Study guide
10.2 Intrusion Detection and Prevention, and Privacy in Change Management
Certified Information Privacy Technologist CIPT
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CIPT Exam Overview and Study Plan
1.1 CIPT Exam Facts, Blueprint, and Study Plan
2 Chapter 2: The Privacy Technologist's Legal and Procedural Role
2.1 Privacy Function Roles: DPO, Data Owner, Steward, Custodian, Legal, and Security 2.2 Translating Legal and Regulatory Requirements into Technical Controls 2.3 Notices, Policies, and Oversight of Privacy Operations, Audits, and Third Parties
3 Chapter 3: Technical Responsibilities: Risk Concepts and Incident Response
3.1 Risk Concepts: Threat, Vulnerability, Attack, Exploit, and Privacy Risk 3.2 Technical Support for Privacy Incident and Breach Response
4 Chapter 4: Privacy Risk Models, Frameworks, and Threat Models
4.1 Privacy Risk Models and Frameworks: Contextual Integrity, Calo, Solove, FIPPs, OECD, NIST, and FAIR 4.2 Privacy Threat Models: LINDDUN and MITRE PANOPTIC
5 Chapter 5: Data Ethics and Automated Decision-Making
5.1 Legal Versus Ethical Processing and the Social Impact of Privacy-Affecting Designs 5.2 Identifying and Minimizing Bias in Automated Decision-Making
6 Chapter 6: Minimizing Privacy Risk During Data Collection
6.1 Notice, Consent Management, and Choice Architecture 6.2 Managing Privacy Risk in Automatic Collection and Telemetry 6.3 Extracting Personal Data from Publicly Available Sources 6.4 Data Retention, Destruction, and Cryptographic Erasure 6.5 Data Minimization Techniques 6.6 Implementing Data Processing Segregation
7 Chapter 7: Minimizing Privacy Risk During Data Use: Aggregation, PETs, and Secondary Use
7.1 Minimizing Privacy Risk from Aggregation and Inference 7.2 De-identification, Pseudonymization, and Tokenization 7.3 Microdata Protection: k-Anonymity, l-Diversity, and t-Closeness 7.4 Advanced PETs: Differential Privacy, Secure Multi-Party Computation, and Homomorphic Encryption 7.5 Secondary Use, Function Creep, and Purpose Limitation Controls
8 Chapter 8: Minimizing Privacy Risk During Dissemination
8.1 Disclosure and Accessibility Controls: APIs, Egress, and Clean Rooms 8.2 Countering Distortion, Exposure, Breach of Confidentiality, Blackmail, and Appropriation 8.3 Defense in Depth: Identity, Access Management, and Authentication
9 Chapter 9: Intrusion, Decisional Interference, and Dark Patterns
9.1 Minimizing Intrusion and Decisional Interference: Behavioral Advertising, Profiling, Cyberbullying, and Social Engineering 9.2 Dark Patterns and Deceptive Design
10 Chapter 10: Privacy Risks Related to Software Security
10.1 Detecting and Fixing Software Privacy Vulnerabilities 10.2 Intrusion Detection and Prevention, and Privacy in Change Management 10.3 Service Providers, Third-Party SDKs, and Supply Chain Risk
11 Chapter 11: Tracking and Surveillance Technologies
11.1 Privacy Risks and Impacts of E-Commerce 11.2 Audio and Video Surveillance, Wearables, and IoT 11.3 Privacy Issues Around Biometrics: Facial, Voice, Fingerprint, and DNA Data 11.4 Privacy Risks and Impacts of Location Tracking 11.5 Internet Monitoring and Web Tracking: Cookies, Fingerprinting, and GPC
12 Chapter 12: Workplace Technologies: AI, Communications, and Monitoring
12.1 Identifying and Minimizing Privacy Risks in AI, Machine Learning, and Deep Learning 12.2 Privacy Risks of Communications Technologies: Video Calls, Messaging, Mobile Devices, Social Media, and Gaming 12.3 Workplace Monitoring and BYOD Privacy
13 Chapter 13: Monitoring and Managing Privacy Risk
13.1 Privacy Audits, IT Control Reviews, KRIs, and KPIs 13.2 Completing Privacy and Data Protection Impact Assessments
14 Chapter 14: Implementing Privacy by Design
14.1 Cavoukian's Seven Foundational Principles of Privacy by Design 14.2 Privacy Goals, Objectives, and Translating High-Level Specifications into Low-Level Specifications 14.3 Hoepman's Privacy Design Strategies: Data-Oriented Strategies 14.4 Hoepman's Privacy Design Strategies: Process-Oriented Strategies
15 Chapter 15: Evaluating Privacy Risks in User Experiences
15.1 Privacy in User Experience: UX Concepts and Usability Testing 15.2 Value Sensitive Design
16 Chapter 16: Privacy Engineering Objectives, Architecture, and the Development Life Cycle
16.1 NIST Privacy Engineering Objectives: Predictability, Manageability, and Disassociability 16.2 Enterprise Architecture, Data Flow Mapping, Lineage, and Cross-Border Transfers 16.3 Managing Privacy Risk in the Software Development Life Cycle 16.4 Applying LINDDUN Threat Modeling in Engineering
17 Chapter 17: Managing and Monitoring Privacy Controls
17.1 Data Inventories, Records of Processing Activities, and Asset Discovery 17.2 Privacy Code Review and Runtime Behavior Monitoring
10.2 Intrusion Detection and Prevention, and Privacy in Change Management
Key Takeaways Explain This Topic AI
An IDS monitors and alerts, while an IPS sits inline and can block traffic; both come in network-based and host-based forms.
