Software data privacy threat analysis metric using no trust privacy risk metric
1 like1,272 views
This document introduces the Linddun Privacy Risk Indicator (LPRI), a new metric for assessing data privacy security during software testing, which integrates privacy-specific threat analysis into the software development process. It emphasizes the necessity of quantifying both data privacy and security to support the creation of privacy requirements from business documents, thereby allowing software testers to enhance security policies related to privacy in various applications, including Zero Trust Networks and access control systems. The method outlined aims to improve the traceability and effectiveness of privacy testing in software systems by utilizing established frameworks such as Linddun and Microsoft's Security Development Lifecycle.
![Software Data Privacy Threat Analysis Metric using the LINDUNN Extension: LPRI
Author: Valdez Ladd
Abstract: Today data privacy at the software testing level is too often treated as a non
functional requirement. Software security is tested, but seldom with data privacyspecific
testing. This paper's goal has been to present a new method for developing a data privacy
security metric during software testing that incorporate privacyspecific threat analysis.
This new metric is based on a quantified version of the LINDDUN Privacy framework based
on Deng, Wyuts, All doctoral research. [Deng 2010] The functional specifications of a
software application can now include data privacy requirements from the Business
requirements document (BRD). The software testing team when creating their test suites
can setup test cases for privacyspecific requirements and assign a metric. This allows the
software quality analyst to add use the Security Requirements Traceability Matrix (STRM)
to include and track the progress of data privacy within the test cases for the software
application. It is hoped that this method will enhance software security to enables better
privacyspecific security policy controls. Both security and privacy should be tested. This
new software privacyspecific metric based on LINDDUN is called the LINDDUN Privacy
Risk Indicator (LPRI).
One use case would be adding the LPRI as a new property for privacyspecific security
policy controls in Attribute Based Access Control (ABAC) such as Zero Trust Networks
implementations using microsegmentation of virtual machine deployments. OAuth and
OpenID which use bearer tokens with no inherent security besides optional MAC integrity
depend on trust would benefit if privacyspecific mechanisms could be invoked.
Do note that the LINDDUN privacy threat analysis framework is a nontrivial tool itself and
requires new training for the software quality analyst. This is outside the scope of this
research paper.
LINDDUN (Linkability, Identifiability, Nonrepudiation, Detectability, information
Disclosure, content Unawareness, and policyandconsent Noncompliance) [Deng 2014]](https://image.slidesharecdn.com/softwaredataprivacythreatanalysismetricusingnotrustprivacyriskmetric-150805052037-lva1-app6892/85/Software-data-privacy-threat-analysis-metric-using-no-trust-privacy-risk-metric-1-320.jpg)
![Evolution of a new privacyspecific threat metric: LPRI
Corporations today are forging greater number of links to external organizations and third
party providers. This is seen with the increasing numbers of business connections outside
the enterprise by customers, employees, and business partners. Increased business
relationships of various forms including relationships in a "coopetition"a situation where a
competitor in one field is also a business partner in another.[Dubrawsky 2007] This has led
many corporations to complex and sometimes overlapping span of control of corporate data
that have eroded traditional borders.
This is illustrated in image 1
Image 1 Overlapping Trust Boundaries [whatiscloud.com, 2015]
Privacy and Trust Boundaries
Before the Internet and Cloud permeated the corporation perimeter privacy was built upon
trust within the secure confines within the technology, people and processes of the
business unit. This is reflected in Conway’s law, (Melvin Conway) who observed that
“organizations which design systems … are constrained to produce designs which are
copies of the communication structures of these organizations.” [Sussna 2015] This
made the idea of a Privacy Impact Analysis of software easier as it pointed to the concept of
confidentiality being constrained by the trust boundaries of the corporation’s application
security.
The infamous” Deperimeterization” has arrived in full today under the umbrella of Cloud
Computing and its many supporting technologies that are rapidly converging. Both cyber
security and cyberprivacy are seeing the same effects of deperimeterization that the
Jericho Forum described to “describe the erosion of the traditional ‘secure’ perimeters,
or ‘network boundaries’, as mediators of trust and security.” ( Privacy and Security can
not be equal when they are extended beyond the borders (trust boundaries) of the
corporation. [Dubrawsky 2007]](https://image.slidesharecdn.com/softwaredataprivacythreatanalysismetricusingnotrustprivacyriskmetric-150805052037-lva1-app6892/85/Software-data-privacy-threat-analysis-metric-using-no-trust-privacy-risk-metric-2-320.jpg)
![Therefore external business partners need more application aware information (metadata)
to determine trust. In contrast to the previous image showing overlapping trust boundaries
the traditional boundary appears archaic as the number of external linkages are too limited
for context awareness of application authentication.
