![Page 1: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/1.jpg)
Adrian Leung Head of Information Security Catalyst Housing
2nd December 2014
Controlled Information: Restricted
![Page 2: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/2.jpg)
I. Security vs Privacy
Differing perspectives
Relationship between Security and Privacy
Why things go wrong
II. The Catalyst approach
Catalyst’s approach
Catalyst information security programme
Laying the foundations
Lessons learnt
Agenda
Controlled Information: Restricted
![Page 3: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/3.jpg)
Security vs Privacy From DP practioners’ perspective
Privacy
Security
Controlled Information: Restricted
![Page 4: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/4.jpg)
Security vs Privacy From security practioners’ perspective
Privacy
Security
Controlled Information: Restricted
![Page 5: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/5.jpg)
Security vs Privacy From the business’ perspective
Business Shareholders
Customers
Competition
Brand
Security
Privacy
Regulation
Controlled Information: Restricted
![Page 6: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/6.jpg)
Security vs Privacy My view of the world(s)
Controlled Information: Restricted
![Page 7: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/7.jpg)
Security vs Privacy A love hate relationship
Security is a process…Privacy is a consequence. Security is action… Privacy is result of successful action. Security is the strategy…Privacy is outcome. Security is the sealed envelope… Privacy is the successful delivery of the message inside the envelope. You must implement Security to obtain Privacy. Privacy is the state of existence…Security is the constitution supporting the existence.
Controlled Information: Restricted
![Page 8: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/8.jpg)
Security vs Privacy What usually goes wrong
Most common DPA breach leading to £££ penalty?
Controlled Information: Restricted
![Page 9: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/9.jpg)
Security vs Privacy Why things go wrong
Privacy is perceived purely as legal issue, whilst Security is seen as an IT or technical issue.
Privacy and Security functions often sitting in different departments and working in silos.
Privacy and Security teams have little communications and interactions. E.g. Privacy Policy written and published but no security policies, procedures and technical solutions implemented to enforce it.
Controlled Information: Restricted
![Page 10: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/10.jpg)
Security vs Privacy My view of the world(s)
Principle 7
Privacy Security
Controlled Information: Restricted
![Page 11: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/11.jpg)
Controlled Information: Restricted
![Page 12: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/12.jpg)
Catalyst Approach A brief history of time
~Dec’13: Neither a Security nor a Privacy function Jan’14: Head of Information Security in post Jan-Feb’14: Established security governance structure Mar’14: Data Protection audit Apr’14: Recruited a security analyst May’14: Formally accountable for Data Protection Jun’14: Security programme formally launched Jul’14: Engaged Wright Hassall Oct’14: Recruiting privacy analyst
Controlled Information: Restricted
![Page 13: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/13.jpg)
Controlled Information: Restricted
![Page 14: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/14.jpg)
Catalyst Approach Laying the foundations
Security Governance
Established Security Board & Security Working Group
Information Protection
Defined information classification scheme
Piloting a classification tool
Data Protection
Central coordination
Controlled Information: Restricted
![Page 15: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/15.jpg)
Awareness & Cultural change Visual identifier
Controlled Information: Restricted
![Page 16: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/16.jpg)
Awareness & Cultural change Engaging the business
Controlled Information: Restricted
![Page 17: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/17.jpg)
Controlled Information: Restricted
![Page 18: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/18.jpg)
Controlled Information: Restricted
![Page 19: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/19.jpg)
Catalyst Approach Lessons learnt
People, people, people;
Listen to business – build rapport and relationships;
Seek out opportunities to raise profile of security & privacy;
Reach out to peers (e.g. Circle housing);
Form strategic partnerships.
Controlled Information: Restricted
![Page 20: Adrian Leung - Chartered Institute of Housing pdfs/Presentations/Data manchester... · Adrian Leung Head of Information Security Catalyst Housing 2nd December 2014 Controlled Information:](https://reader030.vdocument.in/reader030/viewer/2022040814/5e5b7f71f0e95a5d0e2644e5/html5/thumbnails/20.jpg)
Adrian Leung Email: [email protected] LinkedIn: uk.linkedin.com/pub/adrian-leung/1/511/a97/
Controlled Information: Restricted