Open the gate a little: strategies to protect and share data

@FerPer a lesM #r a ilsconf2022 Open the gate a
little: strategies to protect and share data Fern a ndo Per a les

@FerPer a lesM #r a ilsconf2022 <me>

@FerPer a lesM #r a ilsconf2022 Hi! 👋 • Fernando
(Fer) Perales • Perales is Spanish for Pear Trees (🍐🌳🌳🌳) • I don’t like pears 🤷 • From Guadalajara, Mexico 🇲🇽 • 8 years doing RoR consulting • Developer @ thoughtbot #boost • Host Ruby MX community • 5th RailsConf, 1st as speaker 🥳 Illustration by instagram.com/@layered_space

@FerPer a lesM #r a ilsconf2022 </me>

@FerPer a lesM #r a ilsconf2022 Some warm up questions

@FerPer a lesM #r a ilsconf2022 Raise your hand if…

@FerPer a lesM #r a ilsconf2022 You have access to
a production server or database

@FerPer a lesM #r a ilsconf2022 You would feel more
comfortable *not* having access to a production server or database

@FerPer a lesM #r a ilsconf2022 You are comfortable with
the security measurements your organization takes

@FerPer a lesM #r a ilsconf2022 Regardless of your answers,
this may *not* the talk for you

@FerPer a lesM #r a ilsconf2022 However…

@FerPer a lesM #r a ilsconf2022 Raise your hand if…

@FerPer a lesM #r a ilsconf2022 You have had a
copy of production data in your machine

@FerPer a lesM #r a ilsconf2022 Someone from your organization
has asked you for a copy of production data

@FerPer a lesM #r a ilsconf2022 You have provided a
copy of production data to someone in your organization

@FerPer a lesM #r a ilsconf2022 You are concerned about
copies of production data being in someone’s hands

@FerPer a lesM #r a ilsconf2022 If you answer yes
to at least one, this is the talk for you

@FerPer a lesM #r a ilsconf2022 Some cases

@FerPer a lesM #r a ilsconf2022 HIPAA

@FerPer a lesM #r a ilsconf2022 Health Insurance Portability and
Accountability Act of 1996

@FerPer a lesM #r a ilsconf2022 PHI Protected Health Information

@FerPer a lesM #r a ilsconf2022 What is considered PHI?
• Name • Address (anything smaller than a state) • Dates (except years) related to an individual -- birthdate, admission date, etc. • Phone number • Fax number • Email address • Social Security Number • Medical record number • Health plan bene fi ciary number • Account number • Certi fi cate or license number • Vehicle identi fi ers, such as serial numbers, license plate numbers • Device identi fi ers and serial numbers • web URL • Internet Protocol (IP) address • Biometric IDs, such as a fi ngerprint or voice print • Full-face photographs and other photos of identifying characteristics • Any other unique identifying characteristic.

@FerPer a lesM #r a ilsconf2022 https://www.healthcareitnews.com/news/unencrypted-stolen-laptop-costs-lifespan-more-1-million

@FerPer a lesM #r a ilsconf2022 Unencrypted

@FerPer a lesM #r a ilsconf2022 If the device contained
PHI, and you cannot document that the device was encrypted, you will need to follow the requirements of the HIPAA Breach

@FerPer a lesM #r a ilsconf2022 Am I safe If
my app is not health-related?

@FerPer a lesM #r a ilsconf2022 Well…

@FerPer a lesM #r a ilsconf2022 Nice thing of consulting
is that you may work with clients from outside USA

@FerPer a lesM #r a ilsconf2022 = You have to
worry about local legislation

@FerPer a lesM #r a ilsconf2022 🇲🇽

@FerPer a lesM #r a ilsconf2022 LFPDPPP

@FerPer a lesM #r a ilsconf2022 Federal Law on Protection
of Personal Data Held by Individual

@FerPer a lesM #r a ilsconf2022 Another case

@FerPer a lesM #r a ilsconf2022 https://www.databreaches.net/personal-info-of-93-4-million-mexicans-exposed-on-amazon/

@FerPer a lesM #r a ilsconf2022 How did that happen?

@FerPer a lesM #r a ilsconf2022 #upsi

@FerPer a lesM #r a ilsconf2022 First lesson: don’t give
production copies to anyone

@FerPer a lesM #r a ilsconf2022 Thanks!

@FerPer a lesM #r a ilsconf2022 …

@FerPer a lesM #r a ilsconf2022 What if…

@FerPer a lesM #r a ilsconf2022 You can provided only
what is needed

@FerPer a lesM #r a ilsconf2022 Anonymization

@FerPer a lesM #r a ilsconf2022

@FerPer a lesM #r a ilsconf2022 FerPerales/anon_app

@FerPer a lesM #r a ilsconf2022 Install extension

@FerPer a lesM #r a ilsconf2022 Enable extension in our
db

@FerPer a lesM #r a ilsconf2022 What can we do
now?

@FerPer a lesM #r a ilsconf2022 Static Masking*

@FerPer a lesM #r a ilsconf2022 Static Masking* *Don’t run
this in production!

@FerPer a lesM #r a ilsconf2022 Applying masking rules Shu
ffl ing a column Adding noise to a column

@FerPer a lesM #r a ilsconf2022 ➡ Applying masking rules
Shu ffl ing a column Adding noise to a column

@FerPer a lesM #r a ilsconf2022 Connect to our db

@FerPer a lesM #r a ilsconf2022 Init extension

@FerPer a lesM #r a ilsconf2022 De fi ne some
rules

@FerPer a lesM #r a ilsconf2022 SECURITY LABEL

@FerPer a lesM #r a ilsconf2022 De fi ne some
rules

@FerPer a lesM #r a ilsconf2022 Apply rules statically*

@FerPer a lesM #r a ilsconf2022 Result

@FerPer a lesM #r a ilsconf2022 Applying masking rules ➡
Shu ff l ing a column Adding noise to a column

@FerPer a lesM #r a ilsconf2022 Shu ffl ing columns

@FerPer a lesM #r a ilsconf2022 Applying masking rules Shu
ffl ing a column ➡ Adding noise to a column

@FerPer a lesM #r a ilsconf2022 Adding noise

@FerPer a lesM #r a ilsconf2022 Dynamic Masking

@FerPer a lesM #r a ilsconf2022 Dynamic masking

@FerPer a lesM #r a ilsconf2022 Anonymous dumps

@FerPer a lesM #r a ilsconf2022 Data generalization

@FerPer a lesM #r a ilsconf2022 dalibo/postgresql_anonymizer

@FerPer a lesM #r a ilsconf2022 Takeaways

@FerPer a lesM #r a ilsconf2022 Understand the reasons why
someone needs data before saying yes or not

@FerPer a lesM #r a ilsconf2022 If justi fi ed,
provide only what is needed without risking your users information

@FerPer a lesM #r a ilsconf2022 Regardless of the tool,
be careful with the data you have: once our of the server, it’s hard to protect

@FerPer a lesM #r a ilsconf2022 Thanks! 🤖 P.S. We
are hiring in Americas, Europe, Middle East and Africa 🤖 thoughtbot.com/jobs @FerPeralesM [email protected]

Open the gate a little: strategies to protect and share data

Open the gate a little: strategies to protect and share data

More Decks by Fernando Perales

Other Decks in Technology

Featured

Transcript