A Model-based Approach to Realize Privacy and Data Protection by Design

Pedroza, Gabriel; Muntés-Mulero, Víctor; Martín, Yod Samuel; Mockly, Guillaume

doi:10.1109/eurospw54576.2021.00042

Cited by 5 publications

(16 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The subsequent steps involved synthesizing these findings into a coherent framework. A preliminary framework was created, outlining the [13], ISPM [37] and PDPbD [38] .…”

Section: Rq2: Common Processes Shared Among Methodologiesmentioning

confidence: 99%

“…The process begins by analyzing the organization's data processing activities [23]. This involves pinpointing the various data categories and assets in play [8], [30], [38], [49], [53]. To generate a comprehensive list of these activities, one can employ tools such as a guided questionnaire [23], [30], [50] or even conduct focus group discussions [25], [45].…”

Section: ) Asset and Data Inventorymentioning

confidence: 99%

“…Technique. Various modeling approaches includes Data Flow Diagrams [13], [35], [38], [51], [53], STS-ml (Socio-Technical Security Modeling Language) [46]- [48], SecBPMN2 [48], Secure Tropos (SecTro) [48], JTrust [48], Misuse Case Diagrams [29], [51], [52], UML diagram [37], [42], BPMN [37], [54], Goal modeling diagrams [55], Problem Frames [5], or TOGAF-based modeling [37]. Textual specifications [32], [36], NLP techniques [16], Questionnaires [30], [46], Co-creation tools [45] Functional requirements list [32], Privacy-related entities [36] Stakeholder goals Asset and Data Inventory Data processing analysis [23], Guided questionnaire [30], [50], Focus group discussions [25], Surveys, Interviews [4], [29] Assets and data inventory list [23], Data processing activities [44] Data audit forms [8], Current database, Data flow diagrams Model-based Approach Data Flow Diagrams [13], [51], STS-ml [46], SecBPMN2, Secure Tropos, JTrust, Misuse Case Diagrams [29], [52], UML, BPMN…”

Section: ) Model-based Approachmentioning

confidence: 99%

“…After that, choose the PETs and privacy patterns based on experts knowledge [8], [52] or from the mapping table between privacy requirements/threats to the corresponding solutions [8], [9], [13], [22], [37], [42], [44], [63] or based on recommendation system from semantics-based knowledge [44]. This can be categorized in further detail into a group of threats [13] or design strategies whether it is related to data or process [38], [53] or related to specific requirements in regulation [66].…”

Section: ) Privacy Pattern and Pet Selectionsmentioning

confidence: 99%

“…In this task, the focus is on designing an architecture that supports the selected PETs and countermeasures while also meeting other relevant criteria. This involves defining the system architecture in a way that best supports the identified privacy-related processes [22], [24], [37], [38], [43], [49], [65], [66] and compliance [19].…”

Section: ) Designing Privacy-aware Architecturementioning

confidence: 99%

See 4 more Smart Citations

Toward a Holistic Privacy Requirements Engineering Process: Insights From a Systematic Literature Review

Herwanto,

Ekaputra,

Quirchmayr

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Privacy requirements engineering is a crucial aspect of privacy engineering. It aims to integrate privacy principles into organizational and technical processes throughout the software development lifecycle. This specialized field involves various strategies, including compliance with regulatory frameworks, asset analysis, and system diagram development for threat modeling. The wide range of approaches, while beneficial in providing different perspectives, presents a significant challenge to the novice privacy engineer or developer in identifying the most effective methodologies. The lack of a single methodology highlights the need for a systematic literature review (SLR) to establish a standardized process for privacy requirements engineering that promotes consistency across different methodologies. To address this issue, we conducted a comprehensive SLR to synthesize existing privacy requirements engineering methodologies. Our analysis involved dissecting each method's processes, tasks, techniques, work products, and resources. Our review examined 40 privacy requirements engineering methodologies detailed in 50 papers, from which we extracted five key processes commonly followed in privacy requirements engineering research. We used this as the foundation for a holistic approach to facilitate the adoption of a comprehensive privacy requirements engineering process. The review also identifies ongoing challenges and suggests future directions in this field.INDEX TERMS privacy requirements engineering, privacy design engineering, privacy engineering, privacy by design

show abstract

“…The subsequent steps involved synthesizing these findings into a coherent framework. A preliminary framework was created, outlining the [13], ISPM [37] and PDPbD [38] .…”

Section: Rq2: Common Processes Shared Among Methodologiesmentioning

confidence: 99%