Privacy
A short definition First natural privacy is defined by law has traditionally been described as
the right and ability of a person to define and live his or her life in a selfdetermined
manner. Notice the village or city where the person lived by their cultural norms and laws
defined the boundaries of the rights of privacy.[Dennedy 2014]
Data Privacy
Today in a hightechnology society any computer data that is captured and recorded about
the person by observation, or self created when creating an Email or Bank account. This
computerized collection of personally identifiable information or data and the application
privacy management is called substantive privacy legally, bit for this paper is named data
privacy. [Dennedy 2014]
Extending Privacy Threat Analysis frameworks
There are many security metrics and analysis for applications. While a few cover data
privacy there are none with any metrics to assist in assessing the software that are
produced during a (STRM) analysis of an application’s software
requirements.
Now we will use the LINDDUN Privacy framework and the Microsoft Security Development
Lifecycle's security and threat properties to create our new privacy metric. You will see
these charts used later in this article for calculating the metric scales for these two
frameworks used by Dr Deng and associates in their research.[Deng 2014]
Adam Shostack in his book, “Threat Modeling: Designing for Security”, has chapter six
covering several privacy tools such as Solove's Taxonomy of Privacy, Nymity Slider, and
LINDDUN.[Shostack 2014] The most promising of his “privacy tools” listed was LINDDUN.
It appeared to be the framework with a more comprehensive risk analysis of data privacy
threats as it offers a more applicationspecific data privacy threat framework analysis.
LINDDUN is modeled after Microsoft Corporation’s incident threat analysis tool the
Microsoft Security Development Lifecycle's security and threat properties as per Dr. Mina
Deng. “LINDDUN is a systematic methodology to model privacyspecific threats that is
analogous to Microsoft Security Development Lifecycle”. [Deng 2010]
LINDDUN is an acronym which stands for Linkability, Identifiability, Non Repudiation,
Detectability, Information Disclosure, NonContent Unawareness, NonConsent/policy
Noncompliance. [Deng 2014] It uses an analysis based on a data flow diagram (DFD) . It is
important to note that the DFD itself is considered to be a “labeled property graph”.
[Robinson 2015]](https://image.slidesharecdn.com/softwaredataprivacythreatanalysismetricusingnotrustprivacyriskmetric-150805052037-lva1-app6892/85/Software-data-privacy-threat-analysis-metric-using-no-trust-privacy-risk-metric-3-320.jpg)
![The image below illustrates the data flow diagram (DFD) concept that is the foundation for
LINDDUN privacy threat analysis which originated with the Microsoft Software
Development Lifecycle (SDL).
Image 2 Data Flow Diagram [Deng, 2010]
Deng, Wuyts, et. All; defines the data flow diagram (DFD) in image 3, with the following
elements: entities, data stores, data flows, and processes for threat modeling. Notice that
the trust boundaries are used to indicate the border between the trustworthy and
untrustworthy elements” [Deng, 2014]
LINDUNN is based on the Microsoft Security Development Lifecycle (SDL) Security
Property | Security Threat properties shown below from Dr. Deng research paper. Deng,
2010]](https://image.slidesharecdn.com/softwaredataprivacythreatanalysismetricusingnotrustprivacyriskmetric-150805052037-lva1-app6892/85/Software-data-privacy-threat-analysis-metric-using-no-trust-privacy-risk-metric-4-320.jpg)
![Image 4, [Deng, 2010, pg. 3]
We will use the Microsoft Security Development Lifecycle (SDL) elements listed above as
the starting point as the LINDDUN methodology does. Next we use the assumption that
data privacy is constrained by Confidentiality. The question for this research was how to
achieve a correlation between confidentiality threats and privacyspecific threats for
software security requirements testing purposes?
The answer came with the following requirements:
First both security and privacy need to be quantified for analysis.
Second a composite metric had to be produced that exhibited the properties of the
confidentiality – privacy relationship
Third the data flow diagram (DFD) should allow modeling of the confidentiality – privacy
relationship numerically also.
The key idea here is that to extract the value of confidentiality from the Microsoft Security
Development Lifecycle (SDL) Security Property | Security Threat elements in correlation
with the LINDDUN Privacy Threat elements. [Deng 2014] This correlation is the data
privacy securityconstraint relationship that is not revealed in software functional
testing today.
To accomplish this you must quantify confidentiality. This allows us to solve for
Confidentiality divided by Integrityandavailability (C/IA) instead of CIA which yields only
a security metric. The working model is based a numeric scale for all seven LINDDUN
privacyspecific elements that are tied to Microsoft's SDL Security Property | Security
Threat elements.
