# Insiders Call Summary: Best practices for data security 🔒

**URL:** <https://forum.getodk.org/t/insiders-call-summary-best-practices-for-data-security/50636>\
**Category:** Community\
**Created:** [November 6, 2024, 11:29pm UTC](https://forum.getodk.org/t/insiders-call-summary-best-practices-for-data-security/50636 "2024-11-06T23:29:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aly\_Blenkin](https://getodk.b-cdn.net/user_avatar/forum.getodk.org/aly_blenkin/32/19303_2.png) [@Aly\_Blenkin](https://forum.getodk.org/u/Aly_Blenkin)\
**Post date:** [November 6, 2024, 11:29pm UTC](https://forum.getodk.org/t/insiders-call-summary-best-practices-for-data-security/50636/1 "2024-11-06T23:29:07Z")

</div>

[![](https://getodk.b-cdn.net/uploads/default/original/3X/8/f/8f1c0cf10cadb65899147b5bd4cf850a67c7d9cd.jpeg "ODK Insiders Call: Best practices for data security") ](https://www.youtube.com/watch?v=_S7Fp-LzevU)

Thank you to everyone who joined the lively conversation on data security and privacy last week!

🍿 **Lightning talk**  
@chrissyhroberts and @seadowg shared their insights on fingerprint data collection using [Keppel](https://forum.getodk.org/t/odk-fingerprints-biometrics-framework/37648), a ODK-compatible tool developed for Ebola vaccine trials. They showed a demo of how it integrates with Collect and highlighted the risks of collecting any type of sensitive data.

💬 **Strategies to identify and mitigate potential risks**  
@LN walked us through the benefits of [threat modeling](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html) how frameworks like [STRIDE](https://en.wikipedia.org/wiki/STRIDE_model) can be used to identify and assess risks. Together, we discussed mitigating threats such as:

- Leakage of biometric data from servers
- Disruption caused by individuals registering as the wrong person
- Risks of device theft by malicious actors

🔒 **ODK's security practices**  
@yanokwa shared our [new security documentation](https://docs.getodk.org/security) detailing how we safeguard the sensitive data you collect with ODK. He also went through recommendations for device settings and considerations for hosting.

🧭 **Product updates**  
We skipped product updates to give more time for discussion, but you can check out the [slides](https://docs.google.com/presentation/d/1AsoAwHDNa9MhMPkgZnh0bIZztGCGAwr7QsD15cjTIDo/edit?usp=sharing) or the [roadmap](https://getodk.notion.site/2cba7220132e49ffb56f8fce96d06bd0?v=9a7f435947a84f7eb10bdaa94d2bef11) to see what's coming up next with Central, Collect, and Web Forms.

🔥 **After Hours**  
Looks like after hours might become a regular thing, as there were plenty of questions and more discussions after the call. After hours are not recorded, so to participate, become an Insider.

📚 **Resources**

- [Slide deck](https://docs.google.com/presentation/d/1AsoAwHDNa9MhMPkgZnh0bIZztGCGAwr7QsD15cjTIDo/edit?usp=sharing)
- [ODK Security doc](https://docs.getodk.org/security) - our threat models, security practices, and device recommendations
- [OWASP threat modeling cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html)
- [ODK Collect’s protected settings](https://docs.getodk.org/collect-settings#admin-settings)
- [ruODK v1.5.1 release](https://forum.getodk.org/t/new-release-ruodk-v1-5-1-odata-entities/50620) - now with Entities support
- [Simprints](https://www.simprints.com/) - biometrics solution compatible with ODK that includes search by print

Please add to the thread if we missed anything, you have questions, or other resources to share.

🗓 **Join us on Dec 4th**  
It’s been fantastic to see some new faces on the calls and to learn from your experiences! Our next [@Insiders](https://forum.getodk.org/groups/insiders) call will focus on capturing and editing a point or location in both Collect and Web Forms. Want to join? [Learn how](https://forum.getodk.org/t/how-to-become-an-odk-insider/45134).

---

<div class="post-metadata">

**Author:** ![yanokwa](https://getodk.b-cdn.net/user_avatar/forum.getodk.org/yanokwa/32/1695_2.png) [@yanokwa](https://forum.getodk.org/u/yanokwa)\
**Post date:** [November 14, 2024, 6:54pm UTC](https://forum.getodk.org/t/insiders-call-summary-best-practices-for-data-security/50636/2 "2024-11-14T18:54:55Z")

</div>