NIST Privacy Engineering Program Privacy Framework March 2019

NIST Privacy Engineering Program & Privacy Framework March 2019

Session Overview • Privacy Engineering @ NIST • Background • NIST’s approach to privacy engineering and risk mgmt • NIST Privacy Framework • Background and status of the framework • Review of the NIST Privacy Framework outline and Request for Information (RFI) analysis • Resources for engagement

NIST Privacy Engineering Program

MYTH: Privacy Is Dead Why bother? Everyone’s data is already out there. http: //gifimage. net/wp-content/uploads/2017/01/ASDF-GIF-Image-for-Whatsapp-and-Facebook-47. gif 4

Trustworthy Systems: Foundational to a Digital Society What makes systems trustworthy? • Multiple attributes of trustworthiness include security, safety, reliability, etc. • Privacy must be considered one of the attributes • How can we know if systems are trustworthy? • Repeatable and measurable approaches help provide a sufficient base of evidence • Privacy needs a body of guidance for repeatable and measurable approaches similar to other attributes of trustworthiness

CONFIDENTIALITY PRIVACY

Privacy Risk Management Information Security and Privacy Relationship • • • There is a clear recognition that security of data plays an important role in the protection of privacy Individual privacy cannot be achieved solely by securing data Authorized processing: system operations that handle data (collection – disposal) to enable the system to achieve mission/business objectives

Privacy Today: More Than a Compliance Exercise

Privacy Windex MYTH: Privacy is just legal compliance. All we need to do is spray legal compliance all over the system, and then we’re all good on privacy. http: //www. theluxuryspot. com/wp-content/uploads/2014/05/tumblr_ma 0 zg 9 v. Ay. I 1 qakgc 1 o 1_500. gif

Legal compliance is a piece of the whole privacy pie. law policy privacy risk assessment mission needs Privacy Requirements

NISTIR 8062 An Introduction to Privacy Engineering and Risk Management in Federal Systems

Risk Model Risk models define the risk factors to be assessed and the relationships among those factors. Risk factors are inputs to determining levels of risk.

Security Risk Model Risk factors: Likelihood | Vulnerability | Threat | Impact

Processing Data Can Create Problems for Individuals Dignity Loss Discrimination Loss of Self Determination Loss of Autonomy Loss of Liberty Physical Harm Economic Loss of Trust

NIST Working Model for System Privacy Risk Factors: Likelihood | Problematic Data Action | Impact Likelihood is a contextual analysis that a data action is likely to create a problem for a representative set of individuals Impact is an analysis of the costs should the problem occur Note: Contextual analysis is based on the data action performed by the system, the data being processed, and a set of contextual considerations

Primary Benefits of a Privacy Risk Assessment Methodology Communication Collaboration Informed Risk Decisions Privacy Engineered Solutions

NIST Privacy Risk Assessment Methodology (PRAM) Monitor Change Select Privacy Controls Assess Privacy Risk Frame Business Objectives Frame Org Privacy Governance Assess System Design

Privacy Engineering Collaboration Space • Online venue open to the public where practitioners can discover, share, discuss, and improve upon open source tools, solutions, and processes that support privacy engineering and risk management • Initial focus on de-identification (including and differential privacy techniques) and privacy risk assessment • Open collaboration via Git. Hub, sharing tools, use cases, and feedback

Privacy Engineering Objectives Predictability Enabling reliable assumptions by individuals, owners, and operators about PII and its processing by a system. How can the system enable reliable assumptions about data processing? Manageability Providing the capability for granular administration of PII including alteration, deletion, and selective disclosure How much manageability of data does this system need? Privacy Principles Disassociability Enabling the processing of PII or events without association to individuals or devices beyond the operational requirements of the system. How can data be dissociated from individuals or devices while still permitting functionality in the system? Mission/Business Needs | System Functionality & Design Data mapping Organizational Requirements Definition Risk Assessment Privacy Methodology* Requirements Privacy risk model Analysis approach Assessment approach Legal environment Organizational policies System privacy requirements *Per NIST Special Publication 800 -30 Controls Selection → Implementation → Assessment Privacy Posture Monitoring

What This Means for Standards

Categories of IT Standards Testing Methodology Standards IT Technical Standards Management System Standards

Draft NISTIR 8228: Considerations for Managing Io. T Cybersecurity and Privacy Risks Risk Considerations Mitigation Goals and Areas Why and how Io. T devices impact the management of cybersecurity and privacy risks Which types of cybersecurity and privacy risks matter for Io. T devices and may be most affected by the risk considerations Expectations How organizations expect conventional IT devices to help mitigate cybersecurity and privacy risks for the risk mitigation goals and areas Challenges What challenges Io. T devices may pose to the expectations and what the implications of those challenges are.

