Share these talks and lectures with your colleagues
Invite colleaguesPractice paper
A data privacy approach for cyber-physical systems
Cyber Security: A Peer-Reviewed Journal,
3
(1),
57-72
(2019)
Abstract
The European General Data Protection Regulation (GDPR), which has been in effect since 25th May, 2018, tightens the requirements regarding data protection for anyone collecting or processing personal data within the European Union (EU) and is connected with heavy fines in case of violations. The topic of data privacy for cyber-physical systems and the related requirements towards development and operation are, however, not new. Many regional laws and regulations pursuing the goals of confidentiality, integrity, availability, storage and purpose limitation, minimisation, transparency and accuracy of personal data have already been in place long before the introduction of the GDPR. But for many companies, dealing with the formal requirements defined by the GDPR is a new and challenging task. We developed a clearly structured approach based on established and proven workflows aimed at integrating data protection topics into existing development processes and thereby achieving compliance with data protection regulations. This approach follows the widely used V-model for development and is inspired by concepts from functional safety development. Both the discipline of functional safety and that of data privacy aim to protect the end-user against harm caused by malfunctions of the system they are using. In the first case this refers to physical harm, while in the second to harm due to violations of fundamental rights and freedoms of natural persons. In the age of digitalisation there are currently indications for a paradigm shift that puts both kinds of harm on the same level. The approach starts by defining the scope of collection and processing of private data as well as the relevant functions and interfaces. Based on this, the threats related to the loss or breach of personal data are analysed and corresponding goals are formulated. A high-level strategy for reaching those goals and preventing data privacy infringements is then derived. This strategy is further refined into concrete technical and process solutions for which verification and validation criteria are defined.
Keywords: data privacy; GDPR; V-model; threat analysis and risk assessment; data protection impact assessment; cyber security; privacy by design
The full article is available to subscribers to the journal.
Author's Biography
Jan Weldert works as a cyber security and data privacy expert at INVENSITY. After obtaining his Master’s degree in mathematics at the JGU Mainz, Jan worked in cyber security on performing threat and risk assessments for INVENSITY and for their customers, as well as on developing cyber security concepts. Jan’s main focus is data privacy, where he developed a GDPR compliance approach aimed at integrating data protection topics into existing development processes together with the INVENSITY cyber security and data privacy team. Jan successfully executed this method for a cloud service-based system for a customer. Furthermore, he carried out security and software architecture projects at Bosch and Continental in the automotive sector.
Jana Karina Von Wedel is the Deputy Head of Cyber Security and Data Privacy at the technology consulting company INVENSITY. After obtaining her Master’s degree in computer science at the TU Munich, Jana worked for several years in safety management and engineering on the system and software level before shifting her focus to cyber security and data privacy. Jana’s focus is on developing methods, tools and concepts for integrating these topics into the development processes for cyber-physical systems. Jana has carried out projects at Bosch, Continental, MAN Truck & Bus and Busch-Jaeger, among others.
Christian Beul has acquired a broad knowledge and a wide network working in different positions and roles within the industry. Using his valuable knowledge with the focus on complex challenges in technology and innovation consulting, Christian has led projects with many well-known companies, including Daimler, BMW, MAN, Continental, Bosch, ZF TRW, Magna, TÜV and Roland Berger.
