Classification of personal data security threats in information systems

Abstract

The purpose of this work is to analyze and classify threats that arise when working with personal data in information systems. In the field of information technology in any country, one of the national interests is to ensure and protect the constitutional rights and freedoms of man and citizen in so far as it relates to the receipt and use of information, as well as confidentiality when using information technologies. In this regard, special attention is currently being paid to the organization of processing and ensuring the security of personal data in information systems, including during their cross-border transfer. In the European Union, this activity is regulated by the General Data Protection Regulation (GDPR), which was put into effect on May 25, 2018. Personal data are in a high-risk area, especially in organizations that operate with large amounts of personal data, such as passport data, solvency data, employers, contact details, phone numbers, addresses, email, and other information that represents interest for potential computer attacks. The solution to the problem of ensuring the security of personal data is impossible without identifying and classifying potential threats to personal data in information systems. The proposed classification can serve as the basis for a threat model of a specific information system designed to process personal data.