Tool-supporting data protection impact assessments with CAIRIS.
Coles, Joshua; Faily, Shamal; Ki-Aries, Duncan
The General Data Protection Regulation (GDPR) encourages the use of Data Protection Impact Assessments (DPIAs) to integrate privacy into organisations' activities and practices from early design onwards. To date, however, there has been little prescription about how Security & Privacy Requirements Engineering processes map to the necessary activities of a DPIA, and how these activities can be tool-supported. To address this problem, we present a tool-supported process for undertaking DPIAs using existing Requirements Engineering approaches and the CAIRIS platform. We illustrate this process using a real-world case study example where it was used to elicit privacy risks for a prototype medical application to support chemotherapy treatment.
COLES, J., FAILY, S. and KI-ARIES, D. 2018. Tool-supporting data protection impact assessments with CAIRIS. In Beckers, K., Faily, S., Lee, S.-W. and Mead, N. (eds.) Proceedings of the 5th International workshop on evolving security and privacy requirements engineering (ESPRE 2018), 20 August 2018, Banff, Canada. Los Alamitos: IEEE Computer Society [online], pages 21-27. Available from: https://doi.org/10.1109/ESPRE.2018.00010
|Conference Name||5th International workshop on evolving security and privacy requirements engineering (ESPRE 2018)|
|Conference Location||Banff, Canada|
|Start Date||Aug 20, 2018|
|Acceptance Date||Jul 6, 2018|
|Online Publication Date||Oct 22, 2018|
|Publication Date||Dec 31, 2018|
|Deposit Date||Sep 17, 2021|
|Publicly Available Date||Dec 15, 2021|
|Publisher||IEEE Computer Society|
|Keywords||Data protection; Privacy and computing; General Data Protection Regulation (GDPR); Security risk analysis; Systems security; Requirements engineering; Computer-aided integration of requirements and information security (CAIRIS)|
COLES 2018 Tool-supporting data protection
You might also like
Automation and cyber security risks on the railways: the human factors implications.
Presentation / Conference
Integrated design framework for facilitating systems-theoretic process analysis.
Cybersecurity user requirements analysis: the ECHO approach.
Use-case informed task analysis for secure and usable design solutions in rail.
Visualising personas as goal models to find security tensions.