Chapter 14 — Privacy foundations | Bachelor's Security operations and blue team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 14 — Privacy foundations

Lesson map

Lesson 14 published. Map, example, EX040.

flowchart TD
  N0["Learning outcomes"]
  N1["14.1 Principles"]
  N2["14.2 Purpose limitation"]
  N3["14.3 Minimisation"]
  N4["14.4 Retention"]
  N5["14.5 Individuals' rights"]
  N6["14.6 Breach assessment"]
  N7["14.7 Working with the DPO"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX040"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["14.1 Principles"]
  N2["14.2 Purpose limitation"]
  N3["14.3 Minimisation"]
  N4["14.4 Retention"]
  N5["14.5 Individuals' rights"]
  N6["14.6 Breach assessment"]
  N7["14.7 Working with the DPO"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX040"]

[Learning outcomes]
    |
    v
[14.1 Principles]
    |
    v
[14.2 Purpose limitation]
    |
    v
[14.3 Minimisation]
    |
    v
[14.4 Retention]
    |
    v
[14.5 Individuals' rights]
    |
    v
[14.6 Breach assessment]
    |
    v
[14.7 Working with the DPO]
    |
    v
[Worked example] --> [Exercise EX040]

Learning outcomes

You will (1) explain privacy principles relevant to monitoring; (2) apply data minimisation and purpose limitation; (3) handle personal data in investigations; (4) communicate with data protection staff.

14.1 Principles

Common privacy principles include lawfulness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, and security. They apply to SOC monitoring as to any processing of personal data.

For Riverton's SOC, lawfulness and transparency mean the monitoring notice described below; purpose limitation means security logs serve security; minimisation means metadata by default; accuracy means correcting a wrong attribution, such as a sign-in linked to the wrong user; storage limitation means fixed retention periods; and security means the SOC's own systems are protected and access-logged.

14.2 Purpose limitation

Logs collected for security may not be reused for unrelated purposes, such as checking attendance. Riverton's monitoring notice states security as the purpose.

Lucas met this in practice when a lecturer asked whether Wi-Fi logs could show which students had attended a lecture. The answer was no: the logs were collected for security under the monitoring notice, and using them for attendance would be a different purpose that students had not been told about. Dr. Kim replied to the lecturer explaining why.

14.3 Minimisation

The SOC collects metadata needed for detection, not message content. When content is needed, access is approved per case and limited to what answers the question.

In the phishing case, sign-in records, rule details and message counts were enough to confirm both compromises. Content was needed only to judge what s2047's forward rule had exposed, and even then the approval covered subjects of the forwarded messages, not their bodies. Each step in the case notes shows why a piece of data was needed.

14.4 Retention

Sign-in logs are kept 90 days, mail metadata 180 days. Longer retention needs justification.

The periods reflect how investigations work: most compromises are found within days, while some mail-based fraud is noticed weeks later, which is why mail metadata is kept longer. Data needed for an open case is copied into the case file with a note of why it is kept, and the case file has its own review date. When the case closes, the copies are deleted unless the disciplinary process or the DPO needs them, and the reason for any extension is written down.

14.5 Individuals' rights

Students can ask what data is held about them. The SOC's records must be retrievable for such requests, with redaction where other people's data appears.

If s2047's owner asked what the SOC held about her, the response would include her sign-in records and the case notes about her account. The forwarded messages' subjects, which mentioned other students' marks, would be redacted, since disclosing them would expose other people's data. Keeping case files organised by account makes such requests answerable within the deadline.

14.6 Breach assessment

If personal data was exposed — for example, mail forwarded to an attacker — the data protection officer assesses whether to notify regulators and affected people.

The SOC's role is to supply what the DPO needs to decide: what data was exposed, how many people were affected, whether the attacker could have used it, and when. In the s2047 case, that meant the list of forwarded messages and which ones mentioned other students. The decision to notify belonged to the DPO, who weighed the sensitivity of the marks and the attacker's likely use.

14.7 Working with the DPO

The SOC informs the data protection officer early and provides facts, not legal conclusions.

For s2047, Lucas sent the DPO a short note on the morning of the incident: the forwarding rule existed, how many messages had gone out, and that subjects were being reviewed under approval. He did not speculate on whether notification was required. Early contact gave the DPO time to prepare, since some notification deadlines run from discovery. Lucas followed up with each new fact the same day.

Transparency

The monitoring notice is published on the university intranet and linked from the sign-in page. It explains what is logged, why, for how long and who can see it. People who understand monitoring are more likely to trust and report to the SOC.

Third parties

Cloud providers process logs on the university's behalf under contracts setting security and location terms.

Worked example

For s2047, the forward rule sent 37 messages to an external address. Lucas lists their subjects with Dr. Kim's approval; three contained other students' marks. The DPO decides that those three students must be informed, and the SOC provides the exact message list.

Synthetic case. The case and decisions are invented.

Errors and limits

Privacy law varies by country; follow your institution's legal advice.

Exercises

EX040 — Purpose limitation. Give an example of a purpose-limitation breach. Rubric: 3 = using security logs to check attendance; 2 = partial; 1 = vague; 0 = none.
EX041 — Minimisation. How does the SOC apply minimisation? Rubric: 3 = metadata by default; content only per approved case; 2 = partial; 1 = collect all; 0 = none.
EX042 — Breach outcome. What did the DPO decide for s2047's forwarded mail? Rubric: 3 = three students with exposed marks informed; 2 = partial; 1 = vague; 0 = none.

Synthesis

Privacy principles shape what a SOC collects, how long it keeps it and how it handles exposure of personal data.

Continue studying — chapter 14 of 40

← Chapter 13 (draft) · Course chapter index · Chapter 15 (draft) →