Identity, Access Management, and Authentication for Privacy Flashcards

From a privacy perspective, why is collecting biometric data for authentication considered higher risk than password-based authentication?

Answer: Biometric data is immutable — if compromised, the individual cannot change their fingerprint or iris scan

Unlike passwords, biometrics cannot be reset after a breach; the permanent nature of biometric identifiers makes their compromise a lifelong privacy harm.

What is the 'need-to-know' principle as applied to personal data access in identity management?

Answer: Individuals should only access personal data that is necessary for their specific, current task

Need-to-know limits data access to what is required for the immediate, specific task, preventing unnecessary exposure even among authorized users.

An organization implements 'just-in-time' (JIT) privileged access, granting elevated permissions only for the duration of a specific task. What privacy benefit does this provide?

Answer: Minimizes the window of exposure for sensitive data by eliminating persistent privileged access

JIT access ensures that elevated permissions exist only as long as the task requires, dramatically reducing the risk of insider misuse or credential theft of persistent admin accounts.

Under the US Health Insurance Portability and Accountability Act (HIPAA), what access control requirement applies to electronic protected health information (ePHI)?

Answer: Covered entities must implement technical policies to allow access only to authorized persons or software programs

HIPAA's Technical Safeguards require covered entities to implement access controls ensuring only authorized users can access ePHI systems.

What is 'identity proofing' and why is it important for privacy?

Answer: Verifying that a person is who they claim to be before creating an account, preventing fraudulent or duplicate identities

Identity proofing validates that the person requesting an account or access is legitimate, preventing account fraud, impersonation, and unauthorized access to personal data stores.

Which privacy risk is specifically introduced when an organization relies on a social login provider (e.g., 'Login with Facebook') for authentication?

Answer: The social provider may receive data about the user's activity across the organization's applications

Social login shares authentication events and potentially behavioral data with the identity provider, creating a third-party data disclosure that users may not fully understand.