1. NIST Privacy Engineering Program & Privacy Framework March 2019

2. Session Overview Privacy Engineering @ NIST Background
NIST’s approach to privacy engineering and risk mgmt
NIST Privacy Framework
Background and status of the framework
Review of the NIST Privacy Framework outline and Request for Information (RFI) analysis
Resources for engagement

3. NIST Privacy Engineering Program

4. Why bother? Everyone’s data is already out there.
MYTH: Privacy Is Dead
Why bother? Everyone’s data is already out there. 4

5. Trustworthy Systems: Foundational to a Digital Society
What makes systems trustworthy?
Multiple attributes of trustworthiness include security, safety, reliability, etc.
Privacy must be considered one of the attributes
How can we know if systems are trustworthy?
Repeatable and measurable approaches help provide a sufficient base of evidence
Privacy needs a body of guidance for repeatable and measurable approaches similar to other attributes of trustworthiness

6. CONFIDENTIALITY
PRIVACY

7. Privacy Risk Management
Information Security and Privacy Relationship
There is a clear recognition that security of data plays an important role in the protection of privacy
Individual privacy cannot be achieved solely by securing data
Authorized processing: system operations that handle data (collection – disposal) to enable the system to achieve mission/business objectives

8. Privacy Today: More Than a Compliance Exercise

9. Privacy Windex
MYTH: Privacy is just legal compliance. All we need to do is spray legal compliance all over the system, and then we’re all good on privacy.

10. Legal compliance is a piece of the whole privacy pie.
mission needs
policy
law
privacy
risk assessment
Privacy Requirements

11. NISTIR 8062 An Introduction to Privacy Engineering and
Risk Management in Federal Systems

12. Risk factors are inputs to determining levels of risk.
Risk Model
Risk models define the risk factors to be assessed and the relationships among those factors.
Risk factors are inputs to determining levels of risk.

13. Likelihood | Vulnerability | Threat | Impact
Security Risk Model
Likelihood | Vulnerability | Threat | Impact

14. Processing Data Can Create Problems for Individuals
Dignity Loss
Discrimination
Loss of Self Determination
Loss of Autonomy
Loss of Liberty
Physical Harm
Economic Loss
Loss of Trust

15. NIST Working Model for System Privacy Risk
Privacy Risk Factors:
Likelihood | Problematic Data Action | Impact
Likelihood is a contextual analysis that a data action is likely to create a problem for a representative set of individuals
Impact is an analysis of the costs should the problem occur
Note: Contextual analysis is based on the data action performed by the system, the data being processed, and a set of contextual considerations

16. Primary Benefits of a Privacy Risk Assessment Methodology
Informed Risk Decisions
Communication
Collaboration
Privacy Engineered Solutions

17. NIST Privacy Risk Assessment Methodology (PRAM)
Frame Business Objectives
Frame Org Privacy Governance
Assess System Design
Assess Privacy Risk
Select Privacy Controls
Monitor Change

18. Privacy Engineering Collaboration Space
Online venue online venue open to the public where practitioners can discover, share, discuss, and improve upon open source tools, solutions, and processes that support privacy engineering and risk management
Initial focus on de-identification (including and differential privacy techniques) and privacy risk assessment
Open collaboration via GitHub, sharing tools, use cases, and feedback

19. Privacy Engineering Objectives
Predictability
Enabling reliable assumptions by individuals, owners, and operators about PII and its processing by a system.
Manageability
Providing the capability for granular administration of PII including alteration, deletion, and selective disclosure
Disassociability
Enabling the processing of PII or events without association to individuals or devices beyond the operational requirements of the system.
How can the system enable reliable assumptions about data processing?
How can data be dissociated from individuals or devices while still permitting functionality in the system?
How much manageability of data does this system need?
Privacy Principles
Mission/Business Needs | System Functionality & Design
Data mapping
Requirements Definition
Organizational Privacy Requirements
Legal environment
Organizational policies
Risk Assessment Methodology*
Privacy risk model
Analysis approach
Assessment approach
System privacy requirements
*Per NIST Special Publication
Controls
Selection → Implementation → Assessment
Privacy Posture Monitoring

20. What This Means for Standards

21. Categories of IT Standards
Testing
Methodology
Standards
Technical
Standards
Management System
Standards

22. Draft NISTIR 8228: Considerations for Managing IoT Cybersecurity and Privacy Risks
Why and how IoT devices impact the management of cybersecurity and privacy risks
Risk Considerations
Which types of cybersecurity and privacy risks matter for IoT devices and may be most affected by the risk considerations
Mitigation Goals and Areas
How organizations expect conventional IT devices to help mitigate cybersecurity and privacy risks for the risk mitigation goals and areas
Expectations
What challenges IoT devices may pose to the expectations and what the implications of those challenges are.
Challenges

