privacy engineering tutorial (trustcom2015)

1 © Nokia Solutions and Networks 2014

Privacy Engineering

PUBLIC

Dr Ian Oliver

Security Research, Nokia Networks

7 April 2015


Contents

•Quick Introduction & Contents

• A note of Privacy by Design

•Data Flow Modelling

• Language and its semantics

• Analysis

•Ontology and Terminology

• What’s wrong with ”PII” and ”Personal Data”

• Ontologies of Information, Requirements and RIsk

•Requirements Engineering

• Aspects, Development Flow and Privacy Ontologies

PUBLIC

•Risk

• Information classes

• The role of modelling and terminology

• Analysis, FMEA, RCA

• Metrics

• Differential Privacy, k-Anon, l-Div etc

• Hashing, and the identifier problem

• Encryption

•Culture

• Aviation, Surgery (!)

• Privacy as a safety-critical concern

•Summary and Questions


Dataflow Modelling

<Change information classification in footer>


Data Flow Modelling – Basic Syntax and Semantics

PUBLIC


Data Flow Modelling - Partitioning

PUBLIC


Data Flow Modelling - Annotations

PUBLIC


Data Flow Modelling - Analysis

PUBLIC

•Processes ’preserve’ information

•Boundary Crossing

•Policy Calculation

• (and therefore Policy Generation)


Data Flow Modelling - Annotations

PUBLIC


Ontology and Terminology




PUBLIC

Personal Data and PII



PUBLIC


are the worst terms you can have for describing data



PUBLIC


are the worst terms you can have for describing data

these terms should be banned! never use them!



PUBLIC



PUBLIC


that fact that an information set contains

is derived or calculated from:

the information type, usage, purpose, provenance, jurisdiction etc. of the information set’s contents



PUBLIC

Common Terminology and Meaning

is CRITICAL

to a shared understanding between all privacy parties

(lawyers, engineers, advocates)


Requirements Engineering




PUBLIC

Scary truth for privacy lawyers:



PUBLIC

Scary truth for privacy lawyers: You are all requirements engineers!



PUBLIC



PUBLIC

Ontology class x Requirements Aspect x Level of Abstraction



PUBLIC


x Specific/Edge Cases



PUBLIC


x Specific/Edge Cases

Patterns



PUBLIC

Another scary truth for privacy lawyers:



PUBLIC

Another scary truth for privacy lawyers: Policies are Requirements



PUBLIC

Another scary truth for privacy lawyers: Policies are Requirements furthermore!



PUBLIC

Another scary truth for privacy lawyers: Policies are Requirements furthermore! Requirements are Policies!



PUBLIC

increasing strength of requirements or

decreasing risk



PUBLIC


decreasing risk

beyond here we can not construct a system



PUBLIC


decreasing risk


the sum of all our requirements



PUBLIC


decreasing risk


the sum of all our requirements

zone of acceptable

risk

retrenchment of requirements


Risk



Risk

PUBLIC

•Information classes •The role of modelling and terminology •Analysis, FMEA, RCA •Metrics •Differential Privacy, k-Anon, l-Div etc •Hashing, and the identifier problem •Encryption

Privacy Engineering is about managing risk through a well-defined, rigorous process of construction and measurement encompassing all abstraction levels


Risk

PUBLIC


Privacy Engineering is about managing risk through a well-defined, rigorous process of construction and measurement encompassing all abstraction levels •lawyers call this due dilligence •engineers call this ”good engineering” •privacy advocates call this ”woo yeah!! privacy baby!!”


Risk

PUBLIC

We do not have simple metrics for risk Other than potential cost in financial terms


Risk

PUBLIC

The role of modelling and terminology


Risk

PUBLIC

Failure Mode and Effect Analysis


Risk

PUBLIC

Anonymisation •k-anonymisation •l-diversity •Differential Privacy •Hashing •Encryption


Risk

PUBLIC

Syntactical Changes eg: Hashing


Culture



Culture

PUBLIC


Privacy should be a safety-critical aspect of engineering


Culture

PUBLIC


Privacy should be, must become a safety-critical aspect of engineering


Culture

PUBLIC


Culture

PUBLIC

Privacy Engineering Culture is about managinging, quantifying and qualifying risk

not eliminating it


Summary



•Quick Introduction

•Data Flow Modelling

• Language and its semantics

• Analysis

•Ontology and Terminology

• What’s wrong with ”PII” and ”Personal Data”

• Ontologies of Information, Requirements and RIsk

•Requirements Engineering

• Aspects, Development Flow and Privacy Ontologies

PUBLIC

•Risk

• Information classes

• The role of modelling and terminology

• Analysis, FMEA, RCA

• Metrics

• Differential Privacy, k-Anon, l-Div etc

• Hashing, and the identifier problem

• Encryption

•Culture

• Aviation, Surgery (!)

• Privacy as a safety-critical concern


The End



Colors and fonts Use sentence case for slide titles


Core and background colors

18 65 145

0 201 255

104 113 122

168 187 192

216 217 218

R G B

We use blue and white predominantly, and selectively call out key points in light blue. If necessary, we use our palette of grays to help highlight supporting information.

Document fonts Nokia Pure is our business font and should be used as a priority.

If you do not have this font installed, Arial is the

acceptable alternative.

the presentation title should be in lower case using Nokia Pure Headline Light. Slide titles should be in sentence case using Nokia Pure Headline Light.

Body copy text should be sentence case using Nokia Pure Text Light.


Colors and text combinations


A a A a A a A a A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

A a

X

X

X

X

X X X

!

X

!

!

!

! !

X

X

!

A a

A a

A a

A a

A a

X

!

!

X

!

Do not use.

Avoid using with small text.

!

privacy engineering tutorial (trustcom2015)

Technology