Access Control.
Encryption.
Conclusion.
3. Privacy Legislation.
Regulations Changing the Way Companies Do Business.
DoubleClick.
RealNetworks.
Alexa Internet.
Microsoft Office 2003.
Major Privacy Legislation.
Organisation for Economic Co-operation and Development (OECD).
EU Directive on Data Protection.
Personal Information Protection and Electronic Document Act (PIPEDA).
The U.S. Safe Harbor Privacy Principles.
Children's Online Privacy Protection Act (COPPA).
Computer Fraud and Abuse Act (CFAA).
Gramm-Leach-Bliley Act (GLBA).
Health Insurance Portability and Accountability Act (HIPAA).
Privacy-Certification Programs.
Conclusion.
4. Managing Windows Privacy.
Privacy Disclosure Documents for Microsoft Windows.
Management Papers.
First Privacy Statement.
Using Group Policy for Centralized Setting Management.
Online Help and Top Issues.
Windows Error Reporting.
Using the Windows Error Reporting Dialog.
Using Group Policy to Manage Windows Error Reporting.
Automatic Updates.
Configure Automatic Updates.
Specify Intranet Microsoft Update Service Location.
Reschedule Automatic Updates Scheduled Installations.
No Auto-Restart for Scheduled Automatic Updates Installations.
My Recent Documents.
Windows Media Player 9.
Microsoft Office 2003.
Microsoft Office 2003 Online Settings.
Microsoft Word 2003 Metadata Settings.
Microsoft Office Remove Hidden Data Tool.
Creating a Custom ADM File.
Creating a Custom GPO for Privacy.
Conclusion.
Resources.
5. Managing Spam.
Spam As a Privacy Issue.
The Cost of Spam.
Spam Litigation.
What Can Be Done to Fight Spam.
Individuals.
Companies.
Developers.
Antispam Approaches.
Challenge-Response for Account Creation.
Client-Side Antispam Solutions.
Spam and Infected Attachments.
Server-Side Antispam Solutions.
Block List Companies.
Antispam Server Software.
Developing E-Mail-Friendly Solutions.
Protecting Legitimate Bulk E-Mail.
Conclusion.
References.
6. Privacy-Invasive Devices.
Radio Frequency Identification (RFID) Tags.
Blocking RFID Tags.
Subdermal RFID Devices.
Other RFID Tag Uses.
Market Acceptance of RFID Tags.
Problems with RFID Tags.
RFID Tags and Privacy Concerns.
Obtaining RFID Tags.
Radar-Based Through-the-Wall Surveillance System.
Spotme Conferencing Device.
nTAG Smart ID Badges.
Smart Dust.
Devices That Look Under Clothing.
Passive Millimeter Wave Scanners.
Backscatter X-Ray Devices.
A Legal View of New Technology.
Conclusion.
II. PRIVACY AND THE ORGANIZATION.
7. Building a Privacy Organizational Infrastructure.
The Absence of a Privacy Infrastructure Can Be Costly.
Understanding Your Company's Data Handling Practices.
The Chief Privacy Officer.
The Corporate Privacy Group.
Creating a Corporate Privacy Policy.
Providing Privacy Training.
The Flow of Privacy Policy to Departments.
Building a Privacy Hierarchy for Developing Solutions.
Creating a Privacy Council.
Privacy Leads.
Developing a Privacy Standard.
Conclusion.
8. The Privacy Response Center.
Providing Customer Service for Privacy Issues.
Handling Privacy Issues.
The Importance of a Privacy Response Center.
Organizing a Privacy Response Center.
Integrating the PRC with Product Groups.
Working with Foreign Subsidiaries.
PRC Workflow.
Technology Description.
Recording Privacy Issues.
Online Privacy Form.
Improving the Privacy Response Process.
Determining Resources.
Conclusion.
III. PRIVACY AND THE DEVELOPER.
9. Platform for Privacy Preferences Project (P3P).
Surveillance: Good or Bad?
Introducing P3P for Expressing Web Site Privacy.
Deploying P3P at a Web Site.
The P3P Reference File.
P3P Policy File.
P3P Compact Policy.
Browsers and P3P Integration.
Internet Explorer.
Opera.
Mozilla.
Mozilla Firebird.
Netscape.
Avant.
AT&T Privacy Bird.
P3P Creation Tools.
P3P Policy Editor.
P3P Validator.
P3PEdit.
Joint Research Centre.
A P3P Preference Exchange Language (APPEL).
Conclusion.
References.
10. Integrating Privacy into the Development Process.
Getting Started.
Start with a Solid Infrastructure.
Get Privacy Training.
Create a Plan.
Privacy-Process Flowchart.
Integrating Privacy into Development.
The Documents.
Design Phase.
Feature Complete.
Development Phase.
Test Phase.
Code Complete.
Beta Release.
Product Release.
Privacy Response Team.
Creating a Deployment Guide.
The Privacy Specification.
Data Analysis.
Usage Analysis.
Security Analysis.
User Control Analysis.
User Access Analysis.
Disclosure Plan.
Dependency Analysis.
Phone Home Disclosure.
Entity Description.
The Privacy Review.
Starting the Privacy Review.
Management by Exception.