We make the following assumptions for the Confidentiality, Integrity, and availability
to quantify their security properties.
Integrity is true (1) or false (0 /null)
Availability is true (1) or false (0 /null)
Confidentiality
privacy (encryption) is true (1) or false (0 /null)
access control is true (1) or false (0 /null)
These numeric scales allows us to solve for confidentiality within the software quality
analysis and testing. The functional specifications of software application testing can now
include privacy requirements from the Business requirements document (BRD).
LINDDUN Privacy Risk Indicator (LPRI) – A Composite Analysis Metric:
The highest value of the Microsoft Security Development Lifecycle's Confidentiality property
is also the highest possible value any of the the individual LINDDUN properties that is used
to calculate the LPRI metric. This is the security constraint that links the Confidentiality
property in Microsoft Security Development Lifecycle to the LINDDUN privacy properties. It
is a metric that creates a composite image of the application’s data security and privacy
threat violations. It allows the analysis of the Data Flow Diagram (DFD) used for numeric
analysis of data privacy. (Deng, 2010, p.2) Our article declares the DFD as a labeled](https://image.slidesharecdn.com/softwaredataprivacythreatanalysismetricusingnotrustprivacyriskmetric-150805052037-lva1-app6892/85/Software-data-privacy-threat-analysis-metric-using-no-trust-privacy-risk-metric-5-320.jpg)
![Security and Privacy Metrics Calculation Methods
1) Create a scale with the Microsoft Security Development Lifecycle properties.
Microsoft Security Development Lifecycle
All security – threat pairs have a range 01, except Confidentiality 02
Sum up all six properties
sum of all seven properties over range 07
Convert product to a decimal value.
2) Create a scale using the LINDDUN properties
LINDDUN properties range 02
sum of all seven properties over range, i.e., 5/7 Convert product to a decimal value.
Multiple the Microsoft Security Development Lifecycle metrics decimal value times the
LINDDUN metrics decimal value
This creates the LINDDUN Privacy Indicator (LPRI).
It is a composite metric that solves for confidentiality as a privacy threat indicator.
Microsoft Security Development Lifecycle
Scale Security Property | Security Threat
LINDDUN Scale
Privacy Threat Metrics
Authentication | Spoofing 01
Integrity | Tampering 01
Nonrepudiation | Repudiation 01
Confidentiality | Information 02
Disclosure
Availability | Denial of Service 01
Authorization | Elevation of Privilege 01
Microsoft Security Development Lifecycle
Index
range 07, Ratio X / 7
Examples:
perfect security 7/7 = 1.0,
Non perfect security 5/7 = 0.7142
Linkability (0 2)
Identifiability (0 2)
NonRepudiation (0 2)
Detectability (0 2)
Information Disclosure (0 2)
Content Unawareness (02)
NonConsent/ (0 2)
policy Noncompliance
LINDDUN Index
range 014, Ratio X / 14
Example:
perfect privacy 14/14 = 1.0,
Non perfect privacy 9/14 = 0.6428
Table 1 MS SDL & LINDDUN Scales
Concise example:
Confidentiality (SDL Index x LINDDUN Index) = LPRI (LINDDUN Privacy Risk Indicator)
C(0.7142 x 0.6428) = LPRI 0.4590
LPRI = 0.4590 [ Privacy Metric ]](https://image.slidesharecdn.com/softwaredataprivacythreatanalysismetricusingnotrustprivacyriskmetric-150805052037-lva1-app6892/85/Software-data-privacy-threat-analysis-metric-using-no-trust-privacy-risk-metric-7-320.jpg)
![Appendix
Proof
DFD’s labeled property graph assumptions for the Composite Metric of LINDDUN
Privacy (LPRI) Metric based on the Microsoft Security Development Lifecycle and
LINDDUN framework scales.
Microsoft Security Development
Lifecycle scale Security Property |
Security Threat
LINDDUN Scale
Privacy Threat Metrics
Authentication | Spoofing 01
Integrity | Tampering 01
Nonrepudiation | Repudiation 01
Confidentiality | Information 02
Disclosure
Availability | Denial of Service 01
Authorization | 01
Elevation of Privilege
Microsoft Security Development
Lifecycle Index
range 07, Ratio X / 7
Examples:
perfect security 7/7 = 1.0,
Non perfect security 5/7 = 0.7142
Linkability (0 2)
Identifiability (0 2)
Non Repudiation (0 2)
Repudiation (0 2)
Detectability (0 2)
Information Disclosure (0 2)
NonContent Unawareness / (0 2)
NonConsent/policy Noncompliance
LINDDUN Index
range 014, Ratio X / 14
Example:
perfect privacy 14/14 = 1.0,
Non perfect privacy 9/14 = 0.6428
Table 1 MS SDL & LINDDUN Scales
The highest value of the Microsoft Security Development Lifecycle Confidentiality property
is also the highest possible value any of the the individual LINDDUN properties that is used
to calculate the LPRI metric.
