Legal and security compliance

The EU GDPR, which came into force in May 2018, protects all EU citizens from privacy and data breaches. According to the GDPR FAQ:

"The GDPR not only applies to organizations located within the EU but it also applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company's location."

In other words, if a company is providing services to customers in the European Union, its data handling will need to comply entirely with GDPR. From a DevSecOps point of view, it's related to data collection, handling, storage, backup, modification, transport, and removal—in a secure manner. According to GDPR Article 5, there are six privacy principles:

• Lawfulness, fairness, and transparency
• Purpose limitations
• Data minimization
• Accuracy
• Storage limitations
• Integrity and confidentiality

GDPR, like other security compliance policies, doesn't define the technical approach to achieve it. GDPR can still be too high-level for an engineering team. It needs to translate into software security requirements, design, threat modeling, tools, and so on. The following table summarizes typical security practices for the engineering team:

Stage	Common security practices for privacy or sensitive info handing
Design	Privacy Impact Assessment (PIA)
Coding	Data masking library Anonymous toolbox RAPPOR—privacy-preserving reporting algorithms Encryption storage (RSA, ASE) Secure erasure Secure communication protocol (such as TLS v1.2, SSH v2, SFTP, SNMP v3) Cookie consent Data Vault Key management
Testing	OWASP testing for weak cryptography, testing for error handling, testing for configuration, and so on
Deployment	OWASP configuration and deployment management testing CIS secure environment configuration Sensitive information in Git
Monitoring	ELK for log analysis Integrity monitoring (IDS/IPS) to monitor any unauthorized changes CIS secure configuration monitoring Sensitive information leakage in Git