In this session, both customer and AWS speakers discuss how organizations incorporate privacy protections into the design of their products and services (i.e., privacy by design). It also covers how they use privacy-enhancing technologies to protect their customers’ personal data. Learn about the impact that the regulatory environment and ethics considerations have on engineering and emerging technology development and adoption.

1. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Privacy, ethics, and engineering in
emerging technology
Jonathan Jenkyn
Senior Consultant, Security
AWS Professional Services, GFS
S E P 2 0 4
Matt Hillary
VP, Security
Instructure, Inc.

2. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Instructure’s approach
AWS professional services approach

3. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Related breakouts
Tuesday, June 25
SEP208 - Designing for data privacy on AWS
1300 – 1400 | Level 2, Room 207
Tuesday, June 25
FND202 – Privacy by Design on AWS
1715 – 1915 | Level 1, Room 104A
Wednesday, June 26
GRC324 - Use AWS Config rules to satisfy your compliance needs
1445 - 1545 | Level 1, Room 154

4. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

5. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

6. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security vs. Privacy

7. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security team objectives
• Detect badness
• Secure against badness
• Build and maintain the trust of customers (Privacy!)

8. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Openness

9. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Data processors
Data controller
Users

10. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Partnership – CSO (security) + DPO (legal)

11. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Data inventory
• Category (user, business, system, etc.)
• Elements (possible) (name, e-mail, phone number, etc.)
• Purpose for collecting
• Source of data
• Data handling (transit and rest)
• Flow of data
• Vendors handling data

12. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Robust privacy training and privacy policy

13. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Securityand privacy in the softwaredevelopment lifecycle

14. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Using AWS Services
• Build in ability for Data Controllers to self-service manage data
• Clear, open agreements with customers
• Clear, open understanding provided to end users
• Use AWS’ out-of-the-box abilities to help detect + secure against data breaches:
• Amazon GuardDuty
• AWS Trusted Advisor
• Well architected / secured reviews
• AWS Config + Config Rules (or similar compliance checks using Lambda)
• Amazon Macie
• Tags
• AWS CloudTrail and Amazon CloudWatch (log-based alerting)

15. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security and Privacy

16. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

17. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Shared responsibility model

18. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Privacy standards and
regulations
AWS delivers services to millions of
active customers over 190
countries

19. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
What AWS Provides
Terms and conditions
Transparency
Compliance/security tools & services
Amazon partner network & marketplace
Deep industry expertise
Independent audit & attestation

20. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS professional services approach
Discover
Assess
Implement

21. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

22. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
OECD privacy
framework
• Collection limitation
• Data quality
• Purpose specification
• Use limitation
• Security safeguards
• Openness
• Individual participation
• Accountability

23. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
“John Stiles”
“J Stiles”
“123, Any Street, Any Town, USA”
“203.0.113.0”
”j.stiles@amazon.com”
“555-0100”
“PHPSESSID=68fc543de45f67ba”
“876567898765”
Discovery: What does personal data look like in my
solution?

24. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Assess: What AWS tools help manage my risk?
AWS Identity and
Access
Management
SAML
Federation
Active
Directory
Service
Identity & access management
Monitoring & logging
Encryption
Amazon
GuardDuty
Amazon
Macie
Amazon Inspector
Security & compliance
AWS
KMS
AWS
CloudHSM
AWS
Certificate
Manager
AWS
CloudTrail
AWS
Config
Amazon
CloudWatch

25. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Assess: User story security control definitions
As a <role>
I want <behaviour>
So that <outcome>
Example:
As a SEP204 participant
I want to learn about the way AWS and key partners in the Privacy domain
manage data
So that I fully understand the best approach and am able with my own customers.

26. Thank you!
© 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Jonathan Jenkyn
jjenkyn@amazon.co.uk
Matt Hillary
mhillary@instructure.com