Mitigation Goals and Areas Goal 1: Protect Device Security Asset Management: Maintain a current, accurate inventory of all Io. T devices and their relevant characteristics throughout the devices’ lifecycles in order to use that information for cybersecurity and privacy risk management purposes. Vulnerability Management: Identify and eliminate known vulnerabilities in Io. T device software and firmware in order to reduce the likelihood and ease of exploitation and compromise. Access Management: Prevent unauthorized and improper physical and logical access to, usage of, and administration of Io. T devices by people, processes, and other computing devices. Device Security Incident Detection: Monitor and analyze Io. T device activity for signs of incidents involving device security. Goal 2: Protect Data Security Data Protection: Prevent access to and tampering with data at rest or in transit that might expose sensitive information or allow manipulation or disruption of Io. T device operations. Data Security Incident Detection: Monitor and analyze Io. T device activity for signs of incidents involving data security. Goal 3: Protect Individuals’ Privacy Information Flow Management: Maintain a current, accurate mapping of the information lifecycle of PII, including the type of data action, the elements of PII being processed by the data action, the party doing the processing, and any additional relevant contextual factors about the processing to use for privacy risk management purposes. PII Processing Permissions Management: Maintain permissions for PII processing to prevent unpermitted PII processing. Informed Decision Making: Enable individuals to understand the effects of PII processing and interactions with the device, participate in decision-making about the PII processing or interactions, and resolve problems. Disassociated Data Management: Identify authorized PII processing and determine how PII may be minimized or disassociated from individuals and Io. T devices. Privacy Breach Detection: Monitor and analyze Io. T device activity for signs of breaches involving individuals’ privacy.

NIST Privacy Framework: Background and Status

Why NIST? • Long track record of successfully, collaboratively working with public and private sectors • Experience developing the Cybersecurity Framework • Extensive privacy expertise

Why a privacy framework? • Designing, operating, or using technologies in ways that are mindful of diverse privacy needs in an increasingly connected and complex environment • Multiplying visions for how to address privacy challenges inside and outside the U. S. • Good cybersecurity doesn’t solve it all

What will the framework look like? Collaborative Effort

Process to Date Workshop #1 Request for Information Austin, TX Oct 16, 2018 Nov 14, 2018 – Jan 14, 2019 RFI Webinar Nov 29, 2018 RFI Analysis & Framework Outline Webinar March 14, 2019 Feb 27, 2019 ONGOING ENGAGEMENT Feedback encouraged and promoted throughout the process

Compatible and Interoperable

Benefits of Framework Attributes

Upcoming Opportunities to Engage Drafting the NIST Privacy Framework: Workshop #2 Monday, May 13 - Tuesday, May 14, 2019 Hosted by Georgia Tech Scheller College of Business Atlanta, Georgia

NIST Privacy Framework: Review of Outline and RFI Analysis

Privacy Risk Management NIST Working Model: System Privacy Risk Factors: Likelihood | Problematic Data Action | Impact

Alignment with the Cybersecurity Framework: Core FUNCTIONS Identify Protect Control Inform Respond CATEGORIES SUBCATEGORIE S INFORMATIVE REFERENCES

Alignment with the Cybersecurity Framework: Profiles

Alignment with the Cybersecurity Framework: Tiers 1 -4: 1. PARTIAL 2. RISKINFORMED 3. REPEATABLE 4. ADAPTIVE Elements per tier: Risk Management Process Informal, ad hoc privacy risk management processes that enable continuous adaptation to changing technologies and data processing activities and incorporate the use of advanced privacy-enhancing technologies Integrated Risk Management Program A limited awareness of privacy risk at the organizational level all levels of the organization being able to make decisions with a clear understanding of the relationship between privacy risk organizational objectives Ecosystem Relationships Entity does not understand its role in the larger ecosystem with respect to other entities the entity understands its role in the larger ecosystem and contributes to the community’s broader understanding and management of privacy risks Workforce A workforce that has little or no understanding of privacy risks a workforce that includes specialized privacy skillsets throughout the organizational structure

Roadmap

Resources Website https: //www. nist. gov/programs-projects/privacy-engineering https: //nist. gov/privacyframework Contact Us Ellen. nadeau@nist. gov @NISTcyber #Privacy. Engineering #Privacy. Framework