This represents the security constraint that links the Confidentiality property in
Microsoft Security Development Lifecycle to the LINDDUN privacy properties.
That relationship is expressed in the concept of C/IA ( Confidentiality divided by Integrity
times Availability) to solve for privacy.
Confidentiality (SDCL Index x LINDDUN Index) = LPRI
C(0.7142 x 0.6428) = LPRI 0.4590 [ Privacy Metric ]
LPRI = 0.4590 [ Privacy Metric ]
Composite Analysis Metric: LINDDUN Privacy Risk Indicator (LPRI).](https://image.slidesharecdn.com/softwaredataprivacythreatanalysismetricusingnotrustprivacyriskmetric-150805052037-lva1-app6892/85/Software-data-privacy-threat-analysis-metric-using-no-trust-privacy-risk-metric-9-320.jpg)
![It should be noted that this paper treats the DFD (Data Flow Diagram) as a labeled
property graph with the following characteristics:
• It contains nodes and relationships.
• Nodes contain properties (keyvalue pairs).
keyvalue pair: KeyPrivacyIndicator LPRI
keyvalue pair: security threat
keyvalue pair: privacy threat
• Nodes can be labeled with one or more labels
label: LPRI
label: start node
label: end node
• Relationships are named and directed, and always have a start and end node.
keyvalue pair: LPRI Duration
keyvalue pair: SQUISHI Duration (emergent property over time)
*SQUISHI (symmetrically constrained, quantified unit of intrusion, security threat,
holistic index)
Security Metrics Measurement Scales
They are based on the hypothesis of C divided by IA instead of CIA
(Confidentiality, Integrity, Availability)
This allows the Security property to weight Confidentiality higher which permits us to solve
for it as a privacy metric.
Confidentiality (SDCL Index x LINDDUN Index) = LPRI (LINDDUN Privacy Risk Indicator)
C(0.7142 x 0.6428) = LPRI 0.4590 [ Privacy Metric ]
LPRI = 0.4590 [ Privacy Metric ]
LINDDUN Privacy Risk Indicator (LPRI) Metric:
Privacy Chaining
Data Flow Diagram chaining of new Nodes privacy metrics within an extended labeled
graph.
N1 – N2 (base) Nx
______________ x ________= Z
LPRI r(oot) LPRIΔ
r(0.7142) x N3(0.5714) = Z (0.4080)
Legend:
N1 N2 = base nodes of Data Flow Diagram
Nx = graph new node numbers, i.e., 3, 4, 5, 6…
r = root , the labeled graph root (base) value for LPRI metric](https://image.slidesharecdn.com/softwaredataprivacythreatanalysismetricusingnotrustprivacyriskmetric-150805052037-lva1-app6892/85/Software-data-privacy-threat-analysis-metric-using-no-trust-privacy-risk-metric-10-320.jpg)
Software data privacy threat analysis metric using no trust privacy risk metric
- 3. Therefore external business partners need more application aware information (metadata) to determine trust. In contrast to the previous image showing overlapping trust boundaries the traditional boundary appears archaic as the number of external linkages are too limited for context awareness of application authentication. Privacy A short definition First natural privacy is defined by law has traditionally been described as the right and ability of a person to define and live his or her life in a selfdetermined manner. Notice the village or city where the person lived by their cultural norms and laws defined the boundaries of the rights of privacy.[Dennedy 2014] Data Privacy Today in a hightechnology society any computer data that is captured and recorded about the person by observation, or self created when creating an Email or Bank account. This computerized collection of personally identifiable information or data and the application privacy management is called substantive privacy legally, bit for this paper is named data privacy. [Dennedy 2014] Extending Privacy Threat Analysis frameworks There are many security metrics and analysis for applications. While a few cover data privacy there are none with any metrics to assist in assessing the software that are produced during a (STRM) analysis of an application’s software requirements. Now we will use the LINDDUN Privacy framework and the Microsoft Security Development Lifecycle's security and threat properties to create our new privacy metric. You will see these charts used later in this article for calculating the metric scales for these two frameworks used by Dr Deng and associates in their research.[Deng 2014] Adam Shostack in his book, “Threat Modeling: Designing for Security”, has chapter six covering several privacy tools such as Solove's Taxonomy of Privacy, Nymity Slider, and LINDDUN.