23. Mitigation Goals and Areas
Goal 1: Protect Device Security
Goal 2: Protect Data Security
Goal 3: Protect Individuals’ Privacy
Asset Management: Maintain a current, accurate inventory of all IoT devices and their relevant characteristics throughout the devices’ lifecycles in order to use that information for cybersecurity and privacy risk management purposes.
Vulnerability Management: Identify and eliminate known vulnerabilities in IoT device software and firmware in order to reduce the likelihood and ease of exploitation and compromise.
Access Management: Prevent unauthorized and improper physical and logical access to, usage of, and administration of IoT devices by people, processes, and other computing devices.
Device Security Incident Detection: Monitor and analyze IoT device activity for signs of incidents involving device security.
Data Protection: Prevent access to and tampering with data at rest or in transit that might expose sensitive information or allow manipulation or disruption of IoT device operations.
Data Security Incident Detection: Monitor and analyze IoT device activity for signs of incidents involving data security.
Information Flow Management: Maintain a current, accurate mapping of the information lifecycle of PII, including the type of data action, the elements of PII being processed by the data action, the party doing the processing, and any additional relevant contextual factors about the processing to use for privacy risk management purposes.
PII Processing Permissions Management: Maintain permissions for PII processing to prevent unpermitted PII processing.
Informed Decision Making: Enable individuals to understand the effects of PII processing and interactions with the device, participate in decision-making about the PII processing or interactions, and resolve problems.
Disassociated Data Management: Identify authorized PII processing and determine how PII may be minimized or disassociated from individuals and IoT devices.
Privacy Breach Detection: Monitor and analyze IoT device activity for signs of breaches involving individuals’ privacy.

24. NIST Privacy Framework: Background and Status

25. Why NIST?
Long track record of successfully, collaboratively working with public and private sectors
Experience developing the Cybersecurity Framework
Extensive privacy expertise

26. Why a privacy framework?
Designing, operating, or using technologies in ways that are mindful of diverse privacy needs in an increasingly connected and complex environment
Multiplying visions for how to address privacy challenges inside and outside the U.S.
Good cybersecurity doesn’t solve it all

27. What will the framework look like?
Collaborative Effort

28. Request for Information RFI Analysis & Framework Outline
Process to Date
Workshop #1
Austin, TX
Oct 16, 2018
Request for Information
Nov 14, 2018 – Jan 14, 2019
RFI Webinar
Nov 29, 2018
RFI Analysis & Framework Outline
Feb 27, 2019
Outline Webinar
March 14, 2019
ONGOING ENGAGEMENT
Feedback encouraged and promoted throughout the process

29. Compatible and Interoperable

30. Benefits of Framework Attributes

31. Upcoming Opportunities to Engage
Drafting the NIST Privacy Framework: Workshop #2
Monday, May 13 - Tuesday, May 14, 2019
Hosted by Georgia Tech Scheller College of Business
Atlanta, Georgia

32. NIST Privacy Framework: Review of Outline and RFI Analysis

33. Privacy Risk Management
Privacy Risk Factors:
Likelihood | Problematic Data Action | Impact

34. Alignment with the Cybersecurity Framework: Core
CATEGORIES
SUBCATEGORIES
INFORMATIVE REFERENCES
FUNCTIONS
Identify
Protect
Control
Inform
Respond

35. Alignment with the Cybersecurity Framework: Profiles

36. Alignment with the Cybersecurity Framework: Tiers
1. PARTIAL
2. RISK-INFORMED
3. REPEATABLE
4. ADAPTIVE
Elements per tier:
Risk Management Process
Informal, ad hoc privacy risk management processes  processes that enable continuous adaptation to changing technologies and data processing activities and incorporate the use of advanced privacy-enhancing technologies
Integrated Risk Management Program
A limited awareness of privacy risk at the organizational level  all levels of the organization being able to make decisions with a clear understanding of the relationship between privacy risk organizational objectives
Ecosystem Relationships
Entity does not understand its role in the larger ecosystem with respect to other entities  the entity understands its role in the larger ecosystem and contributes to the community’s broader understanding and management of privacy risks
Workforce
A workforce that has little or no understanding of privacy risks  a workforce that includes specialized privacy skillsets throughout the organizational structure

37. Roadmap

38. Resources Website Contact Us
Contact Us
@NISTcyber #PrivacyEngineering #PrivacyFramework