S2E32: "Privacy Red Teams, Protecting People & 23andme's Data Leak" with Rebecca Balebako (Balebako Privacy Engineer)

The Shifting Privacy Left Podcast

Content provided by Debra J. Farber (Shifting Privacy Left). All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Debra J. Farber (Shifting Privacy Left) or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://podcastplayer.com/legal.

1+ y ago 48:58

MP3•Episode home

This week’s guest is Rebecca Balebako, Founder and Principal Consultant at Balebako Privacy Engineer, where she enables data-driven organizations to build the privacy features that their customers love. In our conversation, we discuss all things privacy red teaming, including: how to disambiguate adversarial privacy tests from other software development tests; the importance of privacy-by-infrastructure; why privacy maturity influences the benefits received from investing in privacy red teaming; and why any database that identifies vulnerable populations should consider adversarial privacy as a form of protection.
We also discuss the 23andMe security incident that took place in October 2023 and affected over 1 mil Ashkenazi Jews (a genealogical ethnic group). Rebecca brings to light how Privacy Red Teaming and privacy threat modeling may have prevented this incident. As we wrap up the episode, Rebecca gives her advice to Engineering Managers looking to set up a Privacy Red Team and shares key resources.
Topics Covered:

How Rebecca switched from software development to a focus on privacy & adversarial privacy testing
What motivated Debra to shift left from her legal training to privacy engineering
What 'adversarial privacy tests' are; why they're important; and how they differ from other software development tests
Defining 'Privacy Red Teams' (a type of adversarial privacy test) & what differentiates them from 'Security Red Teams'
Why Privacy Red Teams are best for orgs with mature privacy programs
The 3 steps for conducting a Privacy Red Team attack
How a Red Team differs from other privacy tests like conducting a vulnerability analysis or managing a bug bounty program
How 23andme's recent data leak, affecting 1 mil Ashkanazi Jews, may have been avoided via Privacy Red Team testing
How BigTech companies are staffing up their Privacy Red Teams
Frugal ways for small and mid-sized organizations to approach adversarial privacy testing
The future of Privacy Red Teaming and whether we should upskill security engineers or train privacy engineers on adversarial testing
Advice for Engineer Managers who seek to set up a Privacy Red Team for the first time
Rebecca's Red Teaming resources for the audience

Resources Mentioned:

Listen to: "S1E7: Privacy Engineers: The Next Generation" with Lorrie Cranor (CMU)
Review Rebecca's Red Teaming Resources

Guest Info:

Connect with Rebecca on LinkedIn
Visit Balebako Privacy Engineer's website

Send us a text

Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.
Shifting Privacy Left Media
Where privacy engineers gather, share, & learn
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.
Copyright © 2022 - 2024 Principled LLC. All rights reserved.

Chapters

1. S2E32: "Privacy Red Teams, Protecting People & 23andme's Data Leak" with Rebecca Balebako (Balebako Privacy Engineer) (00:00:00)

2. Introducing Rebecca Balebako, Founder and Principal Consultant at Balebako Privacy Engineer (00:01:47)

3. How Rebecca switched from software development to a focus on privacy and adversarial privacy testing (00:03:25)

4. What motivated Debra to shift left from her legal training to privacy engineering (00:04:42)

5. What 'adversarial privacy tests' are; why they're important; and how it differs from other tests for software development (00:08:15)

6. Defining 'Privacy Red Teams,' one type of adversarial privacy test, and what differentiates them from 'Security Red Teams' (00:11:41)

7. Why Privacy Red Teams should primarily be used by organizations with mature privacy programs (00:16:49)

8. The 3 steps to conducting a Privacy Red Team attack (00:20:54)

9. How leveraging a Red Team differs from other privacy tests like conducting a vulnerability analysis or managing a bug bounty program (00:24:05)

10. How 23andme's recent data leak, affecting 1 mil Ashkanazi Jews, could have been avoided via Privacy Red Team testing (00:31:52)

11. The trend where BigTech companies are staffing up their Privacy Red Teams (00:40:44)

12. How small and mid-sized organizations with mature privacy programs can approach adversarial privacy testing (00:42:19)

13. The future of Privacy Red Teaming and whether we should upskill security engineers or train privacy engineers on adversarial testing (00:44:03)

14. Rebecca's advice for Engineer Managers who seek to set up a Privacy Red Team for the first time (00:45:10)

15. Rebecca shares information about Red Teaming resources that she put together for the audience (00:46:20)

63 episodes

#Tech #Entrepreneur #Business #News #Tech News #Privacy #Security #Engineering #Innovation #Ethics #Design #Debra J. Farber (Shifting Privacy Left Media #Development #DevOps #Data Science #Privacy Engineer #Architecture