Identity, Access Management, and Authentication for Privacy Flashcards

Which privacy-enhancing identity technique allows a user to prove they meet a requirement (e.g., age over 18) without revealing their actual attribute value?

Answer: Zero-knowledge proof

Zero-knowledge proofs enable verification of a claim without disclosing the underlying data, directly applying identity minimization in authentication flows.

What is the difference between 'authentication' and 'authorization' in the context of personal data access?

Answer: Authentication verifies who you are; authorization determines what you are permitted to access

Authentication confirms identity (who are you?), while authorization enforces access control (what are you allowed to do?); both are required to protect personal data.

A company uses attribute-based access control (ABAC) to restrict access to medical records. What makes ABAC more privacy-protective than simple RBAC?

Answer: ABAC can incorporate contextual attributes (time, location, data sensitivity) for finer-grained, purpose-aware access decisions

ABAC evaluates multiple attributes — user role, resource sensitivity, time of day, location — enabling dynamic, context-sensitive access decisions that align more precisely with the need-to-know principle.

What is an 'access log' used for from a privacy accountability perspective?

Answer: Creating an auditable record of who accessed personal data, when, and from where

Access logs enable post-hoc detection of unauthorized access, support breach investigations, and demonstrate accountability for personal data access to regulators.

Which federated identity standard is widely used for delegating authorization to third-party applications without sharing user credentials?

Answer: OAuth 2.0

OAuth 2.0 provides an authorization framework allowing users to grant third-party apps limited access to their resources without exposing their passwords.

A healthcare organization conducts quarterly 'access reviews' where managers certify which employees need continued access to patient records. What privacy risk does this address?

Answer: Privilege creep — accumulation of unnecessary access rights over time

Access reviews identify and remediate privilege creep, ensuring that only individuals with a current, legitimate need retain access to sensitive personal data.