Schneier on Security

BF Skinner • April 22, 2010 6:55 AM

It’s not bad. My problem has always been with the definition of PII.

I can develop controls on your system based on the information in it but this is not that helpful…

“any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.”

Is this a discrete list of elements or an aggregate? How discrete are the data elements to be protected?

This matters as systems today share Ts of data and OMB policy is to class any system with PII in it as a minimum of Moderate Impact.

Okay. My name. My name is a matter of public record (mis-spent youth, mistakes were made, let’s move on)

Its in the phone book, it’s on my birth certificate, my tax deliquencies, my deeds all avaliable at the courthouse (now on line). How do you reconcile public records with a moderate level of confidentiality?

So say I have a public webserver to present agency information to the citizenry. NIST FIPS says you can class that as Confidentiality – N/A. (the only case where there is an N/A). But say I put a comment field in with the ability for the citizen to request a follow up. Instantly my impact level is in doubt because many people will put their name in the system and their contact information. Say they only sign their name to their comment. Same thing. I now have to protect the PII. The cost between a Low and a Moderate system in terms of number of controls is significant.

Moderate, among others things, requires encryption, unique user id’s, auditing (a privacy conflict on webservers some argue). And while we’re on the subject of webservers what about those W3SVC weblogs and audit records in general. If you’ve ever done forensics it’s pretty easy for that information to be “linked or linkable to an individual”. Some laws require those records be maintained anywhere from a year to forever.

The definition includes specific types of data and many agencies will limit themselves to those specific words. we had that with the privacy act. My first service phone book included the types of information (discrete and aggregate) that could be disclosed (like the service members name) and the type that could not be (home phone, and/or address). Note that under the Privacy act Names were not protected information. But Privacy Offices are being much more discriminating in their PIAs–except for EINSTEIN. But that’s DHSs Privacy Office which is more like the DoJ OLC under the Bush II administration.

BF Skinner • April 22, 2010 9:32 AM

@Hjohn “hoping for some controls on making the information a bit harder to use. I didn’t see it”
When dealing with NIST we’re dealing with a big wibbly wobbly conglomeration of laws, mandates, policy procedures and protocols. If you ask NIST about controls they’ll point you to OMB requirements, your own organizations internal policy structure and 800-53. We have some law but for privacy it’s mostly controlling what the Government can do viz it’s citizens. There is nothing to prevent the data aggregators like Experian from collecting and maintaining records. The laws that do control them are consumer protections for accuracy. Their right to collect and sell is not questioned by most.

@wiredog “worrying that question for years ”
Yes, I know. I have been in the room.

But I see two issues. First having control over information about me; then insisting protection of my private information in the custody of the government. The first issue assumes I own the information just because it’s about me. That’s a point yet to be settled. It may not be true.

The second issue is what PII is about and when we develop a system it instantly becomes ‘What Information’ ‘What Controls’ and applications developers are squirrly. They want to know in excruitating detail what is and is not a PII typified piece of information; alone or in aggregrate. After having dealt with a couple of breaches dealing with aggregate classified material, shared file servers and enterprise email systems, I have a lot sympathy with their view. Without defining, without typifying, information we can’t mark it, without marking we can’t prevent it from sailing past anysort of ACL or filter.

@GreenSquirle “comment on a blog is different…using a false name…user submitted requests which need a response (and therefore need to provide correct contact details) then these can either not be posted to the web or have the PII stripped off first?”

Actually to your latter point. There are two cases. One staight up blog like what Bruce hosts here. Second queries requiring a reply. But yes that does describe the double bind.

AND

There are all kinds of weird specific rules. I think it may only be resolvable by use cases for each type of information (ugh). The President’s webpage (with comments) as an example is actually subject to the Presidential Records Act and must be preserved (including the Spam) in the National Archive (forever). Although prudent people can use nom de plume’s on a blog comment there will be people who don’t and it’s their privacy that suddenly must be addressed as soon as they give up their name. Informed consent is usually enough. Reasonable people understand they are volunteering their names as part of a permanent record. But this is the US and we have many unreasonable people too.

urrrrg. This is why I don’t like the blog comment format. There are too many issues that intertwine to resolve in a paragraph or two. Privacy conflates the problem because it’s not, I think, a general principal but very specific and unique to each individual. Thousands of ink trees must die before we can even skecth the outlines. To my mind the only one here who writes at length and stays interesting is Clive and thats mostly cause I sure he’s gonna blow something up or tell us how to.

BF Skinner • April 22, 2010 12:35 PM

@antibozo
PII was defined as a term by OMB. This makes it an administrative rule binding on Federal agencies.

@Craig “just an overview, and should be treated as such”

If by overview you mean a guideline that all Federal Agencies are expected to adhere to in a normalized fashion that can be consistently audited by OMB and agency Inspector General offices. Okay.

But that’s not how I define overview. Especially with an enviornment where they tend to be faithful to SPs down to the comma.

A closer reading has me now thinking “great a separate information type” whose impact level must be assessed differrently from all other information in the system.

The controls are Information Security program drawn small FOR PII.
Identify your asset
Identify it’s impact at breach
Reduce your holdings so breaches won’t hurt too much.
De-PII by removing data elements and dropping the PII radioactivity to an acceptable level.
Implement Security controls AC-3, 5, 6, 17, 21, 19; AU-2, 6,; IA-2; MP-2, 3, 4, 5,6; SC-9, 28; SI-4
Prepare for PII disclosure incidents with response and training plans

It does acknowledge that not all PII is the same. A SSN doesn’t carry the same weight as a Zip Code. It doesn’t go much farther in helping to determine the degree of difference.

It does give some criteria to apply to making PII impact decisions.

It ALSO puts the whole load of decision making on the organization using to decide what is/is not PII using Hotter/colder ways of “evaluating” impact.

This is a long argument with the IG second guessing that’ll never end.

And I don’t see anything about how it relates to the impact level of the system as a whole. I can forsee some agencies implementing pairs of Impact level per system.

BF Skinner • April 22, 2010 6:14 PM

@Hjohn “more votes to be gained by advocating even more measures against business”

Yes except it doesn’t happen.

Scanning back through this thread it appears to be peoples belief that business’s are expected to meet some sort of legal obligation. Beyond torts ‘taint so.

Is there a misconception here that the NIST standards and guidelines are binding on buisness or private citizens? Beyond leakage due to contracts cited in my post to antibozo it don’t.

They can collect, process, disseminate, sell information to anyone pretty much. Including Sherrifs and Feebies. Why else do aggregator sites exist? You can’t be a peeping Tom and you can’t intercept some types of communication legally.

But beyond that what you rent at a video store is information belonging to them. Make a sex tape and lose it in the break up with your SO and you’re SOL.

The Privacy Act? Applies only to the government–federal at that. Did you think it protects you against Experian? Go re-read it.

Why do you think Europe has such heart burn about putting their citizens into the no-fly list? Because the US has flimsy privacy rules.