Do We Need Security Management Systems for Data Privacy ?

The importance of personal data and managing them is increasing worldwide. However first, one must be able to distinguish between data, information, and knowledge, before one turns to protecting them. Furthermore, it must be considered that, in open systems, security is a relative term and can be characterized only with the term risk. This suggests that security is not a state in open and dynamic systems but can only be maintained on a pre-defined level (conservation status) with a security management system. Data privacy therefore requires security management systems to ensure sustainable protection at a previously defined level. Pure guidelines and policies are just not sufficient for the protection of data in open systems, as is typical in companies. INTRODUCTION: THINKING IN SYSTEMS This contribution can be classified thematically to the field of Security Engineering. This assignment is based on both computer science and engineering alike. For this assignment, Ross Anderson provided an apt definition in his eponymous book. Security Engineering is about building systems to remain dependable in the face of malice, error, or mischance. As a discipline, it focuses on the tools, processes, and method needed to design, implement, and test complete systems, and to adapt existing systems as their environment evolves (Anderson, 2008). From the view of R. Anderson (2008), four interacting components are addressed, which are illustrated in Figure 1. Firstly, a policy is postulated that describes what can be achieved. On the other hand, so-called mechanisms are required in response to this that is necessary to enforce the policy. This could, for example, be cryptographic protocols, access configuration and access arrangements, tamper-resistant hardware, etc. Wolfgang Boehmer Technische Universität Darmstadt, Germany