Applying NIST's new Privacy Risk Management Framework

Presented as part of the 2017 HCSS conference.

ABSTRACT

NIST's influential cybersecurity frameworks have been a cornerstone of the certification process. They provide methodologies and standards to help organizations rigorously analyze the security of their systems. These standards are an important step in clarifying the policy, technical, and mental models that can lead to formal and semi-formal implementations.

Building on the impact of the Risk Management Frameworks for cybersecurity, NIST is developing a Privacy Risk Management Framework. Rather than emphasizing the classic cybersecurity triad of Confidentiality, Integrity, and Availability it contributes the core privacy principles of Predictability, Manageability, and Disassociability. According to NISTIR 8062:

• Predictability is the enabling of reliable assumptions by individuals, owners, and operators about personal information and its processing by an information system.
• Manageability is providing the capability for granular administration of personal information including alteration, deletion, and selective disclosure.
• Disassociability is enabling the processing of personal information or events without association to individuals or devices beyond the operational requirements of the system.

Tozny is implementing an End-to-End Encrypted DataBase (E3DB) for any type of mobile or web application to build secure workflows into their systems. It is a type of Personal Data Service (PDS). A PDS is designed to give end users significant control over the collection, retention, and sharing of their personal data. This approach improves privacy by inverting the model where data brokers control user data and choose which 3rd parties access user data.

E³DB is one of the first projects implemented using NIST's new privacy frameworks. In this talk, we will provide:

• An overview of NIST's Privacy Framework, and related standards (800-53, 800-63),
• An experience report on implementing a product based on these standards, and
• An in-depth review of our cryptographic approach and how it supports privacy.

--

Isaac Potoczny-Jones is a cybersecurity researcher with a focus on identity management, authentication, authorization, and access control. Before founding Tozny, he was with Galois for 10 years and has been the Principal Investigator for Cybersecurity projects across a wide variety of clients, including DHS, DOE, and the DoD. Education: BS Computer Science, MS Cybersecurity. Tozny is a product spin-off of the cybersecurity research firm Galois.