Departments of Agriculture, Commerce, Defense, Energy, Census, Health and Human Services, Homeland Security, Transportation, Treasury, and Veterans Affairs. NIST would like to acknowledge the specific contributions to this volume, during Version 1 and/or Version 2 activities, by the following NBD-PWG members: Pw Carey Compliance Partners, LLC Wo Chang NIST Brent Comstock Cox Communications Michele Drgon Data Probity Roy D'Souza AlephCloud Systems, Inc. Eddie Garcia Gazzang, Inc. David Harper Johns Hopkins University/ Applied Physics Laboratory Pavithra Kenjige PK Technologies Orit Levin Microsoft Yale Li Microsoft Akhil Manchanda General Electric Marcia Mangold General Electric Serge Mankovski CA Technologies Robert Marcus ET-Strategies Lisa Martinez Northbound Transportation and Infrastructure, US William Miller MaCT USA Sanjay Mishra Verizon Ann Racuya-Robbins World Knowledge Bank Arnab Roy Fujitsu Anh-Hong Rucker Jet Propulsion Laboratory Paul Savitz ATIS John Schiel CenturyLink, Inc. Mark Underwood Krypton Brothers; Synchrony Financial Alicia Zuniga-Alvarado Consultant
While monitoring has a conventional place in the security specialist’s toolbox, the associated tools may not be sized properly for Big Data systems. For example, in the cloud setting, the following is argued: “Monitoring demonstrates several challenges including gathering metrics from a variety of layers (infrastructure, platform, application), the need for fast processing of this data to enable efficient elasticity and the proper management of this data in order to facilitate analysis of current and past data and future predictions. In this work, we classify monitoring as a big data problem and propose appropriate solutions in a layered, pluggable and extendable architecture for a monitoring component.” (Zareian, Fokaefs, Khazaei, Litoiu, & Zhang, 2016) Big Data security and privacy support for audit and logging for monitoring and management is critical, but security operations must be able to scale along with associated Big Data applications. In addition, monitoring must be appropriate for both the utility, domain, and application models involved. This requires a close collaboration between application designers and security teams that is often not achieved.
Application Model An application model is an abstract description of a system element or application, including its Big Data SnP components. Some version of an application model is a requirement for the BDSQ safety framework. App models can foster transparency and interoperability, essential for long-lived Big Data and potentially, Big Data systems. Traditional waterfall or agile artifacts, milestone checks with Big Data support Advanced application design and monitoring tuned to Big Data needs (streaming, IoT, organization bleed-through) In addition to APM, additional workflow implemented as code with explicit model. Full audit and logging to domain model. Model artifacts are produced and consumed inside the Big Data system. Selected References M. Borek, K. Stenzel, K. Katkalov, and W. Reif, "Abstracting security-critical applications for model checking in a model-driven approach," in 2015 6th IEEE International Conference on Software Engineering and Service Science (ICSESS), Sep. 2015, pp. 11-14. [Online]. Available: http://dx.doi.org/10.1109/ICSESS.2015.7338996 Authority to collect data Long-lived or PII-intensive Big Data systems must capture, maintain and maintain transparency for data collection authority. This may be point in time. XML or equivalent for authority, capture terms of service, legal authorities, versioning information within overall enterprise governance. Use digital cert associated with collection. Written policies surrounding enterprise handling for PII, but tend to be limited to a single enterprise. Same as level 1, but with controls designed for transferability to third parties, especially in supply chain settings. Authority data is tracked using Big Data technologies, detail, audit, traceability.
Semantic Web / Linked Data Awareness Some Big Data systems, arguably all, should map their elements to the semantic web using canonical structures such as ontologies. The semantic web supports artificial intelligence through inductive reasoning as well as machine learning. Big Data architects and users should consider safety aspects of these technologies A knowledge engineering framework, typically manually maintained through tagging or concept trees, is provided to allow for recognition of SnP components. May or may not be implemented using semantic web standards; could be COTS or open source but idiosyncratic Adds to Level 1: Use of RDC or OWL to represent SnP and related components. Allows for automated reasoners and other AI tools to be employed to manage knowledge about SnP issues in the Big Data system. Adds direct links to and upper ontologies so that reasoning, for instance, about which test scenarios test which sorts of aspects of the SnP design, can be automatically interrogated and scheduled. Selected References Y. Pandey and S. Bansal, "Safety check: A semantic web application for emergency management," in Proceedings of The International Workshop on Semantic Big Data, ser. SBD '17. New York, NY, USA: ACM, 2017. [Online]. Available: http://doi.acm.org/10.1145/3066911.3066917
Audit, audit data, audit log, reduction tools, audit review, audit trail Subset created for privacy. Could be a smaller problem to solve, or a larger one, depending. Authentication (various terms) Could be needed to allow “owner” of privacy data to see or correct their own data. Authority Centralized vs. decentralized authority. See blockchain as a decentralization of authority. See federation. In most applications, highly domain-specific but there are “authorities.” Authenticity Provenance Authorization Time-limited authorization to access, or use privacy data Authorization to operate Interop issues for Big Data concerning privacy data Automated privacy monitoring To Do Use of automated procedures to ensure security controls are not circumvented or the use of these tools to track actions taken by subjects suspected of misusing the information system. Back door (privacy) Use of Big Data variety to circumvent privacy safeguards Baseline security (for privacy controls) The minimum security controls required for safeguarding an IT system based on its identified needs for confidentiality, integrity, and/or availability protection. Behavioral outcome (for privacy fabric training) Useful for privacy org
Credential, credential service provider “A trusted entity that issues or registers Subscriber tokens and issues electronic credentials to Subscribers. The CSP may encompass Registration Authorities (RAs) and Verifiers that it operates. A CSP may be an independent third party, or may issue credentials for its own use. Criticality, criticality level Not all privacy data elements or tools may be equal Cryptographic binding “Associating two or more related elements of information using cryptographic techniques. “ Conformance to privacy fabric XXX Data integrity (privacy corruption) Mis-identification (e.g., TSA list) Default classification (for privacy data, or privacy tooling) Digital forensics As applied to privacy fabric: still emerging; check academic lit End-to-end privacy XXX TBD Ethics in Design IEEE P7000, IEEE P7002, IEEE P7007, ISO 27500 Traceability of ethics and value chain are seen as no less feasible than requirements tracing, but no more straightforward either. Event (privacy) CNSSI-4009 Subset of events appropriate to privacy “Any observable occurrence in a system and/or network. Events sometimes provide indication that an incident is occurring.
