Questions tagged [pii]
The pii tag has no usage guidance.
30
questions
0
votes
1answer
60 views
How do applications which are integrated using a javascript client side sdk, secure their data or disallow spam?
Take an example of google maps. google maps provides a javascript client SDK, which means any web app running javascript can access the google maps sdk. You need to use an API_KEY so that google can ...
1
vote
1answer
38 views
PII Data Masking rules - what's acceptable and what's not
Is there a security rule on correct masking for sensitive information? Let's say we want to use prod data in our UAT environment. We're thinking of creating a masking logic when we transfer prod data ...
1
vote
0answers
34 views
What would be the logical approach in breaking down the following scenario in regard to CISSP Domains?
I'm currently doing my Cyber Security Certification program, I along with my fellow classmates are in Beginner stages. Over the past few weeks we have been writing up variety of Discussions using ...
3
votes
2answers
97 views
Encryption as bijective data masking function
Context
I'm building data lake from scratch within a small team (3-6 data engineers). I want to mask PII data when copying data from prod to dev/test environments.
I'm particularly interested in the ...
0
votes
0answers
34 views
How to block duplicate accounts without leaking PII?
We need to block multiple accounts from being created using identical PII without leaking any information regarding the original account. What is the best way to:
Inform the person trying to create ...
1
vote
1answer
49 views
AWS KMS Getting Data Key using AWS Encyption SDK
I am exploring the AWS KMS as a vault for storing the encryption keys. Now I am trying to encrypt the database fields like email.
So, issue whenever there is a read/write for email, I don't want to ...
0
votes
3answers
137 views
Is an email domain name considered PII?
For example, can you reference a customer by their domain in an email?
Each customer in a system can be associated with a domain, and some domains are associated with a single customer.
0
votes
0answers
48 views
De-Identifying PHI For HIPAA
I have a SQL DB which contains PHI, hosted on AWS. I want to access this data to perform analytics, however, I must de-identify the data first to comply with HIPAA.
How should I approach this? I have ...
2
votes
1answer
45 views
Implications re security practices of full account access granted to third parties
I'm working with a company (say, Acme) that does some ongoing data collection and processing for me. The data in question is private but not all that sensitive. Part of Acme's service has password-...
1
vote
0answers
78 views
How have you secured production data (PII) on non-prod environments?
Data protection laws including GDPR state:
“Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that ...
1
vote
3answers
249 views
Username in browser history (url) - is this a security problem?
We have a client complaining that there is PII in the browser history (as in the persistent history you get to through your browser's menu - Ctrl + H in Chrome). For example, the URL for editing a ...
2
votes
2answers
225 views
What's the danger of an online resume (a CV)?
I was talking with someone about my resume, and on the subject of my posting it online they said,
just be careful with PII ... for your own good :)
My reaction to that is How bad can it be? -- and,...
0
votes
0answers
90 views
How to Ask for More Transparency from Companies Handling Our Personal Data
A company's asked me to submit a scan of my passport claiming KYC (Know Your Customer) and AML (Anti-money Laundering) purposes. In times of daily data breaches, what can we ask for a company to be ...
1
vote
1answer
64 views
Why should relatively-public personal identifying information be kept secret online if at all?
I don't want to get hung up on technical terms, just laying out basics for this question: I understand personal identifying information (PII) as that info which is not apparent to people who cross ...
4
votes
2answers
2k views
Documentation for GDPR best practices for partially masking email addresses
I must give certain employees access to a report which contains email addresses. I would like to redact or partially mask these email addresses, but I am having trouble finding official guidance on ...
1
vote
1answer
66 views
How we can PoC our product that needs training data for our machine learning algorithm of the the bank clients?
Recently, we have had a challenge with potential future clients which are the bank. Our product requires to gather static data (e.g. address, loans, last 50 transactions, etc) of banks clients. These ...
2
votes
1answer
177 views
Information leakage through json response
I am testing a product survey website. As a response to getSurveyResults() call, the following details of all survey participants shall be displayed to all website users.
Nick name
Location
Rating
...
1
vote
1answer
1k views
How can I encrypt messages sent over AWS PrivateLink?
I am working on a project where I need to send messages to a partner via AWS PrivateLink. Because these messages contain PII, the data needs to be secure. I have been unable to determine from internet ...
0
votes
0answers
42 views
Do security breach victims have any meaningful recourse?
OPM Breach
Anthem Health Care
Equifax
The list goes on... If we define meaningful as non-monetary compensation (e.g. services) to protect victims from further victimization stemming from loss of ...
1
vote
1answer
170 views
Can you tell me if my design is secure?
I'm designing a database interface for a system that could store PII. My first focus is on making sure all the data is secure, to do this I have designed the system as follows.
I'm running three ...
3
votes
4answers
5k views
Are employee or badge numbers PII?
We're looking at implementing an Identity Management/Lifecycle system. We're looking at aggregating all our authentication into this system. However, one area of concern is same-name employees, so ...
1
vote
0answers
36 views
Do S3/Azure/GCS bucket names/keys represent personally identifiable information
We have an event-sourced system that uses a forward-only immutable event store.
If we store personally identifiable information in this store, we'll be in trouble with regards to GDPR, as deletion ...
35
votes
6answers
16k views
Is a standalone phone number considered Personally Identifiable Information?
Personally Identifiable Information (PII) is defined (the example below is from NIST) as (emphasis mine)
Information that can be used to distinguish or trace an individual's
identity, such as ...
0
votes
1answer
127 views
Tokenization - Is it bad practice to reuse tokens?
If I am implementing a tokenization system for PII within a database, is it considered bad practice, or riskier, to reuse tokens?
For example, if I am storing the name "Richard" multiple times, and ...
19
votes
2answers
12k views
Is gender considered PII (Personally Identifiable Information) under the GDPR?
Since GDPR is shaking everything up at the minute I'm working on a few changes to our website/process.
I work in eCommerce in UX (UK based) and support marketing teams with certain activities.
My ...
0
votes
1answer
348 views
How to securely collect email addresses through a third party website
I would like to collect email addresses through a third party website and subscribe them to a Sendgrid mailing list.
Flow:
User goes to a website hosted by unbounce.com that uses my website's ...
2
votes
1answer
147 views
Secure, Portable Bookmarks
A constant bugbear is my bookmarks being synced to my Google accounts, meaning access to them outside that Google account requires various manual steps.
So it got me thinking of a roll your own way ...
-1
votes
1answer
43 views
DLP Tool for requirement [closed]
Is there any DLP tool with default policies to comply with south african laws and regulations on PII ?
4
votes
1answer
92 views
How can I prove that I adhere to stated privacy policy? What audits are effective for voluntary compliance?
I have a website and mobile app that doesn't store data or PII.
Suppose I'm not subject to any special privacy laws. How can I voluntarily submit myself to an audit to ensure that I'm acting true to ...
0
votes
1answer
688 views
Data Masking in a database [closed]
Background
The development team is receiving production data (as Database backup files) in order to fix bugs and application enhancements. The Development team restore these backups in their ...
