01 Activity - Information Security & Assurance 02

Read the blog post entitled “Data Security Vs Data Privacy: An Imperative Distinction to Protect Data” by StealthLabs below. 

In the present digital world, organizations face a multitude of challenges related to the privacy and security of employee, consumer, and client data. The sheer volumes of data that enterprises handle and store is growing and drive a greater need for data protection practices. In addition, computing environments have become highly complex, routinely spanning the cloud, the enterprise data center, and numerous devices ranging from IoT sensors to remote servers. 

This complexity proliferates the attack surface, making it more challenging for organizations to monitor and secure data. Thus, it has become crucial for organizations to incorporate data security and data privacy policies into a sound data governance strategy to prevent data breaches and achieve legal compliance. Unfortunately, many organizations believe that their data security policy covers data privacy and vice versa. They often use data security and data privacy interchangeably. 

Data Security is commonly referred to as confidentiality, availability, and integrity of information. It is all about the practices and procedures that focus on protecting personal information from unauthorized access, data breaches, cyberattacks, and accidental or intentional data loss. Data security ensures that data is accurate and reliable and is available for authorized users. A data security plan includes resilient data storage technologies, encryption solutions, data erasure, data masking, physical and logical access controls, breach response, and multi-factor authentication. 

Whereas Data Privacy is concerned with the procedures and policies that govern the collection, storage, sharing, and usage of Personally Identifiable Information (PII) and proprietary corporate information. It refers to the rules and regulations that ensure personal or private information is being controlled on par with the preferences of the concerned individual(s). 

The best way to understand the distinction between data security and data privacy is to consider the mechanisms used in both cases. An organization may have effective and robust data security, yet the procedure or process by which information was collected and handled might violate the privacy policy. For instance, an organization might ensure data security by encrypting, masking, and properly accessing the data. But if it gathers that information 

improperly, for instance, without any proper consent from the concerned individual, the organization has violated data privacy requirements even though data security remains unbreeched. Therefore, organizations must understand that data security can be achieved without data privacy. However, data privacy cannot be achieved without data security. 

Answer the following questions: 

1. Considering your personal experiences with data breaches or privacy issues, how effective do you believe current data security measures are in protecting individual privacy? Provide examples to support your opinion. (100 words only) 
2. Reflect on a time when you had to share personal information online. How did the website’s data privacy policies influence your decision to provide your information, and how confident were you in the security measures in place? (110 words only) 
3. Imagine you are responsible for implementing data governance in your organization. Based on the article, what strategies would you prioritize to ensure both data security and data privacy, and why? (120 words only) 
4. Think of a situation where a company’s data privacy practices failed to protect your personal information. How did this experience shape your views on the importance of distinguishing between data security and data privacy? (125 words only) 

Write your answer in a long bond paper using a black ball pen.