Chapter 11 — Networks and protocols | Engineering Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Networks and protocols

Lesson map

Lesson 11 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Personal data on the wire"]
  N2["11.2 Transport encryption"]
  N3["11.3 Metadata minimisation"]
  N4["11.4 Third-party calls"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Personal data on the wire"]
  N2["11.2 Transport encryption"]
  N3["11.3 Metadata minimisation"]
  N4["11.4 Third-party calls"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX031"]

[Learning outcomes]
    |
    v
[11.1 Personal data on the wire]
    |
    v
[11.2 Transport encryption]
    |
    v
[11.3 Metadata minimisation]
    |
    v
[11.4 Third-party calls]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) identify personal data in network traffic; (2) apply encryption in transit; (3) limit metadata collection.

11.1 Personal data on the wire

In networks Zara captures traffic from a test copy of Pellmore's app on a lab network with synthetic accounts. She sees that the app sends the patient's email address to an analytics server in a URL parameter. URLs end up in server logs, proxies and browser history. Even with transport encryption, the receiving server logs the full address. Zara files a defect: identifiers must never travel in URLs. She explains to the app team that encryption protects data on the wire but not what the recipient does with it after arrival.

11.2 Transport encryption

Zara checks that all of Pellmore's endpoints use current transport layer security and reject old protocol versions. She explains to the class that Article 32 of the GDPR requires security appropriate to the risk, including encryption where appropriate, and that health data in transit is a clear case. She also verifies that internal traffic between services is encrypted, because attackers who reach the internal network often find unencrypted traffic there. The finding leads Pellmore to enable mutual authentication between its booking and records services.

11.3 Metadata minimisation

Network devices log IP addresses, which the Court of Justice of the European Union has treated as personal data in some circumstances, and which in any case can locate a patient. Zara reviews Pellmore's firewall and load balancer logs and finds full IP addresses kept for two years. She recommends truncating the last part of addresses after seven days, keeping full addresses only in a short security log. The change keeps enough for attack investigation while reducing a long-lived record of where patients connected from.

11.4 Third-party calls

The capture also shows calls to six third-party domains: fonts, analytics, crash reporting and advertising measurement. Zara lists each, what it receives and whether Pellmore has a contract with it. Two have no data processing agreement. Article 28 of the GDPR requires a binding contract with processors. She recommends removing the advertising script entirely, hosting fonts locally and signing agreements for the remaining processors. The exercise shows her that a network capture is also a compliance audit tool, revealing flows that documentation missed.

Worked example

Zara finds an email address in an analytics URL, confirms transport and internal encryption, truncates stored IP addresses after seven days and removes or contracts six third-party calls.

Synthetic case. The app and captures are synthetic; GDPR Articles 28 and 32 are real.

Errors and limits

Captures on test builds may miss production behaviour; repeat on release builds.

Exercises

EX031 — URL identifiers. Why must identifiers not travel in URLs? Rubric: 3 = URLs are logged by servers, proxies and browsers despite encryption;; 2 = mentions logs;; 1 = fine if encrypted;; 0 = none.
EX032 — IP truncation. What does truncating stored IP addresses achieve? Rubric: 3 = keeps attack investigation capacity while reducing long-lived location data;; 2 = mentions privacy;; 1 = deletes all logs;; 0 = none.
EX033 — Processor contracts. What does Article 28 require for third-party processors? Rubric: 3 = a binding contract governing processing;; 2 = mentions contract;; 1 = vague;; 0 = none.

Synthesis

Chapter 11 audits the network. Chapter 12 studies operating systems.

Continue studying — chapter 11 of 50

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →