Difference between revisions of "Attribute"
From MgmtWiki
(→Context) |
(→Context) |
||
| Line 5: | Line 5: | ||
*At one time [[Attribute]]s were once considered to be a useful way to perform [[Authentication]] of a [[User]].<ref>NIST Special Publication 800-162 ''Guide to Attribute Based Access Control (ABAC) Definition and Consideration'' https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.sp.800-162.pdf</ref> | *At one time [[Attribute]]s were once considered to be a useful way to perform [[Authentication]] of a [[User]].<ref>NIST Special Publication 800-162 ''Guide to Attribute Based Access Control (ABAC) Definition and Consideration'' https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.sp.800-162.pdf</ref> | ||
**Now it is realized that this method releases much [[User Private Information]] and offers low [[Assurance]]. | **Now it is realized that this method releases much [[User Private Information]] and offers low [[Assurance]]. | ||
| − | **Even the ISO definition of [[Personally Identifiable Information]] (or PII)seems to imply the existence of [[Attribute]]s that are not personally identifying. | + | **Even the ISO definition of [[Personally Identifiable Information]] (or PII) seems to imply the existence of [[Attribute]]s that are not personally identifying. |
*There are two main sources of user [[Attribute]]s: | *There are two main sources of user [[Attribute]]s: | ||
**The user is often asked to supply [[Attribute]]s, sometimes with a high level of [[Assurance]]. | **The user is often asked to supply [[Attribute]]s, sometimes with a high level of [[Assurance]]. | ||
Revision as of 11:08, 9 October 2018
Full Title or Meme
Any datum (piece of data) about a digital entity.
Context
- At one time Attributes were once considered to be a useful way to perform Authentication of a User.[1]
- Now it is realized that this method releases much User Private Information and offers low Assurance.
- Even the ISO definition of Personally Identifiable Information (or PII) seems to imply the existence of Attributes that are not personally identifying.
- There are two main sources of user Attributes:
- The user is often asked to supply Attributes, sometimes with a high level of Assurance.
- External sources generate User Information which could become Attributes that help identify them, for example EHI or electronic health information from lab tests or health provider notes.
Problems
- Any attribute about a digital entity can be used to narrow the population that exhibits that attribute.
- If you want to see how little data is needed to uniquely determine your real world identity, or your preferences, just enter your data into this little tool].
Solutions
- Attributes should not be released until User Consent is obtained.
References
- NIST Internal Report (NISTIR) 8112: Attribute Metadata defines a schema for metadata that describe a subject’s attributes; it is intended to give relying parties (RPs) greater insight into the methods attributes are determined to assist in making risk-based business decisions. As a result, RPs can examine this metadata and determine if they have the confidence they need in the attribute value before making an authorization decision. This NISTIR is being treated like an “implementers’ draft” – an approach used that focuses on real-world implementation results and lessons-learned before the document can become finalized.
