Solving the problem of privacy by design can bring more than it costs. Answering in real time the Who/What/Where/When question in accessing private data enforces a application design that can have some other benefits.
Web application security : the WWWW challenge
As described in in previous post, the Who What Where/When is a key challenge behind the privacy by Design concept. Knowing at any time Who can access/modify What in which part of the process (When/Where) is a question that should be reliably answered to encore a proper web application security. The full data lifecycle has to be covered so that only the right people can access private data, and that this access is allowed only in the right step of the data lifecycle.
When analysing the code of existing applications where rights are managed without tools such as Confidentializer, one can discover how huge and complex the task is. As a matter of fact, for applications with a quite rich combination of states, users, and data sets this can become the main trigger for evolution costs.
Solving the WWWW challenge and being savvy
User Interfaces are most of the time built from a finite number of blocks that share the same privacy. A Web Application of several dozens of pages is often organised around a handful of main pages that have many variations targeting different users and moments in the lifecycle of the entities displayed on the page. For example a collaborative economy sales pages will display a product, information about the seller, messages exchanged with the seller. The page will be different for the seller, the seller when editing its ad, the buyer, the moderator, and this will change again depending on the sales status.
Those variations generate most of the app’s development cost.
Where centralised security boosts development efficiency
What if each UI block coud adapt itself in read/write/act mode depending on the user and context ?
That’s exactly what managing WWWW is about. Web application security is not necessarily a burden. If properly managed, this can be a vector for front end simplification. Each front end component, or page “widget” will only be developed once, adapting itself to the situation thanks to the fine grained access rights provided by the Confidentializer framework. Security is managed by a centralised security service and front end adapts so to avoid frustrating the user. This reduces a huge combination of situations to a flat list. A global security mechanism is implemented the same way in all widgets, the combination being managed by a security service powered by Confidentializer.
This brings several advantages:
- Reduced costs
- Parallelised work
- Easier testing
- Better adaptability to workflow changes