Who Should be Involved?
Running the Meeting.
Privacy Review Scope.
Privacy Review Template.
Conclusion.
11. Performing a Privacy Analysis.
Helpful Hints for Diagramming.
Number Processes, Data Stores, and Dataflows.
Use Underscores to Connect Words in a Title When Creating Documentation.
Use a Prefix on Names or Identifiers to Avoid Confusion.
Adornments.
Context-Level Application Decomposition.
Level 0 Application Decomposition.
Privacy Boundaries.
Rolling Up an Application Decomposition.
An Application Decomposition Rollup Example.
Complex Rollups.
Conclusion.
12. A Sample Privacy-Aware Application.
Program Design.
F_1.0 User requests.
F_2.0 User responses.
F_3.0 Displ priv stat req.
F_ 4.0 Online data requests.
F_ 5.0 Priv report data.
F_6.0 Config data.
D_ 1.0 Local registry.
D_ 2.0 PrivacyReport.txt.
Installing the Application.
Sample Files.
Privacy Folder.
W3C Folder.
PSample Folder.
PSample/Release Folder.
PSample/Res Folder.
Privacy Disclosure.
The Privacy Statement.
P3P Integration.
Privacy Settings.
Tying Privacy Settings to Group Policy.
Encrypting Local Data.
Conclusion.
13. Protecting Database Data.
Physical Security.
Programmatic Security.
Using Row-Level Security to Protect Data.
Using Column-Level Security to Protect Data.
Transaction Auditing.
Data Minimization.
Data Reduction.
Data Retention Policy.
Data Classification and Isolation.
Translucent Databases.
Data Obfuscation.
Data Quantization.
Query Limitation.
Data Re-identification.
Result-Set Limitation.
Column-Count Limitation.
Query-Type Limitation.
Suppression.
Encryption.
Determining What to Encrypt.
Selecting the Right Encryption Algorithm.
Determining the Encryption Key Length to Use.
Data Perturbation.
Type A Bias.
Type B Bias.
Type C Bias.
Type D Bias.
Perturbation Techniques.
Advanced Perturbation Techniques.
Hippocratic Databases.
Synomos Align.
IBM Tivoli Privacy Manager.
Conclusion.
14. Managing Access to Data: A Coding Example.
Program Overview.
Categorizing the Columns of a Table.
Categorizing the Rows of a Table.
Encrypting Data.
Program Files.
DrOffice Folder.
Privacy Folder.
SQL Folder.
Setting Up the Application.
Setting Up the Web Files.
Setting Up the Database.
Setting Up Authorization Manager.
Setting Up CAPICOM.
Testing the Database Version of the Application.
Viewing Resumés.
Viewing Patient Information.
Testing the Authorization Manager Version of the Application.
Conclusion.
15. Digital Rights Management.
The Digital Millennium Copyright Act.
The Use of DRM to Defend Privacy.
DRM, Copy-Protection Redux.
Rights Management Languages.
Digital Property Rights Language (DPRL).
eXtensible Media Commerce Language (XMCL).
eXtensible Rights Markup Language (XrML).
Open Digital Rights Language (ODRL).
Making a Choice.
Cost.
Features.
Supporters.
Rights Management Applications.
Electronic Media Management System.
OpenIPMP.
Windows Rights Management Services.
Information Rights Management.
Developing DRM Solutions.
ContentGuard XrML SDK.
Nokia Content Publishing Toolkit.
Open Digital Rights Language.
Windows Rights Management Client SDK.
Windows Rights Management Services SDK.
Conclusion.
A. Privacy Section for a Feature Specification.
Privacy.
Privacy Impact.
Definitions.
Impact Description.
Client-Side Component.
Web Service Component.
B. Privacy Review Template.
C. Data Analysis Template.
D. List of Privacy Content.
E. Privacy Checklist.
Notice.
Choice.
Onward Transfer.
Access.
Security.
Data Integrity.
Enforcement.
F. Privacy Standard.
Overview.
Philosophy.
Corporate Privacy Policy.
Follow Fair Information Practices.
Prominent Disclosure.
Control.
Collection of Data.
Retention Policy.
G. References.
Links.
Antispam Software and Information.
Anti-Spyware Software and Information.
Kids' Privacy.
Privacy Advocacy and Consulting Groups.
Privacy Certification Programs.
Privacy Gatherings.
Privacy Journals.
Privacy Surveys.
Privacy Tools and Technology Companies.
Privacy Training.
Books.
The Fight Against the Invasion of Privacy.
Privacy Policy.
Privacy Technology.
Protecting Online and Personal Privacy.
Security and Privacy.
Index.
| Erscheint lt. Verlag | 7.10.2004 |
|---|---|
| Verlagsort | New Jersey |
| Sprache | englisch |
| Maße | 181 x 234 mm |
| Gewicht | 757 g |
| Themenwelt | Informatik ► Betriebssysteme / Server ► Windows |
| Informatik ► Theorie / Studium ► Kryptologie | |
| ISBN-10 | 0-321-22409-4 / 0321224094 |
| ISBN-13 | 978-0-321-22409-5 / 9780321224095 |
| Zustand | Neuware |
| Haben Sie eine Frage zum Produkt? |
