Publicação
Proactive privacy risk detection in DevPrivOps
| Resumo: | Privacy has been gaining increased importance in recent years, both in the public discourse and legal frameworks. However, its integration in the agile software development lifecycle is not responding to the demand. As of now, privacy is ensured by audits that are not integrated into the DevOps lifecycle, which greatly hinders both the analysis of privacy risks and the correction of privacy flaws. On top of that, the very few tools that integrate with the DevOps lifecycle are only reactive, which promotes privacy as a set of corrective measures instead of part of the system’s design. The currently used privacy engineering methodologies tend to be too general and have lackluster tooling to be enforced. Furthermore, privacy quantification is very domain-dependent, which makes it hard to automate without the help of an expert. DevPrivOps has been proposed as a DevOps extension focused on ensuring continuous privacy verification and enhanced transparency for the end user. However, being a new concept, it lacks the tools to concretize its vision. We propose a tool for the DevPrivOps lifecycle that bridges the privacy engineering methodologies with the DevOps planning phase, promoting the adoption of privacy by design strategies. This tool will not fix the lack of tooling for itself, rather, it aims to be the base upon which the rest of the tools can be created and integrated into the DevPrivOps lifecycle. |
|---|---|
| Autores principais: | Felisberto, João Francisco Fernandes |
| Assunto: | DevPrivOps DevOps Privacy Privacy engineering |
| Ano: | 2024 |
| País: | Portugal |
| Tipo de documento: | dissertação de mestrado |
| Tipo de acesso: | acesso aberto |
| Instituição associada: | Universidade de Aveiro |
| Idioma: | inglês |
| Origem: | RIA - Repositório Institucional da Universidade de Aveiro |
| Resumo: | Privacy has been gaining increased importance in recent years, both in the public discourse and legal frameworks. However, its integration in the agile software development lifecycle is not responding to the demand. As of now, privacy is ensured by audits that are not integrated into the DevOps lifecycle, which greatly hinders both the analysis of privacy risks and the correction of privacy flaws. On top of that, the very few tools that integrate with the DevOps lifecycle are only reactive, which promotes privacy as a set of corrective measures instead of part of the system’s design. The currently used privacy engineering methodologies tend to be too general and have lackluster tooling to be enforced. Furthermore, privacy quantification is very domain-dependent, which makes it hard to automate without the help of an expert. DevPrivOps has been proposed as a DevOps extension focused on ensuring continuous privacy verification and enhanced transparency for the end user. However, being a new concept, it lacks the tools to concretize its vision. We propose a tool for the DevPrivOps lifecycle that bridges the privacy engineering methodologies with the DevOps planning phase, promoting the adoption of privacy by design strategies. This tool will not fix the lack of tooling for itself, rather, it aims to be the base upon which the rest of the tools can be created and integrated into the DevPrivOps lifecycle. |
|---|
Atividades financiadas
Não foram encontrados projetos financiados.