Using&Risk&Management&to&Improve& - - PowerPoint PPT Presentation

Using&Risk&Management&to&Improve& Privacy&in&Informa7on&Systems

1

Poten7al&Problems&for&Individuals

2

Loss&of&Self& Determina7on

Loss&of&Autonomy Exclusion Loss&of&Liberty Physical&Harm

Discrimina7on

S7gma7za7on Power&Imbalance

Economic&Loss Loss&of&Trust

3

Fr Frame me

As Asses ess Re Respond Mo Monit nitor r NIST&Risk&Management& Framework&for&Cybersecurity

Se

Senio nior& r& Manageme ment Pr Produc duct&Manag t&Manager er Engineer Engineer

Controls Objec7ves Governance Risk&Model

Risk&Assessment

Requirements System&Design Evalua7on Metrics

The&Right&Tool&for&the&Job

Many&current&privacy&approaches&are&some&mixture&of& governance&principles,&requirements&and&controls.&

Transparency Individual&Par7cipa7on Purpose&Specifica7on Data&Minimiza7on Use&Limita7on Data&Quality&and&Integrity Security Accountability&and& Audi7ng

Authority&and&Purpose Accountability,&Audit,&and& Risk&Management Data&Quality&and&Integrity Data&Minimiza7on&and& Reten7on Individual&Par7cipa7on&and& Redress Security Transparency Use&Limita7on

NIS NIST&S T&SP&800Y53, P&800Y53,&Ap &Appen endix&J x&J USG&FI FIPPs&

NISTIR

NIST&Process

2015 2015

6

Workshop&2

Se Sep p &2014 &2014

Dra^& Proposal&for& Objec7ves& and&Risk& Model

Au Aug 2014 2014

Workshop&1

Ap April& & 2014 2014

Dra^&Privacy&Engineering&Objec7ves

• Design&characteris7cs&or&proper7es&of&the&system
• Support&policy
• Support&control&mapping

7

Pr Predic edictability ability&is&enabling&reliable&assump7ons&by&individuals,&owners,&and&operators&about& personal&informa7on&and&its&processing&by&an&informa7on&system.& Manag Manageability eability&is&providing&the&capability&for&granular&administra7on&of&personal&informa7on& including&altera7on,&dele7on,&and&selec7ve&disclosure.& Ob Obscu curity& y&is&enabling&the&processing&of&personal&informa7on&or&events&without&associa7on&to& individuals&or&devices&beyond&the&opera7onal&requirements&of&the&system.&

Security&Risk&Equa7on

8

Security&Risk&=& =&Vulnerability&*& *&Threat&*& *&Imp mpact

Dra^&Privacy&Risk&Equa7on

Privacy&Risk&=& =&Likelihood&of&a&Problema ma7c&Data&Ac7on&*& *&Imp mpact&of&a& Problema ma7c&Data&Ac7on& Lik Likeliho elihood& d&is&a&contextual& analysis&that&a&data&ac7on&is& likely&to&create&a&problem&for&a& representa7ve&set&of&individuals

Note:&Contextual&analysis&is&based&on&the&data&ac4on&performed&by&the&system,&the&personal& informa4on&being&processed,&and&a&set&of&contextual&considera4ons

Imp mpact&is&an&analysis&of&the&costs& should&the&problem&for& individuals&occur&

Frame& Business& Objec7ves Frame&Org& Privacy& Governance Assess& System& Design Assess& Privacy&Risk Design& Privacy& Controls Monitor& Change

Implementa7on

10

Frame& Business& Objec7ves Frame&Org& Privacy& Governance Assess& System& Design Assess& Privacy&Risk Design& Privacy& Controls Monitor& Change

Implemen7ng&the& Theory

Frame&Business&Objec7ves

Frame&the&business&objec7ves&for&the&system(s),& including&the&organiza7onal&needs&served.&

12

Frame& Business& Objec7ves Frame&Org& Privacy& Governance Assess& System& Design Assess& Privacy&Risk Design& Privacy& Controls Monitor& Change

• Describe&the&func7onality&of&the&system(s).
• Describe&the&business&needs&that&the&system(s)&serve.
• Describe&how&the&system&will&be&marketed,&with&respect&to&any&

privacyYpreserving&func7onality.&

Frame&Privacy&Governance

Frame&the&organiza7onal&privacy&governance&by& iden7fying&privacyYrelated&legal&obliga7ons,&principles,&

• rganiza7onal&goals&and&other&commitments.

13

Frame& Business& Objec7ves Frame&Org& Privacy& Governance Assess& System& Design Assess& Privacy&Risk Design& Privacy& Controls Monitor& Change

• Legal&Environment:&Iden7fy&any&privacyYrelated&statutory,&

regulatory,&contractual&and/or&other&frameworks&within&which& the&system&must&operate.&

• Iden7fy&any&privacyYrelated&principles&or&other&commitments&to&

which&the&organiza7on&adheres&(FIPPs,&Privacy&by&Design,&etc.).

• Iden7fy&any&privacy&goals&that&are&explicit&or&implicit&in&the&
• rganiza7on’s&vision&and/or&mission.&
• Iden7fy&any&privacyYrelated&policies&or&statements&within&the&
• rganiza7on,&or&business&unit.

Assess&System&Design&–&Data&Ac7ons

14

Frame& Business& Objec7ves Frame&Org& Privacy& Governance Assess& System& Design Assess& Privacy&Risk Design& Privacy& Controls Monitor& Change ACME%IDP

Generation/ Transformation Retention/ Logging Disposal Collection

(2)

User

(3) (1,%3,%4,%5,%6)

Disclosure/ Transfer

(4) OTP% Provider Cloud%Storage% Provider Individual Data6Store Web6 Application ACME Third6Party Government Cell6phone Documents

LEGEND

Social%Media% Site (5)(3,4) Govt.%Storage

User

Government% Benefits% (7,8) (8) (9) (7,%9,%6) (1) Third%Party% inPperson% identity%proofing

Assess&System&Design&Y&Context

Frame& Business& Objec7ves Frame&Org& Privacy& Governance Assess& System& Design Assess& Privacy&Risk Design& Privacy& Controls Monitor& Change

Assess&Privacy&Risk

Frame& Business& Objec7ves Frame&Org& Privacy& Governance Assess& System& Design Assess& Privacy&Risk Design& Privacy& Controls Monitor& Change

Assess&Privacy&Risk

Frame& Business& Objec7ves Frame&Org& Privacy& Governance Assess& System& Design Assess& Privacy&Risk Design& Privacy& Controls Monitor& Change

A A B B R R D D E E F F G G H H I I J J K K L L M M N N O O P P Q Q C C S S T T U U V V W W X X Y Y DD DD AA AA BB BB CC CC Z Z EE EE

5 10 15 20 25 30 35 40 45 50 1 2 3 4 5 6 7 8 9 10

Imp mpact Lik Likeliho elihood d

Problem& m&Priori7za7on&Heat&Map

Resources&

NIST&Privacy&Engineering&Website:& hop://csrc.nist.gov/projects/privacy_engineering/index.html

18

Ques7ons&

Contact: Naomi&Leqovitz naomi.leqovitz@nist.gov

19