A Design Approach for Minimizing Data Theft

Not a day goes by without some organization in the world being victimized by the theft of private data, resulting in heavy losses to both the organization and the owners of the data. For an organization, these losses include large expenditures to resume normal operation and damages to its reputation. For data owners, the losses may be financial, and may include identity theft. Security controls (e.g., encryption) help to secure vulnerabilities, but they are not foolproof. This paper proposes a design approach that minimizes the theft of private data from an organization by limiting as much as possible the quantity of such data that is stored on-premise or in the cloud, preferring instead to let the data remain on the user's computing device. This paper additionally presents an example of applying the approach to e-commerce.