Data Privacy

Internal processes and technical controls around in scope networks, systems, and applications are reviewed to see where clear gaps exist. Direct and implied controls from privacy statutes are translated into technical controls that can be identified within and across the in-scope network or architecture. VerSprite reviews control gaps at the persistent data tier (e.g. – filesystems, databases, caches, etc.), across data transmission infrastructure, as well as applications or software that represent a processing tier.

Data protection comes in different levels of maturity and testing for the resiliency of protection helps determine how well PII controls fare against common abuse cases. Building from the prior phase, VerSprite emulates privacy based attacks to demonstrate viability of exposure. This helps to support a risk based approach and determine what prerequisites are needed for illicit data access (when and if possible). This also helps as a clear risk analysis to auditors, clients, and regulators who wish to understand a more scientific approach to how a company qualified the effectiveness of security controls for an in-scope environment.

The prior 6 steps of PASTA for Privacy culminate with a risk analysis phase aimed at determining what risk reduction steps are needed. Often, this can translate to remediation efforts that are technical in level (i.e. – applying greater cryptographic controls, reducing data retention levels, etc.) or business process related (i.e. – leveraging third party tokenization or anonymization data services, divesting the receipt and use of certain data components, improved contractual clauses that transfer risk).