Major / Minor application (for privacy) OMB Circular A-130 Appendix III; SP What makes it major / minor in the NBDRA? Not resolved in V2. Masquerading privacy data (see identity) NIST SP 800-19 Biometric match event FIPS 201; Possible paradigmatic event exemplar for Big Data Media (wearable, implanted digital device) FDA, adapted from NIST SP 800-53 Memorandum of Understanding for Privacy data (MOUP) Simple MOU was NIST SP 800-47 Critical for Big Data Variety Minor application (susceptible to privacy concerns) NIST SP 800-18 Identify aspect of a larger application that applies to privacy Mission/business segment* NIST SP 800-30 Identify segment associated with business processes that collect PII or other privacy data at risk Multilevel security (for privacy data) CNSSI-4009 Applies MLS to privacy data subset Mutual suspicion CNSSI-4009 As applicable to privacy data. E.g., consider privacy data across organizational boundaries National security system (US) FIPS 200 Use to identify possible exclusions or variations from otherwise universal guidelines or practices. Nation-specific. Need to know determination CNSSI-4009 Need to know for PII. Needs assessment for privacy (policy, risk, etc.) NIST SP 800-50 “The results of a needs assessment can provide justification to convince management to allocate adequate resources to meet the identified awareness and training needs.” Privacy data resilience Adapted from Ability to sustain business operations after privacy data attack (e.g., partial leak) Non-organizational user NIST SP 800-53
Security change or event CNSSI-4009 “Any change to a system’s configuration, environment, information content, functionality, or users which has the potential to change the risk imposed upon its continued operations. “ Security (privacy) requirements CNSSI-4009 Mandated privacy requirements Security (privacy) requirements traceability matrix CNSSI-4009 Security (Privacy) Safeguards CNSSI-4009 Security (privacy) service NIST SP 800-27 “A capability that supports one, or many, of the security goals. Examples of security services are key management, access control, and authentication “ Security (privacy) tag FIPS 188 “Information unit containing a representation of certain information (e.g., a restrictive attribute bit map). “ Security (privacy) test, eval, assess etc. CNSSI-4009 Sensitivity (for privacy data) label CNSSI-4009 “Information representing elements of the security label(s) of a subject and an object. Sensitivity labels are used by the trusted computing base (TCB) as the basis for mandatory access control decisions. See Security Label. “ SLA for Privacy TBD Signed data (applied to privacy) CNSSI-4009 Privacy Spillage CNSSI-4009 “Security incident that results in the transfer of classified or CUI information onto an information system not accredited (i.e., authorized) for the appropriate security level. “ Status (for privacy components) monitoring NIST SP 800-137 Person or s/w agent “Monitoring the information security metrics defined by the organization in the information security ISCM strategy. “ security-
Key management Managed by project chief security officer (CSO). Separate key pairs issued for customers and internal users. Security best practices for data stores Regular data integrity checks via XML schema validation Security against DoS attacks Industry-standard webhost protection provided for query subsystem. Data provenance Unique Fabric Analytics for security intelligence No project-specific initiatives Event detection N/A Forensics Usage, cube-creation, and device merge audit records were retained for forensics and billing Web Traffic Analytics Visit-level webserver logs are of high granularity and voluminous. Web logs are correlated with other sources, including page content (buttons, text, and navigation events) and marketing events such as campaigns and media classification. Table E-3: Mapping Web Traffic Analytics to the Reference Architecture NBDRA Component and Interfaces Security and Privacy Topic Use Case Mapping Data Provider → Application Provider End-point input validation Device-dependent. Spoofing is often easy Real-time security monitoring Web server monitoring Data discovery and classification Some geospatial attribution Secure data aggregation Aggregation to device, visitor, button, web event, and others Application Provider → Data Consumer Privacy-preserving data analytics IP anonymizing and time stamp degrading. Content-specific opt-out Compliance with regulations Anonymization may be required for EU compliance. Opt-out honoring Government access to data and freedom of expression concerns Yes Data Provider ↔ Framework Provider Data-centric security such as identity/policy-based encryption Varies depending on archivist Policy management for access control System- and application-level access controls Computing on the encrypted data: searching/filtering/deduplicate/ FHE Unknown Audits Customer audits for accuracy and integrity are supported Framework Provider Securing data storage and transaction logs Storage archiving—this is a big issue Key management CSO and applications