[Shostack 2014] The most promising of his “privacy tools” listed was LINDDUN. It appeared to be the framework with a more comprehensive risk analysis of data privacy threats as it offers a more applicationspecific data privacy threat framework analysis. LINDDUN is modeled after Microsoft Corporation’s incident threat analysis tool the Microsoft Security Development Lifecycle's security and threat properties as per Dr. Mina Deng. “LINDDUN is a systematic methodology to model privacyspecific threats that is analogous to Microsoft Security Development Lifecycle”. [Deng 2010] LINDDUN is an acronym which stands for Linkability, Identifiability, Non Repudiation, Detectability, Information Disclosure, NonContent Unawareness, NonConsent/policy Noncompliance. [Deng 2014] It uses an analysis based on a data flow diagram (DFD) . It is important to note that the DFD itself is considered to be a “labeled property graph”. [Robinson 2015]
- 7. Security and Privacy Metrics Calculation Methods 1) Create a scale with the Microsoft Security Development Lifecycle properties. Microsoft Security Development Lifecycle All security – threat pairs have a range 01, except Confidentiality 02 Sum up all six properties sum of all seven properties over range 07 Convert product to a decimal value. 2) Create a scale using the LINDDUN properties LINDDUN properties range 02 sum of all seven properties over range, i.e., 5/7 Convert product to a decimal value. Multiple the Microsoft Security Development Lifecycle metrics decimal value times the LINDDUN metrics decimal value This creates the LINDDUN Privacy Indicator (LPRI). It is a composite metric that solves for confidentiality as a privacy threat indicator. Microsoft Security Development Lifecycle Scale Security Property | Security Threat LINDDUN Scale Privacy Threat Metrics Authentication | Spoofing 01 Integrity | Tampering 01 Nonrepudiation | Repudiation 01 Confidentiality | Information 02 Disclosure Availability | Denial of Service 01 Authorization | Elevation of Privilege 01 Microsoft Security Development Lifecycle Index range 07, Ratio X / 7 Examples: perfect security 7/7 = 1.0, Non perfect security 5/7 = 0.7142 Linkability (0 2) Identifiability (0 2) NonRepudiation (0 2) Detectability (0 2) Information Disclosure (0 2) Content Unawareness (02) NonConsent/ (0 2) policy Noncompliance LINDDUN Index range 014, Ratio X / 14 Example: perfect privacy 14/14 = 1.0, Non perfect privacy 9/14 = 0.6428 Table 1 MS SDL & LINDDUN Scales Concise example: Confidentiality (SDL Index x LINDDUN Index) = LPRI (LINDDUN Privacy Risk Indicator) C(0.7142 x 0.6428) = LPRI 0.4590 LPRI = 0.4590 [ Privacy Metric ]
- 9. Appendix Proof DFD’s labeled property graph assumptions for the Composite Metric of LINDDUN Privacy (LPRI) Metric based on the Microsoft Security Development Lifecycle and LINDDUN framework scales. Microsoft Security Development Lifecycle scale Security Property | Security Threat LINDDUN Scale Privacy Threat Metrics Authentication | Spoofing 01 Integrity | Tampering 01 Nonrepudiation | Repudiation 01 Confidentiality | Information 02 Disclosure Availability | Denial of Service 01 Authorization | 01 Elevation of Privilege Microsoft Security Development Lifecycle Index range 07, Ratio X / 7 Examples: perfect security 7/7 = 1.0, Non perfect security 5/7 = 0.7142 Linkability (0 2) Identifiability (0 2) Non Repudiation (0 2) Repudiation (0 2) Detectability (0 2) Information Disclosure (0 2) NonContent Unawareness / (0 2) NonConsent/policy Noncompliance LINDDUN Index range 014, Ratio X / 14 Example: perfect privacy 14/14 = 1.0, Non perfect privacy 9/14 = 0.6428 Table 1 MS SDL & LINDDUN Scales The highest value of the Microsoft Security Development Lifecycle Confidentiality property is also the highest possible value any of the the individual LINDDUN properties that is used to calculate the LPRI metric. This represents the security constraint that links the Confidentiality property in Microsoft Security Development Lifecycle to the LINDDUN privacy properties. That relationship is expressed in the concept of C/IA ( Confidentiality divided by Integrity times Availability) to solve for privacy. Confidentiality (SDCL Index x LINDDUN Index) = LPRI C(0.7142 x 0.6428) = LPRI 0.4590 [ Privacy Metric ] LPRI = 0.4590 [ Privacy Metric ] Composite Analysis Metric: LINDDUN Privacy Risk Indicator (LPRI).