A Framework for Privacy and Security Requirements Analysis and Conflict Resolution for Supporting GDPR Compliance Through Privacy-by-Design

Abstract

Requirements elicitation, analysis, and, above all, early detection of conflicts and resolution, are among the most important, strategic, complex and crucial activities for preventing software system failures, and reducing costs related to reengineering/fixing actions. This is especially important when critical Requirements Classes are involved, such as Privacy and Security Requirements. Recently, organisations have been heavily fined for lack of compliance with data protection regulations, such as the EU General Data Protection Regulation (GDPR). GDPR requires organisations to enforce privacy-by-design activities from the early stages and for the entire software engineering cycle. Accordingly, requirements engineers need methods and tools for systematically identifying privacy and security requirements, detecting and solving related conflicts. Existing techniques support requirements identification without detecting or mitigating conflicts. The framework and tool we propose in this paper, called ConfIs, fills this gap by supporting engineers and organisations in these complex activities, with its systematic and interactive process. We applied ConfIs to a realistic GDPR example from the DEFeND EU Project, and evaluated its supportiveness, with positive results, by involving privacy and security requirements experts 1 .

Development of the concept for determining the level of critical business processes security

“…Models [32,33] do link risks to security objectives and requirements, but they use this relationship to indicate that security requirements reduce risk and that the significance of the risk is determined by the security criterion. Models [36][37][38] associate threats with security requirements. This indicates a breach, but misses the link between security requirements and controls, and also lacks the concept of vulnerabilities in the model.…”

Ensino da Adequação à LGPD no Desenvolvimento de Software através da Aprendizagem Ativa e Centrada no Discente

“…Essas duas legislações impõem que o desenvolvimento de produtos e soluções de software considerem a privacidade de dados pessoais desde a concepção e incorpore esta prática durante toda a vida do software: Princípios de Privacy by Design e Privacy by Default [11]. Esta obrigação legal impacta diretamente no processo de desenvolvimento de software, que precisa se atentar à privacidade e proteção de dados pessoais Fica permitido ao(s) autor(es) ou a terceiros a reprodução ou distribuição, em parte ou no todo, do material extraído dessa obra, de forma verbatim, adaptada ou remixada, bem como a criação ou produção a partir do conteúdo dessa obra, para fins não comerciais, desde que sejam atribuídos os devidos créditos à criação original, sob os termos da licença CC BY-NC 4.0. durante todo desenvolvimento software, trazendo um novo desafio para a Engenharia de Software [12] [13].…”

Bridging the Gap Between GPDR and Software Development: The MATERIALIST Framework

“…Practices and solutions currently in use have had difficulty closing this gap. Ad-hoc and fragmented approaches have become commonplace in many organizations, leading to ambiguous and inconsistent software development and endangering data protection and privacy compliance [5,6]. Moreover, according to Sobolewski et al, the GDPR is considered a step towards a more user-centric approach [7].…”