Privacy Principles for Sharing Cyber Security Data

Abstract

Sharing cyber security data across organizational boundaries brings both privacy risks in the exposure of personal information and data, and organizational risk in disclosing internal information. These risks occur as information leaks in network traffic or logs, and also in queries made across organizations. They are also complicated by the trade-offs in privacy preservation and utility present in anonymization to manage disclosure. In this paper, we define three principles that guide sharing security information across organizations: Least Disclosure, Qualitative Evaluation, and Forward Progress. We then discuss engineering approaches that apply these principles to a distributed security system. Application of these principles can reduce the risk of data exposure and help manage trust requirements for data sharing, helping to meet our goal of balancing privacy, organizational risk, and the ability to better respond to security with shared information.

Big-data business models: A critical literature review and multiperspective research framework

“…For example, a thoughtful examination of complex supply-chain systems could link the engagement of different players in the interorganizational fabric of BD ( supply-chain perspective) to ethical concerns associated with data privacy ( ethics perspective). Doing so is especially salient when data collection and analysis do not take place within the same organization and where it is not clear who is responsible for minimizing potential harms to individuals, or data owners (Fisk et al, 2015). Focusing on the relevance of embedding ethics in BDBMs, especially when data are shared across industries, appears to be an extremely relevant opportunity to extend current thinking assessing the bright and dark sides of BD with respect to society (e.g.…”

Cyber threat intelligence sharing: Survey and research directions

“…Sharing information about cyber threats requires a combination of technical and policy methods [94]. If an organization decides to share their CTI, a clausal for information has to be included or updated in existing policies [4].…”

Run-Time Monitoring of Data-Handling Violations

“…The National Institute of Standards and Technology (NIST) [5] discusses the concepts of privacy engineering and risk management for federal systems and aims to establish the basis for a common vocabulary to facilitate better understanding and communication of privacy risk within federal systems. Fisk et al [14] define three engineering privacy principles that guide sharing security information across organisations: Least Disclosure, Qualitative Evaluation, and Forward Progress.…”