The Golden xCOMPASS: The Compass You Need to Navigate through the App-Privacy Universe

The talk starts from the gap between security and privacy. A data breach is not automatically a privacy failure, and data collected lawfully can still create privacy problems. The speaker argues that privacy threat modeling is slow and expert-heavy, usually happens late in the software development lifecycle, and is hard for developers who lack training in privacy law such as CCPA, GDPR and COPPA.

To address this, the speaker presents xCOMPASS, an open-source framework built around a lightweight questionnaire of yes-or-no questions. Answers feed simple formulas that flag missing privacy requirements, which are then linked to the Fair Information Practice Principles, to LINDDUN privacy threat categories, and to mitigation strategies such as de-identification. The walkthrough covers questions about personal data in code, databases and logs, biometric and sensor data, children's data, access control, data minimization and disposal. Compound questions show follow-up prompts when an answer needs more review.

In the audience Q&A, the speaker explained that xCOMPASS produces a checklist of requirements rather than threat scenarios like STRIDE output, and that it overlaps with the NIST privacy guidance while being far shorter. The practical takeaway is to bring these questions into design reviews early, and optionally into CI/CD, so privacy requirements are handled before code is hard to change.