LINDDUN GO: A Lightweight Approach to Privacy Threat Modeling

Abstract

Realizing privacy-preserving software requires the application of principles such as Privacy by Design (PbD) which require the consideration of privacy early on in the software development lifecycle. While privacy threat modeling approaches, such as LINDDUN, provide such a systematic and extensive assessment of a system's design, their application requires the analyst performing the assessment to have (i) extensive privacy expertise and (ii) sufficient experience with the threat modeling process itself. Hence, there is a high startup cost to apply these techniques. To reduce this initial threshold, more lightweight privacy analysis approaches are necessary.In this paper, we (i) discuss the requirements for early lightweight privacy analysis approaches; (ii) present LIND-DUN GO, a toolkit that supports lightweight privacy threat modeling; (iii) describe the pilot studies that were conducted for the preliminary evaluation with industry professionals.The availability of lightweight privacy analysis approaches reduces the initial effort to start privacy threat modeling and can therefore enable a more wide-spread adoption of system privacy assessments in practice.

Utilizing Shannon's Entropy to Create Privacy Aware Architectures

“…This can help us prioritize and decide what privacy-aware architectural strategies can be used and how it can be implemented. Our threat model appears to be simpler than the LINDDUN model [29] but we understand that identifiability is the ultimate risk as the consequence of linkability, detectability, unawareness is also identifiability and inference. We believe that our proposed formulation is applicable to avoid privacy risks for disclosure of information and in data sharing.…”

“…The more commonly used terminology is unlinkability described from an adversary's perspective, specifying the before and after states of an adversary observing the system which can be quantified as perfect preservation of unlinkability [20]. As pointed out earlier, the ultimate privacy harm associated with linkability is that it can lead to identifiability if too much linkable information is combined or can lead to a potential inference if a link to a sensitive attribute is revealed [29].…”

When the future meets the past: Can safety and cyber security coexist in modern critical infrastructures?

“…Risk management in the context of security often draws from a practice called threat modelling to anticipate likely attackers, incident pathways, possible consequences of attacks and best ways to respond to them. The techniques under the umbrella of threat modelling vary; from qualitative expert workshops (Wuyts et al, 2020), through mathematical models based on probabilities (Markov chains, game theory) to graphical representations (in the forms of tables, data flow diagrams and attack trees), with some threat modelling techniques promising full automation and quantification of risks (Tatam et al, 2021).…”

“…However, as cyber security 'spills out' beyond simply protecting computers, there is a call for broadening the scope of threat modelling. Critical social scientists argued for anticipating risks of emerging technologies by including non-experts (Slupska et al, 2021), understanding security in tandem with privacy and surveillance (Kazansky, 2021;Wuyts et al, 2020), and approaching non-human actors (code, hardware, algorithms) as active co-creators of geopolitics (Dwyer, 2021;Fouad, 2021). The strength of such a 'critical threat modelling' approach would then lie in the capacity to imagine and anticipate a wide range of outcomes and curate a space for explicitly normative discussions about living with digital technologies.…”

A Semantic Specification for Data Protection Impact Assessments (DPIA)

“…We also identified three existing privacy risk methodologies and taxonomies that we plan to integrate into our work: Jakobi et al's list of user-perceived privacy risks [18], Solove's Privacy Harms [19], and LINDDUN [20]. Of these, LINDDUN is notable in that it provides a privacy engineering framework that provides knowledge bases and taxonomies for threats and mitigations associated with software systems.…”