Trustworthy digital infrastructure for identity systems: why should privacy matter to security engineers?

Abstract

Privacy and security have long been perceived as competing objectives, but they both exist in a state of tension within systems. Engineers may be tempted to consider security as essential, while privacy is a nice-to-have. Prof Carsten Maple, Dr Gregory Epiphaniou and Mirko Bottarelli of the University of Warwick and the Alan Turing Institute explain that, as applications and platforms gather ever more data, we need to move to a ‘privacy by design’ approach while implementing data protection mechanisms with existing security engineering methods. Privacy and security have long been perceived as competing objectives. For example, it is widely acknowledged that national security is often (and should often be) prioritised over any concerns for personal privacy. However, privacy and security are, more generally, in tension within cyber systems. This is most noticeably present in the design and operation of systems where information that can be used to determine and protect the security might have private and personal aspects.