Audit Mechanisms for Provable Risk Management and Accountable Data Governance (CMU-CyLab-12-020)

摘要: Organizations that collect and use large volumes of personal information are expected under the principle accountable data governance to take measures protect subjects from risks arise inapproriate uses this information. In paper, we focus on a specific class mechanisms— audits identify policy violators coupled with punishments—that organizations such as hospitals, financial institutions, Web services companies may adopt privacy security stemming inappropriate by insiders. We model interaction between organization (defender) an insider (adversary) during audit process repeated game. then present strategy for defender. The requires defender commit its action when paired adversary’s best response it, provably yields asymmetric subgame perfect equilibrium. two mechanisms allocating total budget inspections across all games plays different first mechanism allocates maximize utility organization. Observing protects organization’s interests but not subjects, introduce property, which conduct thorough impose punishments violators. second achieves property. provide evidence number parameters in game can be estimated prior empirical studies suggest help estimate other parameters. Finally, our predict observed practices industry (e.g., differences punishment rates doctors nurses same violation) effectiveness interventions breach notification laws government audits) encouraging practices. ? This work was partially supported U.S. Army Research Office contract “Perpetually Available Secure Information Systems” (DAAD19-02-1-0389) Carnegie Mellon CyLab, NSF Science Technology Center TRUST, CyberTrust grant “Privacy, Compliance Risk Complex Organizational Processes,” AFOSR MURI “Collaborative Policies Assured Sharing,” HHS Grant no. 90TR0003/01. Jeremiah Blocki also Graduate Fellowship. Arunesh Sinha CMU CIT Bertucci views conclusions contained document those authors should interpreted representing official policies, either expressed or implied, any sponsoring institution, entity.