The detection and handling of data leakages is becoming a critical issue for organizations. To this end, data leakage solutions are usually employed by organizations to monitor network traffic and the use of portable storage devices. However, these solutions often produce a large number of alerts, whose analysis is time-consuming and costly for organizations. To effectively handle leakage incidents, organizations should be able to focus on the most severe incidents. Therefore, alerts need to be analyzed and prioritized with respect to their severity. This work presents a novel approach for the quantification of data leakages based on their severity. The approach quantifies the severity of leakages with respect to the amount and sensitivity of the leaked information as well as the ability to re-identify the data subjects of the leaked information. To specify and reason on data sensitivity in an application domain, we propose a data model representing the knowledge within the domain. We validate our quantification approach by analyzing data leakages within a healthcare environment. Moreover, we demonstrate that the data model allows for a more accurate characterization of data sensitivity while reducing the efforts for its specification.
I.M.Abbadi and M.Alawneh, Preventing insider information leakage for enterprises, in: Proceedings of International Conference on Emerging Security Information, Systems and Technologies, IEEE, 2008, pp. 99–106.
2.
A.Adriansyah, B.F.van Dongen and N.Zannone, Controlling break-the-glass through alignment, in: Proceedings of International Conference on Social Computing, IEEE, 2013, pp. 606–611.
3.
A.Adriansyah, B.F.van Dongen and N.Zannone, Privacy analysis of user behavior using alignments, IT Professional55(6) (2013), 255–260.
4.
AXLE project, available at: http://axleproject.eu/ (accessed July 27, 2015).
5.
M.Backes, B.Kopf and A.Rybalchenko, Automatic discovery and quantification of information leaks, in: Proceedings of Symposium on Security and Privacy, IEEE, 2009, pp. 141–153.
6.
S.Banescu and N.Zannone, Measuring privacy compliance with process specifications, in: Proceedings of International Workshop on Security Measurements and Metrics, IEEE, 2011, pp. 41–50.
7.
Y.Benjamini and Y.Hochberg, Controlling the false discovery rate: A practical and powerful approach to multiple testing, Journal of the Royal Statistical Society, Series B, Methodological57(1) (1995), 289–300.
8.
B.Blakley, E.McDermott and D.Geer, Information security is information risk management, in: Proceedings of New Security Paradigms Workshop, ACM, 2001, pp. 97–104.
9.
K.Borders and A.Prakash, Quantifying information leaks in outbound web traffic, in: Proceedings of Symposium on Security and Privacy, IEEE, 2009, pp. 129–140.
10.
E.Costante, J.den Hartog, M.Petković, S.Etalle and M.Pechenizkiy, Hunting the unknown: White-box database leakage detection, in: Data and Applications Security and Privacy XXVIII, LNCS, Vol. 8566, Springer, 2014, pp. 243–259.
11.
E.Costante, F.Paci and N.Zannone, Privacy-aware web service composition and ranking, in: Proceedings of International Conference on Web Services, IEEE, 2013, pp. 131–138.
12.
E.Costante, S.Vavilis, S.Etalle, J.den Hartog, M.Petković and N.Zannone, Database anomalous activities – Detection and quantification, in: Proceedings of the 10th International Conference on Security and Cryptography, SciTePress, 2013, pp. 603–608.
C.Doulaverakis, G.Nikolaidis, A.Kleontas, I.Kompatsiariset al., GalenOWL: Ontology based drug recommendations discovery, Journal of Biomedical Semantics3 (2012), 14.
15.
F.Farahmand, S.B.Navathe, P.H.Enslow and G.P.Sharp, Managing vulnerabilities of information systems to security incidents, in: Proceedings of International Conference on Electronic Commerce, ACM, 2003, pp. 348–354.
16.
A.Garg, J.Curtis and H.Halper, Quantifying the financial impact of it security breaches, Information Management & Computer Security11(2) (2003), 74–83.
17.
E.Gessiou, Q.H.Vu and S.Ioannidis, IRILD: An information retrieval based method for information leak detection, in: Proceedings of European Conference on Computer Network Defense, IEEE, 2011, pp. 33–40.
18.
J.Gómez-Hidalgo, J.Martın-Abreu, J.Nieves, I.Santos, F.Brezo and P.Bringas, Data leak prevention through named entity recognition, in: Proceedings of International Conference on Social Computing, IEEE, 2010, pp. 1129–1134.
19.
T.R.Gruber, Toward principles for the design of ontologies used for knowledge sharing?, International Journal of Human–Computer Studies43(5) (1995), 907–928.
20.
