Kim Wuyts — Privacy Threat Modeling

A system can protect data from attackers and still violate the privacy of the people using it. Kim Wuyts, a privacy researcher and contributor to LINDDUN, explains why privacy deserves its own threat modeling questions. She distinguishes security goals from harms to individuals, then walks through the framework’s approach to finding privacy risks in software designs. The conversation explores how linking ordinary pieces of information can identify a person, why non-repudiation can be undesirable in a privacy context, and what disclosure, awareness, and compliance mean for a design. Kim also discusses the relationship with privacy by design and offers a practical starting point for teams that already use diagrams and security threat modeling.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Kim Wuyts:
→ Kim Wuyts on LinkedIn

Mentioned in this episode:
→ LINDDUN privacy threat modeling
→ LINDDUN research and publications

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Privacy threat modeling with Kim Wuyts
01:44 Kim’s research background and LINDDUN
04:08 How privacy differs from security
05:55 Modeling harm to the data subject
08:50 Using diagrams and the LINDDUN framework
10:50 Linkability and identifying people from data
14:32 Lessons from the AOL search-data release
15:43 Non-repudiation as a privacy threat
16:44 Detectability and privacy
17:52 Information disclosure and the remaining categories
20:14 The connection to privacy by design
21:06 Getting started with LINDDUN
23:46 Future directions for privacy threat modeling
25:57 Kim’s closing advice