Detection methods include signature-based, anomaly-based, and stateful protocol analysis, as described in NIST SP 800-94.
IDS sensors and packet captures contain personal data, so minimize payload capture, restrict access, and set short retention.
Honeytokens, such as fake customer records or credentials that no legitimate process uses, give high-confidence alerts of unauthorized access to personal data.
Change management should trigger privacy review for changes touching personal data and run automated tests that verify privacy defaults survive every patch and upgrade.
Last updated: October 2026
10.2 Intrusion Detection and Prevention, and Privacy in Change Management
Quick Summary: Two everyday security disciplines carry privacy consequences. Intrusion detection and prevention helps detect attacks against personal data, but it also inspects traffic full of personal data, so it needs its own privacy controls. Change management governs patches, upgrades, and releases; when it ignores privacy, an update can quietly reset settings, add data collection, or expose fields that were hidden.
Intrusion Detection and Prevention Systems
An intrusion detection system (IDS) monitors network traffic or host activity and raises alerts about suspected attacks. An intrusion prevention system (IPS) does the same but sits inline , so it can block or drop malicious traffic as it happens. NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems , groups them as follows:
Type Where It Watches Example Detections
Network-based (NIDS/NIPS) Traffic on network segments SQL injection strings, scanning, command-and-control traffic
Host-based (HIDS/HIPS) Activity on a single server or endpoint Unexpected processes, file changes, privilege escalation
- Wireless Wireless network activity Rogue access points
- Network behavior analysis Traffic flows and volumes Unusual large transfers, new external destinations
Related tools include web application firewalls (WAFs) , which block attacks against web applications, and endpoint detection and response (EDR) agents, which record detailed endpoint activity.
Detection Methods
Signature-based: matches known attack patterns. Accurate for known threats, blind to new ones.
Anomaly-based: learns a baseline and flags deviations, such as a service account that normally reads 50 records an hour suddenly reading 50,000. Better at new threats, but noisier.
Stateful protocol analysis: compares activity against expected protocol behavior to spot misuse.
Using IDS/IPS to Protect Personal Data
Watch the paths to personal data: place sensors at the boundaries of networks and hosts that hold sensitive data, and monitor egress for exfiltration.
Add data-aware signals: combine IDS alerts with database activity monitoring and data loss prevention, so a large export of customer records is flagged even when the attacker uses valid credentials.
Deploy honeytokens: plant fake customer records, API keys, or credentials that no legitimate process ever touches. Any access to them is a high-confidence alert that someone is browsing or stealing data.
Tune deliberately: false positives cause alert fatigue, and false negatives miss real breaches. Review rules after each incident and test them against realistic attacks.
The Privacy Risks of IDS/IPS Themselves
Intrusion detection inspects the very data it protects, so it needs its own privacy controls:
Minimize payload capture. Many detections need only headers and metadata; store full packet captures only when an alert fires and only briefly.
Control TLS inspection. Decrypting traffic exposes passwords, health searches, and banking sessions. Exempt sensitive categories (for example, health and banking sites) where policy and law require, and tell employees about inspection.
Restrict and log analyst access to captured data and alerts.
Set retention limits for logs, alerts, and captures, and include them in the data inventory.
Respect workplace monitoring rules when sensors observe employees (Section 12.3).
Privacy in Change Management: Patches and Upgrades
Change management is the controlled process for proposing, assessing, approving, testing, deploying, and reviewing changes. Its main security purpose is to apply fixes quickly without breaking systems. Its privacy purpose is to make sure changes do not create new collection, new disclosure, or weaker settings.
How Changes Create Privacy Problems
Defaults reset by upgrades: a release that migrates settings can silently set privacy options back to permissive defaults.
New SDK versions: an analytics or ad SDK upgrade can add new identifiers or data types.
Schema migrations: a new column or API field can expose data that was previously hidden.
Debug logging left on: verbose logging enabled during a fix can capture personal data.
Data migrations: copying production data to a new platform or test environment without masking.
Real incidents show the pattern. In 2018, a Facebook bug set the default audience of new posts to public for about 14 million users for several days. In early 2019, Twitter disclosed that an Android bug, present since 2014, had turned off the "Protect your Tweets" setting for some users who changed account settings, making their posts public.
Controls in the Change Process
Privacy triggers in the change request: questions such as "Does this change add, alter, or expose personal data, add a third-party SDK, or change a privacy default?" route the change to privacy review and, where needed, a DPIA update.
Automated privacy regression tests: assert that privacy defaults, consent gating, masking, and retention behavior are unchanged after each build.
Configuration drift detection: compare running configurations with approved baselines.
Staged rollouts and feature flags: release to a small population first, monitor data flows and complaints, and keep the ability to roll back.
Timely patching: prioritize vulnerabilities known to be exploited, such as those on CISA's Known Exploited Vulnerabilities catalog, because unpatched systems are a leading cause of breaches.
Post-implementation review: confirm data flows match what was approved and update the inventory and notices.
Emergency changes: fast-tracked fixes still need after-the-fact privacy review and documentation.