Speaker: Anita Dakamarri
See the DevNexus live blog table of contents for more posts
Why developers
- Developers are first line of defense
- Gap between dev and security teams. Rivals a decade ago. Now same time. Rivals are attackers outside
- Developers use untrusted images to meet deadlines
- Business people/leadership want it fast and bypass security. Then blame developers and security people
- No software is vulnerability free. Goal is to reduce vulnerabilities.
Famous Data Privacy Breaches
- Equifax – in 2017 – unpatched Struts vulnerability. Got Social security numbers, birthdates, etc for 147 million people. Cost over 1.3 billion. Fired security people and executives
- United Health – in 2024 – Ransomware attack on Citrix remote access portal without MFA. Exposed medical, insuring, billing and personal data of 192 million people. Billions in recovery costs, ransom of $22 million and lost revenue
- BadeSaba Calendar App – in late February/early March – Iranian app hacked to include messages like “help has arrived”
Privacy By Design Principles
- Proactive, not reactive. Preventative not remedial
- Privacy as the default setting (ex: car automatically has a seatbelt)
- Privacy embedded into design
- Full functionality, postive sum, not zero sum
- End to end security; full lifecycle protection
- Visibility and transparency; keep it open
- Respect for user privacy; keep it user centric
Requirements/planning
- Identify personal data early
- Minimize data collection
- Definite lawful purpose and retention
- Conduct privacy assessments PIA (privacy impact assessment) /DPIA (data protection impact assessment)
- Translate privacy laws into requirements – ex: GDPR, CCPA (California Consumer Privacy Act)/CPRA (California Privacy Rights Act)/ HIPPA). Requirements include consent, access and deletion
Code with privacy
- Avoid hardcoding sensitive data – Never embed secets, API keys or personal data in code/configs
- Mask/redact personal data – especially in logs/error messages/debugging
- Implement strong encryption – user modern, vetted crypto libraries
- Validate data inputs – prevent injection/data poisoning attacks
- Build deletion and portability features – ensure data can be deleted/exported programmatically
My take
Good end to the day. I learned some acronyms like DPIA and CCPA. So nice to see a session about privacy and not just security overall.