AI
Data Security Is Not Data Privacy
Data security protects any data from unauthorized access, using controls like encryption and MFA. Data privacy is different. It governs proper handling, processing, and storage of personal information, including data about people who never interact with an application directly. GDPR and California’s privacy statute create legal obligations, but privacy also covers individual dignity and consent. The two can conflict. Non-repudiation is a security goal in STRIDE. Repudiation (plausible deniability) is a privacy goal in LINDDUN. Systems must navigate both.
Seven Privacy Threat Categories: The LINDDUN Acronym
LINDDUN stands for Linking, Identifying, Non-repudiation, Detecting, Data disclosure, Unawareness, and Non-compliance. Linking connects data points without identifying anyone by name. A 1997 study by Latanya Sweeney found that zip code, gender, and date of birth alone identify 87% of the US population. Detecting reveals that someone uses a sensitive service through traffic analysis alone, without reading content. Unawareness covers cases where users cannot consent to collection they do not know is happening. Non-compliance only qualifies as a LINDDUN threat when it enables one of the other six categories.
LINDDUN GO: A 33-Card Brainstorming Deck
LINDDUN has three tiers. LINDDUN GO is the leanest. A 33-card deck covers all seven threat categories, one card per threat. Each card lists the threat title, the hotspot where it applies, the threat source (internal or external), elicitation questions, examples, and consequences. Teams draw one card at a time, answer the questions against a rough system sketch, and mark threats that apply. LINDDUN PRO adds a full DFD and mapping tables for systematic prioritization. LINDDUN MAESTRO, still in development, targets exhaustive analysis of a single threat type. The framework was first introduced in 2010 by KU Leuven’s DistriNet research group.
Hotspots Replace Trust Boundaries
STRIDE threat modeling centers on trust boundaries where privilege levels change between components. LINDDUN replaces those with hotspots. A hotspot combines DFD elements (user, process, data store, directional flows) with personal data markers at each node. Personal data is broader than PII. Checkout history, search queries, and browsing patterns all qualify. Each card in the LINDDUN GO deck names the hotspot type where the threat occurs. Mapping inbound personal data, stored records, and outbound flows to third parties tells teams exactly where to apply the elicitation questions.
Library Management System: Three Threats Surfaced by the Card Deck
The demo targets a public library management system with three actors: librarians, registered members, and anonymous users. The American Library Association holds that users should access resources without their reading habits being scrutinized. Anonymous search queries carry browser fingerprints. Two searches from the same device two weeks apart can link a person to chronic illness research with no login required. The system also sends aggregate search and borrowing records to an external AI API called Books Without Borders for book recommendations, raising data disclosure and unawareness concerns.
Mitigating Privacy Threats with PETs and Pseudonyms
Three concrete mitigations come out of the library demo. For Books Without Borders: disclose data sharing in plain language and let members opt in rather than opt out. For the AI data analysis: strip or hash the library location so the external engine sees aggregate trends without linking records to a specific branch or user. For hold labels on physical shelves: let members submit a pseudonym when placing a reserve. The shelf label shows the pseudonym, not a full name. No OWASP-style risk calculator exists yet for privacy threat scoring.
Notable Quotes
75% of uh the residents have asthma and Shanni Prutchi · ▶ Watch (18:42)
Census records you can identify 87% of Shanni Prutchi · ▶ Watch (20:07)
terms of service great who reads them yeah if Shanni Prutchi · ▶ Watch (24:56)
Key Takeaways
- Zip code, gender, and date of birth alone identify 87% of the US population through linking.
- LINDDUN GO’s 33 cards require only a rough system sketch, not a full DFD.
- Non-repudiation conflicts with privacy: audit logs that catch attackers can also expose whistleblowers.
- Data minimization is the primary control: don’t collect or process data the system does not need.
- Opt-in consent offers stronger privacy protection than opt-out defaults for sensitive data sharing.
About the Speaker(s)
Shanni Prutchi is an information security consultant at CrowdStrike, where she delivers incident response tabletop exercises and cybersecurity maturity assessments. She previously worked as a web application ethical hacker at Bishop Fox, where she developed expertise in threat modeling and application security. She serves on the ASVS working group and is a member of the Philadelphia OWASP chapter.
Chris Bush is an application security architect with 35 years of IT experience, the majority in security. His background covers threat modeling, architecture review, secure code review, and web and mobile application penetration testing. He has served as a Technical Project Advisor for OWASP, as an officer of the (ISC)2 Cleveland Chapter, and has spoken at regional and national security conferences.