A.Harel, A.Shabtai, L.Rokach and Y.Elovici, M-score: A misuseability weight measure, IEEE Transactions on Dependable and Secure Computing9(3) (2012), 414–428.
21.
M.Hart, P.Manadhata and R.Johnson, Text classification for data loss prevention, in: Privacy Enhancing Technologies, LNCS, Vol. 6794, Springer, 2011, pp. 18–37.
22.
Health Level Seven (HL7), Healthcare Privacy and Security Classification System (HCS), Release 1, 2013.
23.
HL7 Fast Health Interoperable Resources (FHIR), available at: http://hl7.org/fhir (accessed July 27, 2015).
Information Age, New EU data laws to include 24hr breach notification, 2012.
26.
S.Jajodia, P.Samarati, M.L.Sapino and V.S.Subrahmanian, Flexible support for multiple access control policies, ACM Transactions on Database Systems26(2) (2001), 214–260.
27.
A.Kamra, E.Terzi and E.Bertino, Detecting anomalous access patterns in relational databases, The VLDB Journal17(5) (2007), 1063–1077.
28.
R.Koch, Towards next-generation intrusion detection, in: Proceedings of International Conference on Cyber Conflicts, IEEE, 2011, pp. 1–18.
29.
N.Li, T.Li and S.Venkatasubramanian, T-closeness: Privacy beyond k-anonymity and l-diversity, in: Proceedings of the International Conference on Data Engineering, IEEE, 2007, pp. 106–115.
30.
A.Machanavajjhala, D.Kifer, J.Gehrke and M.Venkitasubramaniam, L-diversity: Privacy beyond k-anonymity, ACM Transactions on Knowledge Discovery from Data1(1) (2007), 3.
31.
F.Massacci, J.Mylopoulos and N.Zannone, Hierarchical Hippocratic databases with minimal disclosure for virtual organizations, The VLDB Journal15(4) (2006), 370–387.
32.
S.Mathew, M.Petropoulos, H.Ngo and S.Upadhyaya, A data-centric approach to insider attack detection in database systems, in: Recent Advances in Intrusion Detection, LNCS, Vol. 6307, Springer, 2010, pp. 382–401.
33.
I.Matteucci, P.Mori and M.Petrocchi, Prioritized execution of privacy policies, in: Data Privacy Management and Autonomous Spontaneous Security, LNCS, Vol. 7731, Springer, 2012, pp. 133–145.
34.
Open Clinical: Ontologies, available at: http://www.openclinical.org/ontologies.html (accessed January 12, 2015).
35.
OpenGALEN, available at: http://www.opengalen.org/ (accessed January 12, 2015).
36.
F.Paci and N.Zannone, Preventing information inference in access control, in: Proceedings of Symposium on Access Control Models and Technologies, ACM, 2015, pp. 87–97.
37.
Ponemon Institute, Third annual benchmark study on patient privacy & data security, Research report, 2012.
38.
Ponemon Institute, 2014 Cost of data breach study: Global analysis, Research report, 2014.
39.
M.B.Salem, S.Hershkop and S.J.Stolfo, A survey of insider attack detection research, in: Insider Attack And Cyber Security, Advances in Information Security, Vol. 39, Springer, 2008, pp. 69–90.
40.
G.Smith, On the foundations of quantitative information flow, in: Foundations of Software Science and Computation Structures, LNCS, Vol. 5504, Springer, 2009, pp. 288–302.
41.
SNOMED – CT, available at: http://www.ihtsdo.org/snomed-ct/ (accessed January 12, 2015).
42.
P.Samarati, Protecting respondents’ identities in microdata release, IEEE Transactions on Knowledge and Data Engineering13(6) (2001), 1010–1027.
43.
T.Takebayashi, H.Tsuda, T.Hasebe and R.Masuoka, Data loss prevention technologies, Fujitsu Scientific and Technical Journal46(1) (2010), 47–55.
44.
Test Level 7, available at: http://tl7.intelliware.ca (accessed July 27, 2015).
45.
The Gene ontology, available at: http://www.geneontology.org/ (accessed January 12, 2015).
46.
The Open Biological and Biomedical Ontologies Foundry, available at: http://www.obofoundry.org/ (accessed January 12, 2015).
47.
S.Vavilis, A.Egner, M.Petković and N.Zannone, An anomaly analysis framework for database systems, Computers & Security53 (2015), 156–173.
48.
S.Vavilis, M.Petković and N.Zannone, Data leakage quantification, in: Data and Applications Security and Privacy XXVIII, LNCS, Vol. 8566, Springer, Berlin, 2014, pp. 98–113.
49.
Y.Yang, An evaluation of statistical approaches to text categorization, Information Retrieval1(1–2) (1999), 69–90.
