10.2 Intrusion Detection and Prevention, and Privacy in Change Management

10.2 Intrusion Detection and Prevention, and Privacy in Change Management

Quick Summary: Two everyday security disciplines carry privacy consequences. Intrusion detection and prevention helps detect attacks against personal data, but it also inspects traffic full of personal data, so it needs its own privacy controls. Change management governs patches, upgrades, and releases; when it ignores privacy, an update can quietly reset settings, add data collection, or expose fields that were hidden.

---

Intrusion Detection and Prevention Systems

An intrusion detection system (IDS) monitors network traffic or host activity and raises alerts about suspected attacks. An intrusion prevention system (IPS) does the same but sits inline, so it can block or drop malicious traffic as it happens. NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems, groups them as follows:

Related tools include web application firewalls (WAFs), which block attacks against web applications, and endpoint detection and response (EDR) agents, which record detailed endpoint activity.

Detection Methods

• Signature-based: matches known attack patterns. Accurate for known threats, blind to new ones.
• Anomaly-based: learns a baseline and flags deviations, such as a service account that normally reads 50 records an hour suddenly reading 50,000. Better at new threats, but noisier.
• Stateful protocol analysis: compares activity against expected protocol behavior to spot misuse.

Using IDS/IPS to Protect Personal Data

• Watch the paths to personal data: place sensors at the boundaries of networks and hosts that hold sensitive data, and monitor egress for exfiltration.
• Add data-aware signals: combine IDS alerts with database activity monitoring and data loss prevention, so a large export of customer records is flagged even when the attacker uses valid credentials.
• Deploy honeytokens: plant fake customer records, API keys, or credentials that no legitimate process ever touches. Any access to them is a high-confidence alert that someone is browsing or stealing data.
• Tune deliberately: false positives cause alert fatigue, and false negatives miss real breaches. Review rules after each incident and test them against realistic attacks.

The Privacy Risks of IDS/IPS Themselves

Intrusion detection inspects the very data it protects, so it needs its own privacy controls:

• Minimize payload capture. Many detections need only headers and metadata; store full packet captures only when an alert fires and only briefly.
• Control TLS inspection. Decrypting traffic exposes passwords, health searches, and banking sessions. Exempt sensitive categories (for example, health and banking sites) where policy and law require, and tell employees about inspection.
• Restrict and log analyst access to captured data and alerts.
• Set retention limits for logs, alerts, and captures, and include them in the data inventory.
• Respect workplace monitoring rules when sensors observe employees (Section 12.3).

---

Privacy in Change Management: Patches and Upgrades

Change management is the controlled process for proposing, assessing, approving, testing, deploying, and reviewing changes. Its main security purpose is to apply fixes quickly without breaking systems. Its privacy purpose is to make sure changes do not create new collection, new disclosure, or weaker settings.

How Changes Create Privacy Problems

• Defaults reset by upgrades: a release that migrates settings can silently set privacy options back to permissive defaults.
• New SDK versions: an analytics or ad SDK upgrade can add new identifiers or data types.
• Schema migrations: a new column or API field can expose data that was previously hidden.
• Debug logging left on: verbose logging enabled during a fix can capture personal data.
• Data migrations: copying production data to a new platform or test environment without masking.

Real incidents show the pattern. In 2018, a Facebook bug set the default audience of new posts to public for about 14 million users for several days. In early 2019, Twitter disclosed that an Android bug, present since 2014, had turned off the "Protect your Tweets" setting for some users who changed account settings, making their posts public.

Controls in the Change Process

1. Privacy triggers in the change request: questions such as "Does this change add, alter, or expose personal data, add a third-party SDK, or change a privacy default?" route the change to privacy review and, where needed, a DPIA update.
2. Automated privacy regression tests: assert that privacy defaults, consent gating, masking, and retention behavior are unchanged after each build.
3. Configuration drift detection: compare running configurations with approved baselines.
4. Staged rollouts and feature flags: release to a small population first, monitor data flows and complaints, and keep the ability to roll back.
5. Timely patching: prioritize vulnerabilities known to be exploited, such as those on CISA's Known Exploited Vulnerabilities catalog, because unpatched systems are a leading cause of breaches.
6. Post-implementation review: confirm data flows match what was approved and update the inventory and notices.
7. Emergency changes: fast-tracked fixes still need after-the-fact privacy review and documentation.