A Privacy-Aware V-Model for Software Development

Abstract

After the adoption of new data protection regulations, like GDPR, proper treatment of privacy throughout the system development lifecycle has become a must. In this paper, we discuss several aspects to more easily and effectively integrate privacy engineering in system development and how to bring the notion of privacy-by-design into practice. We propose the new W-model as a privacy-aware extension of the V-model frequently used in software engineering. One stage of the Wmodel deals with analyzing privacy in the system where privacy engineers conduct a privacy impact assessment in order to elicit privacy threats and to find a suitable countermeasure to remedy each threat. With respect to finding suitable countermeasures, we provide requirements the countermeasures need to meet in order to be selected. In addition, we introduce a cost function that assists privacy engineers in selecting the most suitable countermeasure. Furthermore, we point out several open issues that future work needs to address.

Privacy Engineering Meets Software Engineering. On the Challenges of Engineering Privacy ByDesign

“…Integration and changes are mostly ignored, even by those works that acknowledge the existence of services or iterative methodologies. The most sophisticated treatment of integration is the requirement on privacy technologies to be "integrable" and "compatible" by Al-Momani et al [17]. However, integrable in this paper is not related to actual integration of services but to whether the PET offers the functionality and performance needed in the system.…”

“…Goaloriented Academic publications Hoepman [51] Deng et al [39] Spiekermann and Cranor [93] De Metayer [36] Hansen et al [49] Gürses et al [45], [46] Al-Momani et al [17] Bernsmed [24] Liu et al [65] Kalloniatis et al [57] Kung [62] Danezis et al [35] Standards ISO/IEC TR 27550 [15] OASIS PMRM [13] OASIS [28] NISTIR 8062 [14] PRIPARE [73] of scope for our analysis. We also excluded works that focus only on threat modeling and risk analysis as these are complementary to engineering activities (could be a subset) but are not sufficient as an engineering methodology.…”

“…This does not show impossibility for integration but inappropriateness, hence, even this work does not review the aspects of integration that are intrinsic to service-oriented software. The last aspect, evaluation, is mostly equated to a Privacy Impact Assessment [30], in which [39] monolith waterfall Spiekermann and Cranor [93] hybrid waterfall PRIAM [36] hybrid waterfall Hansen et al [49] hybrid waterfall Gürses et al [45], [46] monolith waterfall Al-Momani et al [17] monolith v-process 2 Bernsmed [24] monolith waterfall Liu et al [65] monolith waterfall Kalloniatis et al [57] monolith waterfall Kung [62] monolith waterfall Danezis et al [35] hybrid mentions iterative Standards ISO/IEC TR 27550 [15] services mentions agile OASIS PMRM [13] services waterfall OASIS [28] services mentions agile NISTIR 8062 [14] monolith waterfall PRIPARE [73] monolith agile designers evaluate the impact of a privacy violation but they do not quantify the likelihood of such violation given the system specification. Evaluation, as understood in academic papers on privacy technologies, is only explicitly mentioned by Danezis et al [35], where they point out that privacy evaluation must be addressed, but they do not explain how nor mention the difficulty behind composition of service-specific privacy protections.…”