78 Table of Contents EXECUTIVE SUMMARY 1 1. INTRODUCTION 3 PURPOSE 3 SCOPE 3 AUDIENCE 4 DOCUMENT ORGANIZATION 5 BACKGROUND 6 2. RISK MANAGEMENT & ITS APPLICABILITY TO PRIVACY 12 SYSTEM OBJECTIVES IN CYBERSECURITY RISK MANAGEMENT 17 PRIVACY ENGINEERING OBJECTIVES 18 A PRIVACY RISK MODEL 22 4. NEXT STEPS 27 APPENDICES 28 APPENDIX A: GLOSSARY 29 APPENDIX B: ACRONYMS 30 APPENDIX C: FORMAL MATHEMATICAL STATEMENT OF THE PRIVACY RISK MODEL 31 APPENDIX D: PRIVACY RISK ASSESSMENT METHODOLOGY 32 APPENDIX E: CATALOG OF PROBLEMATIC DATA ACTIONS 54 APPENDIX F: CATALOG OF PROBLEMS FOR INDIVIDUALS 55 APPENDIX G: CATALOG OF CONTEXTUAL FACTORS 56 APPENDIX H: REFERENCES 57 102 103
1011 Appendix C: Formal Mathematical Statement of the Privacy Risk Model 1012 1013 In this document, privacy risk is by: 1014 1015 Privacy Risk = Likelihood of a x Impact of problematic data 1016 1017 1018 1019 1020 1021 problematic data action action If this is true for each data action in an information system, then the unmitigated privacy risk for an entire system, is given by 1022 where 1023 1024 1025 1026 1027 is the likelihood of privacy problem occurring in data action is the impact of privacy problem on the agency if it results from data action is the set of all possible data actions is the set of all possible privacy problems. 1028 Mitigated, or residual, agency privacy risk for a system, is given by 1029 1030 where 1031 1032 1033 1034 is the reduction in likelihood of privacy problem occurring in data action by employing control is the reduction in impact of privacy problem on the agency if it results from data action by employing control 1035 The residual risk calculation implies that, for any data action, a control can reduce 1036 the likelihood of a privacy problem, the impact of that privacy problem should it occur, 1037 or both. While controls are not the focus of this document, this outcome is sufficiently 1038 important to address here. When determining controls, the agency may be able to 1039 dynamically reduce privacy risk through a single control that reduces both likelihood and 1040 impact and, potentially, does so in multiple data actions. 1041
1224 1225 1226 Task 2: Catalog general contextualfactors. 1227 Data Action Personal Information Specific Context Summary Issues Collection from the Social Media Site ‐Self‐Asserted Full Name ‐Validated Email ‐List of Friends ‐Profile Photograph ‐One‐time action (per user) between social credential and ACME IDP, but establishes an ongoing relationship between user’s social presence and ACME IDP ‐Social credential linkingis vis ible touser ‐Linking of social credential simplifies access to government benefits system ‐User profile may contain information the user considers sensitive ‐User profile may contain information from other users not participating in the system ‐User profile includes information unrelated to the purpose and operations of the system ‐Access to PI is consented by user ‐Nature of the API: full profile access is granted (by default: name, validated profile photograph, and list of friends) ‐Full social credential profile access (including picture and list of friends) is not necessary for fulfilling operational purpose. ‐Will users understand the eventual high‐assurance credential is controlled by ACME and not by their social credential provider? ‐How will perception of the social media organization’s privacy practices impact willingnessto consent to this data action? ‐Will the user understand ACME will have ongoing access to information stored in their social profile? ‐Will social media privacy settings allow this data action? 1228 1229 1230