9

I'm supporting the privacy SE proposal in Area 51, and have read a lot of responses in which people argue that a separate privacy SE site isn't necessary. The reason being that all privacy questions could already be answered in the IT security SE. User Gilles wrote this about IT security:

In spite of the name (which was fixed in stone at the beginning of the site), IT Security is more generally about information security, so that does include privacy.

Is this true? (I haven't been able to conclusively determine that myself, so i would like to know what the experts think.) Has IT security evolved into a SE about information security?

And a followup question: will anyone with a question about (any aspect of) privacy be able to ask it on the IT security SE and get a good answer? Even if the privacy question doesn't relate to the IT or security side of privacy?

2 Answers 2

Reset to default
8

Absolutely.

While I agree that Privacy is not equivalent with Security (and please, ignore the "IT" part of it, that was locked in at the beginning, and really only intends to convey the "professional" aspect), you should realize that one of the responsibilities of Security, is protecting that Privacy.
As @Gilles has commented on the proposal several times, Privacy is really about protecting the confidentiality (security) of certain personal information. While I would say that Privacy does go a bit further than that, it is still the core.

I also want to point out that in common SDL (Security Development Lifecycle) frameworks, there are quite a bit of Privacy requirements. In Microsoft's SDL, almost half (!) is privacy oriented - most Security chapters have a parallel Privacy chapter. Two sides of the same coin.

In any event, of the 8 proposed questions on the proposal so far, almost all would be clearly ontopic here. The only hesitation I would have is the purely legal ones, that could kinda be ontopic here, but could not be safely answered without the big honkin' IANAL disclaimer.
But that would be that case with a standalone Privacy proposal, too.

13
  • So you would consider privacy-related questions that have nothing to do with computers on-topic for security.se?
    – user7848
    Commented Mar 20, 2012 at 12:21
  • @Samuel in principle, yes. But for the sake of argument, give me an example?
    – AviD Mod
    Commented Mar 20, 2012 at 12:24
  • Btw we do have some non-computer security questions, too. Though going so far as having TSA-related questions ontopic, is an open discussion.
    – AviD Mod
    Commented Mar 20, 2012 at 12:25
  • Clarification of my previous comment, we still do focus on information security, and not just general "lock-your-door/carry-mace" type security. Though I would say even a q in that are, if it focused on high-level risk principles, would be okay in my book.
    – AviD Mod
    Commented Mar 20, 2012 at 12:37
  • It's difficult to come up with a good question off the top of my head, and someone can probably come up with a better question, but let's take the mother of all privacy questions for example: "If you aren't doing anything wrong, what do you have to hide?". I.e.; why should i care about my privacy, if i've got nothing to hide? Slightly more of a philosophical, than a law or security related question.
    – user7848
    Commented Mar 20, 2012 at 12:43
  • @Samuel hmm, you mean something like this? :D And yes, I think that would be a great question for here.
    – AviD Mod
    Commented Mar 20, 2012 at 13:02
  • Ok, so pretty much all privacy questions can find a place on security.se. But then my follow-up question is; will (new) users know that their privacy questions can be answered on security.se? Or will the name confuse / discourage them? Could that be the added value of a privacy.se?
    – user7848
    Commented Mar 20, 2012 at 13:10
  • @Samuel I think we have a bigger problem, which is lack of awareness in general. And most of those that are aware, dont realize that its different from privacy. So I dont think that alone will be much value. That said, I would not be opposed to elaborating on the name, or rather the subtitle, of the site. Privacy is one aspect that is apparently missing from "IT Security", but there are others (e.g. Risk Management, compliance, etc).
    – AviD Mod
    Commented Mar 20, 2012 at 13:17
  • "I think we have a bigger problem, which is lack of awareness in general." I don't understand what you're referring to. Do you mean lack of awareness for the value of privacy?
    – user7848
    Commented Mar 20, 2012 at 13:22
  • @Samuel yes. I think that (sadly) not many new users in general would be looking to ask those questions, and most of those that do wouldn't realize that it's not equivalent to security to begin with. (anecdote, that Mother Privacy question I linked to started life as the identical Security question). Of course, there are always those that do, but as I said they should wind up here anyway.
    – AviD Mod
    Commented Mar 20, 2012 at 13:26
  • Ok, so you're saying that new users will probably end up asking privacy questions at security.se anyway (mainly because they don't know the difference between privacy and security yet). And advanced users will know that they can ask privacy questions there because of experience. Is that what you mean?
    – user7848
    Commented Mar 20, 2012 at 13:41
  • Heh, pretty much. Beginners dont know the difference, and advanced ones understand the synergy, and expect it here anyway.
    – AviD Mod
    Commented Mar 20, 2012 at 13:43
  • Well, you've convinced me. I guess that we don't need an extra privacy.se then. It would be nice to have a subtitle to the current security.se though (like you suggested), to prevent any future confusion. Thanks for your answers!
    – user7848
    Commented Mar 20, 2012 at 13:51
5

We ended up having this conversation, primarily in the chat room, during the time that the site graduated from beta. Unfortunately, this was a bit too late since all of the branding and design had been finished, all of which included the dreaded 'T'.

While many of us (most?) on the site came out of an IT background, the industry as a whole has shifted more towards focusing on the information and less on the storage media. For example, while I am a highly technical person who primarily deals with IT related stuff, I like to tell people,

I'm concerned with the data. I don't care if it's in a file server, or a file cabinet. Both need to be protected, and both are in scope.

One of the guiding principles of the discipline is the notion of CIA -- Confidentiality, Integrity, and Availability. Our goal is to make sure all three are met as well as possible. That is, nobody has access to data that they shouldn't (C), the data is correct (I), and whose who need the data can reasonably get it (A). Your question about Privacy fits in with the Confidentiality aspect. Let's not forget that a privacy is a central function to many legislative and industry compliances that we are in the business of handling. Just to name a few we have FERPA, HIPAA, and PCI-DSS (the size and makeup of this list varies widely depending on your industry), but all 3 of those have Confidentiality (privacy) components.

More specifically, to TSA related questions that Avi brought up, you'll find that many Information Security experts regularly discuss such matters.

You must log in to answer this question.