Data Security Maturity Model
draft-li-saag-data-security-maturity-model-00

Abstract

Data Security Maturity Model (DSMM) provides a multi-level maturity model to help organizations to measure their data security capability maturity level, identify issues related to data security capability, and improve their data security capability.

Requirements Language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on September 21, 2016.

Copyright Notice

Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Introduction
• 1.1. Notational Conventions
• 2. Overview
• 3. Maturity Level
• 4. Model Framework
• 5. Data Lifecycle
• 6. Capability Dimension
• 7. Assessment Method
• 8. Model Domains
• 9. IANA Considerations
• 10. Security Considerations
• 11. Acknowledgements
• 12. Normative References
• Author's Address

1. Introduction

The overall goal of Data Security Maturity Model (DSMM) is to provide a multi-level maturity model to help organizations solving the problems of data security management in big data era, including:

• How to build organizations data security capability
• How to measure the data security capability maturity level of an organization
• How to identify issues about data security capability
• How to improve data security capability for organizations

1.1. Notational Conventions

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].

2. Overview

The DSMM is a process management and improvement maturity model for the development and management of data security services. It consists of best practices that address the security issues in the lifecycle of data management from creation to delivery and maintenance. The practices related to the DSMM model are extensible and applicable to any organization objectives. The model presents an organized set of practices and goals necessary for the data security.

The DSMM defines the requirements for organization responsibilities, institution processes, technology tools, and staff skills, to ensure data security management in the organizations. It does not describe how organizations must do something, but rather what they must do in order to achieve high capabilities or maturity of data security management. By providing a structured and standard framework of practices, the DSMM can be used by organizations to build their own roadmap of data security maturity management. The DSMM has an accompanying standardized methodology for conducting objective appraisals of capability and maturity levels within the organizations data security management practice.

The DSMM applies to all kinds of organizations, including industry enterprises, governments and research institutes.

3. Maturity Level

Data Security Maturity Model can be indicated by 5 levels, as described below:

• Level 1: Performed Informally
• Level 2: Planned and Tracked
• Level 3: Well Defined
• Level 4: Quantitatively Controlled
• Level 5: Level 5: Continuously Improving

4. Model Framework

 
        /- - - - - - - - - - - - - - - - -/- - -/ - -/- -/ - /- - /|
       /              Staff Skil         /  D  / D  / D / D / D  / |
      /- - - - - - - - - - - - - - - - -/  a  / a  / a / a / a  /  |
     /           Technology Tools      /  t  / t  / t / t / t  /   |
    /- - - - - - - - - - - - - - - - -/  a  / a  / a / a / a  /    |
   /       Institution Process       /     /    /   /   /    /     |
  /_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _/     /    /   /   /    /      |
 /  Organization Responsibilities  /     /    /   /   /  D /       |
/_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _  /     |    |   |   |  e /        |                      
|Level 5: Continuously Improving   |    |    |   |   | s |        /
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ | C  |    |   | T | t |       /        
|Level 4: Quantitatively Controlled| r  | S  |   | r | r |      /
|- - - - - - - - - - - - - - - - - | e  | t  |   | a | u |     /       
|Level 3: Well Defined             | a  | o  |   | n | c |    /
|- - - - - - - - - - - - - - - - - | t  | r  | U | s | t |   /    
|Level 2: Planned and Tracked      | i  | a  | a | m | i |  /
|- - - - - - - - - - - - - - - - - | o  | g  | g | i | o | /   
|Level 1: Performed Informally     | n  | e  | e | t | n |/  
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |_ _ |_ _ |_ _| _ |_ _/ 
        

Figure 1 Model Framework

5. Data Lifecycle

The high-level descriptions for data lifecycle are:

• 1) Data Creation: Data creation is the generation of new digital content, or the significant alteration/updating of existing content, either structured or unstructured.
• 2) Data Usage: Data usage refers to the combination of a series of activities towards active data.
• 3) Data Transmission: Data transition refers to the process that data flows from one entity to another through the network.
• 4) Data Storage: Data storage refers to inactive data, which is stored physically in any digital form.
• 5) Data Sharing: Data sharing refers to data exchanging between organizations, customers and partners.
• 6) Data Destruction: Data destruction refers to the process of permanently or temperately making the data unavailable using physical or digital means (e.g., crypto-shredding, freezing data under business context).

6. Capability Dimension

The DSMM model defines the organization capability in four dimensions, namely:

• 1) Organization Responsibilities: The first and most important capability the organization should build is its data security organization, including its function and responsibility, security consciousness. It addresses the need to drive organizational data security management from the top down effort, and in this way, organizations can be open and transparent, break down silos and get internal teams to collaborate. It is important to get executive support, to champion data security adoption from the top down.
• 2)Institution Process: This capability involves the creation of process. This means that organizations need to put processes and frameworks in place to operationalize data security management internally and externally. It enables tight collaboration between different teams and entities like legal teams, IT, Crisis PR, various business units and external business parties.
• 3)Technology Tools: Organizations have to invest in security technology to facilitate the data security controls it employed, especially under current big data era. Manual controls or management controls have been verified inefficient. One of the challenges within this capability is that there are various technologies available to choose thus organizations need to think strategically with proper assessment before investing. Ensuring that the technology can scale and integrate with existing applications that already exist in the enterprise is imperative.
• 4)Staff Skills: Organizations have to educate their staffs, to get more security awareness training, and improve their security skills.

7. Assessment Method

The DSMM model uses bottom-up method to assess and determine the data security maturity level of an organization. Each domain in one data lifecycle phase should be assessed and be given a single maturity level as the assessment result of the domain. Then, take the minimum level of these domains as the assessment result of the data lifecycle phase. Finally, the minimum maturity level of all 6 data lifecycle phases is the overall maturity of the organization.

8. Model Domains

TBD

9. IANA Considerations

This draft does not require any IANA registrations.

10. Security Considerations

TBD.

11. Acknowledgements

TBD

12. Normative References

Author's Address