Data Security

Data Security Working Group Meeting - 11/21/24

Publications in Development:

• Cybersecurity and the Data Lifecycle - Q4 2024, Review and continue internal development, prior to public peer review.
• Data security within an AI Environment - Q4 2024, Review and continue internal development, prior to public peer review.

Proposed:

• Highly Sensitive/Confidential Data - 2025
• Privacy Enhancing Technologies for AI - 2025
• Perils of Personal Identifiable Information in LLMs - 2025
• DORA Guidelines & Objectives - 2025

Meeting Summary:

Alex discussed the ongoing Zero Trust Summit and an upcoming AI-focused event, highlighting various sessions and research papers. The team also discussed refining the scope, reviewing, and adding content to the Cybersecurity and the Data Lifecycle paper, focusing on Data Security within an AI Environment, and the potential for privacy-enhancing technologies. Issues with commenting on a document were also addressed, with suggestions that the problem might be at Abhishek's end.

Zero Trust Summit and Upcoming AI Event:

• Alex discusses the ongoing Zero Trust Summit, providing links to access the sessions on-demand. The summit covers topics like applying zero trust principles to operational technology and critical infrastructure in the US federal government. Alex highlights a few interesting sessions from the previous day. The summit is wrapping up, with a few more sessions scheduled after the meeting. Alex also mentions an upcoming AI-focused event in January 2023, which will likely plan for 2025 and provide a more condensed version compared to recent AI symposiums.

Zero Trust and AI Research Update:

• Alex discussed recent research and developments related to Zero Trust and AI. He highlighted a new paper on mapping transaction flows for zero trust, providing guidance on executing the second step of the implementation strategy. He also mentioned a paper from the AI Tech and Risk group on regulatory boundaries and auditing best practices. Additionally, he pointed out a paper on top concerns with vulnerability data and the importance of a rating system for risk prioritization. Lastly, he mentioned several peer reviews, including context-based access control for small and medium businesses, AI tools and applications, and auditing guidelines for enterprise operations.

Refining Paper Scope and Focus:

• Alex initiated a discussion about refining the scope of a paper, which had become too scattered. Rocco suggested reducing the number of subtopics to focus on a clean product. The team agreed to build on this foundation, with a focus Cybersecurity and the Data Lifecycle, followed by Data Security within an AI Environment. Alex mentioned to tie their work into public and private sectors, and possibly industry-specific requirements. The team also discussed the potential for privacy-enhancing technologies and the handling of highly confidential and sensitive data on the Data Security Circle page. The conversation ended with the understanding that these topics are open for further development and refinement.

Zero Trust Event and Draft Document:

• Alex discusses the zero trust event and shares a link to access the on-demand sessions. Abhishek asks if it is a new publication on zero trust data classification, and Alex clarifies that it was a session from the zero trust event happening currently. They discuss some potentially interesting session topics like zero trust for operational technology and AI. Alex encourages reviewing and providing feedback on a draft document before submitting it for peer review. They discuss incorporating references to foundational documents like the NIST big data lifecycle to strengthen the draft.
• NIST SP 1500-1r1: Big Data Interoperability Framework: Volume 1, Definitions
• NIST SP 800-188: De-Identifying Government Datasets: Techniques and Governance

Data Classification Standards and Perspectives:

• Alex and Onyeka discussed the lack of a standard in data classification, with Rocco emphasizing that there is no universally accepted model. They also touched on the differences between linear and circular processes in data classification. The conversation then shifted to the perspective that only government entities can classify data, which was found to be an interesting and thought-provoking idea. The conversation ended without a clear decision or next steps, but with a sense of curiosity and exploration of the topic.

------------------------------
Alex Kaluza
Research Analyst
Cloud Security Alliance
------------------------------