Security vs. privacy

The real concern about privacy today is not confidentiality, but access. In today's electronic society, the real problem is who has access to your personal information.

This personal information can be accessed very easily technologically and then aggregated and sorted or processed. While many companies claim to have privacy policies governing how this will be used, those same companies invariably also reserve the right to change that policy at any time and without any prior consent — or even notice.

For most, this lack of control is the real privacy concern. Most people would have much less concern over this access and usage if they had an assurance over who and how their supplied personal data would be used — whether by the government for agreed upon security needs, or by commercial enterprises for agreed upon convenience or benefit in return.

The vast amounts of personal information available and sought today, effectively means that non-technical enforcement of access and usage is completely impractical. For information security professionals, our task should be to foster the development of system enforceable privacy policies, governing not only what personal information can be collected, but how such information can be accessed and used (and audited) once collected — as well as the security of such information while held.

Tim Mather, chief security strategist, RSA Conferences