Designing for Privacy and Security in Cloud Services

Guest:

• Sarah Aoun, Privacy Engineer, Google

Topic:

• You have had a fascinating career since we [Tim] graduated from college together – you mentioned before we met that you've consulted with a literal world leader on his personal digital security footprint. Maybe tell us how you got into this field of helping organizations treat sensitive information securely and how that led to helping keep targeted individuals secure?
• You also work as a privacy engineer on Fuschia, Google's new operating system kernel. How did you go from human rights and privacy to that?
• What are the key privacy considerations when designing an operating system for "ambient computing"? How do you design privacy into something like that?
• More importantly, not only "how do you do it", but how do you convince people that you did do it?
• When we talk about "higher risk" individuals, the definition can be broad. How can an average person or someone working in a seemingly less sensitive role better assess if they might be a higher-risk target? What are the subtle indicators?
• Thinking about the advice you give for personal security beyond passwords and multi-factor auth, how much of effective personal digital hygiene comes down to behavioral changes versus purely technical solutions?
• Given your deep understanding of both individual security needs and large-scale OS design, what's one thing you wish developers building cloud services or applications would fundamentally prioritize about user privacy?

Resources:

• Google privacy controls
• Advanced protection program