trademark

8.0 Granular Access Control (cont.)
8.7.2 How?
Use a labeling scheme that disambiguates between labels managed by different
authorities. Leverage user attributes that are coupled with advanced SSO systems, such
as LDAP, Active Directory, OAuth, and OpenId.
8.8 Incorporate proper implementation of
secrecy requirements
8.8.1 Why?
To ensure secrecy requirements. Ensuring that the requirements are properly
implemented requires constructing arguments about data identity, user identity, user
purpose, and many additional environmental considerations. In a granular access
control system, these elements can be disbursed throughout the architecture for
performance reasons, but proper use of the tools available can lead to straightforward
arguments for the preservation of secrecy.
8.8.2 How?
Deconstruct secrecy requirements into parts that are data specific, user specific, and
application specific. Use a consistent labeling strategy to ensure that all of the necessary
fine-grained information about the data is found in the labels. Use an authoritative source
for user attributes. Infer that any purpose- or application-specific restrictions are either
provided by the application and audited or inferred by application-specific authentication.
8.9 Implement logical filter in application space
8.9.1 Why?
To prevent data abuse and leakage by application. With granular access control
mechanisms, applications have the ability to access data for many different purposes on
behalf of a user. Any policies that prevent cross-purpose data combinations rely in some
part on the application properly separating different uses of data. For example, a single
health care provider may access data for the purpose of diagnosing a specific patient
or for the purpose of characterizing a population of patients. If an application is reused
for both purposes, then the application is responsible for avoiding leakage of personally
identifiable information and personal health information from the first to the second use.
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
46