{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/ecs/issues/68","repository_url":"https://api.github.com/repos/elastic/ecs","labels_url":"https://api.github.com/repos/elastic/ecs/issues/68/labels{/name}","comments_url":"https://api.github.com/repos/elastic/ecs/issues/68/comments","events_url":"https://api.github.com/repos/elastic/ecs/issues/68/events","html_url":"https://github.com/elastic/ecs/issues/68","id":347850822,"node_id":"MDU6SXNzdWUzNDc4NTA4MjI=","number":68,"title":"Guidance on anonymization/pseudonymization","user":{"login":"loekvangool","id":7300472,"node_id":"MDQ6VXNlcjczMDA0NzI=","avatar_url":"https://avatars0.githubusercontent.com/u/7300472?v=4","gravatar_id":"","url":"https://api.github.com/users/loekvangool","html_url":"https://github.com/loekvangool","followers_url":"https://api.github.com/users/loekvangool/followers","following_url":"https://api.github.com/users/loekvangool/following{/other_user}","gists_url":"https://api.github.com/users/loekvangool/gists{/gist_id}","starred_url":"https://api.github.com/users/loekvangool/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/loekvangool/subscriptions","organizations_url":"https://api.github.com/users/loekvangool/orgs","repos_url":"https://api.github.com/users/loekvangool/repos","events_url":"https://api.github.com/users/loekvangool/events{/privacy}","received_events_url":"https://api.github.com/users/loekvangool/received_events","type":"User","site_admin":false},"labels":[{"id":947079992,"node_id":"MDU6TGFiZWw5NDcwNzk5OTI=","url":"https://api.github.com/repos/elastic/ecs/labels/discuss","name":"discuss","color":"b1f279","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-06T09:40:15Z","updated_at":"2018-08-07T08:01:15Z","closed_at":null,"author_association":"NONE","body":"I'd like to propose that ECS adds guidance for anonymization and pseudonymization. Some thoughts:\r\n\r\n**Definitions**\r\n- anonymization: Irreversible data obfuscation.\r\n- pseudonymization: Reversible data obfuscation.\r\n\r\n**PII model**\r\nThe [NIST 800-122 publication on PII identifies](https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-122.pdf) levels of personal identifiable information:\r\n- High (1): publication has severe/catastrophic effects\r\n- Medium (2): publication has serious adverse effects\r\n- Low (3): publication has limited adverse effects\r\n- Public (4): not part of PII, but describes non-personal data\r\n\r\nTypically if one is allowed to see PII level `X`, one can also see PII levels `< X` (the Air Force One uses the same method: walk freely towards the rear, but never walk forward of your own seat). We could also imagine putting `pii_<level>` as a pre- or postfix in field names to easily manage Field Level Security (because it supports access based on wildcards (`*`)).\r\n\r\n**Varying levels of obfuscation**\r\nWe should also recognize that various versions of the same field can (and should) exist in harmony. Perhaps the Dutch postal code system is a good example:\r\n- `postalcode: 1234AB`\r\n\r\nThe system is set up so that each character to the right is adding more precision to the location.\r\n\r\nPerhaps in Elasticsearch this becomes:\r\n- `customer.postalcode.raw: 1234AB`\r\n- `customer.postalcode.city: 12`\r\n- `customer.postalcode.obfuscated: E32DB25A9BAAA6AF655FE65A861C9BD35AF1868229E0E9D738236B4500626AFB`\r\n\r\nOr, implementing PII:\r\n- `customer.postalcode.pii1: 1234AB` <-- perhaps enough to identify the customer\r\n- `customer.postalcode.pii2: 12` <-- not enough to identify the customer\r\n- `customer.postalcode.pii3: E32DB25A9BAAA6AF655FE65A861C9BD35AF1868229E0E9D738236B4500626AFB` <-- not enough to identify the customer, but based on PII 1 data hence we can bucket customers of the same street without knowing which street it is.\r\n\r\nThe above would allow various users to access the postal code at an appropriate level for their usage (in case Business Analytics, for example, uses non-PII 1 data only due to law)."},"comment":{"url":"https://api.github.com/repos/elastic/ecs/issues/comments/410969828","html_url":"https://github.com/elastic/ecs/issues/68#issuecomment-410969828","issue_url":"https://api.github.com/repos/elastic/ecs/issues/68","id":410969828,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMDk2OTgyOA==","user":{"login":"ruflin","id":244900,"node_id":"MDQ6VXNlcjI0NDkwMA==","avatar_url":"https://avatars3.githubusercontent.com/u/244900?v=4","gravatar_id":"","url":"https://api.github.com/users/ruflin","html_url":"https://github.com/ruflin","followers_url":"https://api.github.com/users/ruflin/followers","following_url":"https://api.github.com/users/ruflin/following{/other_user}","gists_url":"https://api.github.com/users/ruflin/gists{/gist_id}","starred_url":"https://api.github.com/users/ruflin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ruflin/subscriptions","organizations_url":"https://api.github.com/users/ruflin/orgs","repos_url":"https://api.github.com/users/ruflin/repos","events_url":"https://api.github.com/users/ruflin/events{/privacy}","received_events_url":"https://api.github.com/users/ruflin/received_events","type":"User","site_admin":false},"created_at":"2018-08-07T08:01:15Z","updated_at":"2018-08-07T08:01:15Z","author_association":"COLLABORATOR","body":"Thanks for filing this issue with all the details. I assume by default the \"original\" field would always contain the original object? \r\n\r\nIf we would have a field `a` and a field `b` and want to use field security, the fields would have to be called `pii1_a` and `pii1_b` so we could give someone access to all `pii1_*` fields? Would be nice if we could have `a_pii1` instead so assuming has access to `pii1` and `pii2` he could start typing `a` and would see an auto complete for all the fields available to him."}}
{"actor":{"display_login":"ruflin"}}