Privacy- and Security-by-Design Methodology Handbook Version: V1.00 Date: 31 December 2015 Author/s: Alberto Crespo García (ATOS) Nicolás Notario McDonnell (ATOS) Carmela Troncoso (Gradiant) This project has received Daniel Le Métayer (Inria) funding from the European Inga Kroener (Trilateral) Union’s Seventh Framework David Wright (Trilateral) Programme for research, José María del Álamo (UPM) technological development Yod Samuel Martín (UPM) and demonstration under grant agreement no ICT- 610613 PRIPARE Privacy- and Security-by-Design Methodology Handbook V1.00 Table of Contents LIST OF FIGURES ..................................................................................................4 LIST OF TABLES ....................................................................................................5 ABBREVIATIONS AND DEFINITIONS .....................................................................6 FOREWORD .........................................................................................................9 1 INTRODUCTION .......................................................................................... 10 2 REFERENCE MODEL ..................................................................................... 12 3 PHASES ....................................................................................................... 14 4 ROLES ......................................................................................................... 16 5 EXAMPLE DESCRIPTION .............................................................................. 18 6 PROCESSES ................................................................................................. 20 6.1 ENVIRONMENT & INFRASTRUCTURE ............................................................................. 20 6.1.1 Organizational Privacy Architecture ............................................................. 20 6.1.2 Promote privacy awareness ......................................................................... 22 6.2 ANALYSIS .............................................................................................................. 24 6.2.1 Functional Description and High-Level Privacy Analysis .............................. 26 6.2.2 Legal assessment .......................................................................................... 29 6.2.3 Privacy and security plan preparation .......................................................... 32 6.2.4 Detailed privacy analysis .............................................................................. 33 6.2.5 Operationalization of Privacy Principles ....................................................... 38 6.2.6 Risk management ......................................................................................... 44 6.3 DESIGN ................................................................................................................. 49 6.3.1 Privacy enhancing architecture design ......................................................... 50 6.3.2 Privacy-Enhancing Detailed Design .............................................................. 58 6.4 IMPLEMENTATION ................................................................................................... 63 6.4.1 Privacy implementation................................................................................ 63 6.5 VERIFICATION ......................................................................................................... 66 6.5.1 Accountability ............................................................................................... 66 6.5.2 Security & Privacy static analysis (a priori verification) ............................... 67 6.5.3 Security & Privacy dynamic analysis ............................................................. 69 6.6 RELEASE ................................................................................................................ 71 6.6.1 Create Incident Response Plan ..................................................................... 71 6.6.2 Create system decommissioning plan .......................................................... 73 6.6.3 Final Security & Privacy review .................................................................... 75 6.6.4 Publish PIA report ......................................................................................... 77 6.7 MAINTENANCE ....................................................................................................... 79 6.7.1 Execute incident response plan .................................................................... 79 6.7.2 Security & Privacy verifications .................................................................... 81 31/12/2015 2 PRIPARE Privacy- and Security-by-Design Methodology Handbook V1.00 6.8 DECOMMISSIONING ................................................................................................. 83 6.8.1 Execute decommissioning plan .................................................................... 83 7 METHODOLOGY APPLICATION GUIDELINES ................................................ 85 7.1 ITINERARIES ........................................................................................................... 85 7.1.1 Mandatory .................................................................................................... 87 7.1.2 Lightweight ................................................................................................... 87 7.1.3 Standard ....................................................................................................... 89 7.2 MERGING WITH EXISTING METHODOLOGIES .................................................................... 90 7.2.1 Integrating ISO 9241-210 User-Centered Design Process ............................ 90 7.2.2 Software and system engineering methodologies ....................................... 94 7.2.3 Project management methodologies ......................................................... 107 ANNEX A: PSMA TEMPLATE ............................................................................ 113 A.1 PURPOSE ............................................................................................................... 113 A.2 PRIVACY & SECURITY TEAM ......................................................................................... 113 A.3 INTRODUCTION AND OBJECTIVE .................................................................................... 113 A.4 ITINERARY AND ROADMAP .......................................................................................... 113 A.5 DEFINITIONS ........................................................................................................... 113 A.6 FUNCTIONAL DESCRIPTION .......................................................................................... 113 A.6.1 Privacy stakeholders / actors .......................................................................... 113 A.6.2 Domains and roles ........................................................................................... 113 A.6.3 Relevant business processes, products, systems and applications within systems 114 A.6.4 Data subject(s) associated ............................................................................... 114 A.6.5 Data flows and touch points............................................................................ 114 A.7 IMPACT ASSESSMENT ................................................................................................. 115 A.7.1 Policies and regulation .................................................................................... 115 A.7.2 Privacy principles / targets .............................................................................. 115 A.7.3 Risk assessment ............................................................................................... 116 A.7.4 Feared events .................................................................................................. 116 A.7.5 Threats ............................................................................................................. 117 A.7.6 Initial Impact Assessment ................................................................................ 118 A.8 CONFORMANCE CRITERIA ........................................................................................... 118 A.9 DESIGN LOGBOOK .................................................................................................... 118 A.10 PRIVACY CONTROLS ................................................................................................. 118 A.11 REMAINING THREATS AND RECOMMENDATIONS ............................................................. 118 A.12 ACCOUNTABILITY .................................................................................................... 119 A.13 INCIDENT RESPONSE PLAN ......................................................................................... 119 A.14 SYSTEM DECOMMISSIONING PLAN .............................................................................. 119 A.15 FINAL PIA REPORT .................................................................................................. 119 ANNEX B LIST OF PRIVACY PRINCIPLES, GUIDELINES, AND CRITERIA FOR REQUIREMENTS OPERATIONALIZATION .......................................................... 120 31/12/2015 3 PRIPARE Privacy- and Security-by-Design Methodology Handbook V1.00 List of Figures Figure 1: PRIPARE’s methodology reference model 12 Figure 2: PRIPARE methodology phases 15