NCJ Number
18358
Date Published
1974
Length
121 pages
Annotation
REPORT WHICH FOCUSES ON THE TECHNICAL ASPECTS OF IMPLEMENTING INFORMATION PRIVACY SAFEGUARDS AND DATA SECURITY MECHANISMS IN RESOURCE-SHARING COMPUTER-SYSTEMS.
Abstract
PRESENTED IS A STRUCTURAL CLASSIFICATION OF DATABANK SYSTEMS THAT FOCUSES ATTENTION ON PROTECTION PROBLEMS; IDENTIFIES AND EXAMINES THE RELEVANT CHARACTERISTICS OF PERSONAL INFORMATION, THE 'COMMODITY' BEING PROTECTED; PROPOSES A SENSITIVITY SCALE AND CLASSIFICATION SYSTEM FOR PERSONAL INFORMATION; AND EXAMINES THE GENERAL NATURE AND SOURCES OF POTENTIAL THREATS AGAINST DATABANK SYSTEMS. ALSO DESCRIBED IS A GAME-THEORETIC FRAMEWORK FOR THE DESIGN OF PROTECTION SYSTEMS THAT IS BASED ON A MATHEMATICAL FORMULATION OF THE INTERACTION OF A DATABANK PROTECTOR WITH AN INTRUDER WHO IS STRIVING TO GAIN ECONOMIC PROFIT. THE INTERACTION MODEL IS DEFINED AND THE NECESSARY VARIABLES ARE IDENTIFIED AND DISCUSSED. AMONG SUCH VARIABLES ARE MEASURES OF SECURITY-EFFECTIVENESS OF VARIOUS PROTECTION MECHANISMS, THE VALUE OF PROTECTED ENTITIES TO THE PARTIES INVOLVED, AND THE COSTS OF BOTH THE PROTECTION AND INTRUSION. IN ADDITION, THE ELEMENTS OF A SYSTEM THAT PROVIDES PROTECTION TO SUBJECTS' RIGHTS, MAINTAINS DATA CONFIDENTIALITY, PROVIDES DATA SECURITY, INCLUDES ELEMENTS OF DATA INTEGRITY MANAGEMENT, AND IMPLEMENTS THE NECESSARY FEATURES FOR AUDITING THE EFFECTIVENESS OF PROTECTIVE DEVICES AND PROCEDURES ARE EXAMINED IN DETAIL. PROTOTYPE PROTECTIVE SYSTEMS THAT IMPLEMENT THREE LEVELS OF PROTECTION (LOW, MEDIUM, AND HIGH) ARE FORMULATED IN TERMS OF PROTECTION FEATURES THAT SHOULD BE INCLUDED. A ONE-HUNDRED ITEM LIST OF REFERENCES IS INCLUDED. (AUTHOR ABSTRACT)