Please enable JavaScript.

Coggle requires JavaScript to display documents.

law (telecommunication law, bundes am for sicherheit und…

- - - - threats
        
        "höhere gewalt"
        
        blitzschlag
        
        krankheit
        
        feuer
        
        "organisatorische mängel"
        
        "technisches versagen"
        
        "vorsätzliche Handlung"
        
        "menschliche Fehlhandlung"
      - geschäftsprocesse
      - IT komponenten
    - - wiederverwendbar
      - anpassbar
      - erweiterbar
  - - - AWARENESS
  - - - cost
        
        manager wants this
      - usability
        
        user want this
      - security
        
        experts wants this
- - - - helios USB stick
  - - - "Hausdurchsuchungsbefehl"
        
        issued by
        
        "Richter"
        
        "Statsanwaltschaft"
        
        reqirements
        
        justified suspicion
      - imminent danger
    - - chain of custody
        
        procedure
        
        data analysis
        
        reporting
        
        data collection
        
        data inspection
        
        guidline
        
        must follow the procedure
        
        must document all steps taken
        
        must document exact time of all steps
        
        only work with copies of the original data
        
        must not alter original data
  - - - is legal
      - obstruction of state authority is illegal :!:
    - - most proprietary solutions have backdoor
      - use open source of self developed encryption
- - - - Österreich: Datenschutzanpassungsgesetz
  - - - personal data of natural persons may not be processed
        
        exceptions
        
        life or death situation
        
        of public interest
        
        rightful interest from CSIRT
        
        human right violation
        
        natural person has to accept the processing of personal data
      - privacy by desing
      - privacy by default
    - - protected person
        
        rights
        
        right of information
        
        right of correction
        
        right of deletion
      - "datenschutzbeauftragter"
        
        is needed when
        
        collection of sensitiv data
        
        regular/systematic/extensible personal data collection
        
        public authorities
        
        what he has to do
        
        awareness training for coworkers
        
        has to check if GDPR compliant
        
        cooperate with the "Datenschutzbehörde"
        
        special privileges
        
        "weisungsfrei"
        
        "nicht haftbar"
        
        "Verantwortung liegt beim Geschäftsführer"
    - - personal data
        
        sensitiv data
        
        religion
        
        medical records
        
        biometrics
        
        ethic origin
        
        IPs
        
        email
        
        address
        
        name
    - - "Folgenabschätzung"
        
        when?
        
        whitelist
        
        blacklist
        
        freedom or rights of a person are in danger
        because of data collection
        
        content
        
        from whom is data collected
        
        what data is collected
        
        severity of the risk
        
        how data is processed
        
        why the processing is necessary
      - "Verarbeitungsverzeichnis"
        
        content
        
        contact data
        
        why the data is collected / processed
        
        affected groups of people
        
        exception
        
        < 250 workers
        
        no risk of freedom or right
        
        gelegentliche verarbeitung
        
        no sensitiv data is collect
      - "Meldepflicht"
        
        data breaches have to be reported
        to the "Datenschutzbehörde" within 72 hours
        
        people with high risk have to be contacted
    - - automatic processing of personal data to generate a profile of a person
      - automatic decision based on profiles is only allowed when rights or similar are not affected by the decision (fi. credit scores)
- - - - forgery
      - damaging
      - deletion
- - - - critical infrastracture
      - digital services
  - - - computer emergency response team (CERT) /
        computer security incident response team (CSIRT)
    - - z.B. ISO27001 certified
      - z.B. COBIT certified
- - - - companies listed for stock exchange