trademark

6.0 Scalable and Composable Privacy-Preserving Analytics (cont.)
6.8 Encrypt data at rest
6.8.1 Why?
To prevent access to sensitive information. Threats against end user devices may allow
unauthorized parties to access personal information. To prevent such inappropriate
disclosures, particularly of personally identifiable information (PII) and other sensitive
data, the confidentiality of data needs to be secured on the devices.
6.8.2 How?
The primary security control for restricting access to sensitive information stored on
end-user devices is encryption. Encryption can be applied granularly, such as to an
individual file containing sensitive information, or broadly, such as encrypting all stored
data. In the case of database infrastructure, primary keys are used for indexing and
joining tables. Therefore, encryption may not be applicable. Sensitive data, such as
personally identifiable information, should not be used as a primary key. Ensure that the
encryption algorithm used is current and appropriate for the given data set.
6.9 Implement privacy-preserving data composition
6.9.1 Why?
To address privacy concerns preemptively. In some real-world circumstances (such as those
that may occur in the healthcare industry), it is often necessary to aggregate and/or query
data from multiple data sources, such as electronic healthcare record systems in multiple
hospitals or research institutes. Privacy issues are likely to emerge during that process.
6.9.2 How?
Ensure that leakage of private information is controlled when multiple databases and/or
services are linked by reviewing and monitoring the functionality that links them.
6.10 Design and implement linking anonymized datastores
6.10.1 Why?
To ensure privacy. Even if data in each datastore is anonymized (i.e. personally
identifiable information is appropriately removed), this is not often sufficient if multiple
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
35