Out of the box support for Traffic Light Protocol

Jeff Jordan

Organization Name

State of Maine

Description

To improve data governance and security, and to simplify access to data which should be readily available, please introduce the concept of the Traffic Light Protocol (https://www.first.org/tlp/) to the Oracle Analytics system.

This integration could be implemented in an iterative manner with many features. Here are a few I am imagining.

1) All data is defaulted to TLP:RED. Machine Learning can suggest TLP value for metadata based on patterns. (Credit Card Numbers, SSN, etc).

2) Data Set owners can tag a data set as, white, green, amber as red.

3) The metadata of each attribute, dimension and measure can be defined with TLP.

4) Based on the data used in a project the TLP for the project/analysis/dashboard is inferred by the system.

5)  Their is a permission scheme introduced which allows some analysts to change the inferred traffic light. Some analysts can do it, others can't based on assigned roles.

6) Develop a TLP visualization which can be added to any project/analysis to display the TLP of the project inferred by the system, or as overwritten by the analyst.

7) TLP can be used in permission schemes and query filter language at the presentation layer.

8) TLP:White analysis/dashboards/projects can have embed code which allows integration without a complex login scheme.

 

 

 

Use Case and Business Need

Sharing data from the Oracle Analytics with 3rd party integrations (embed code, emails etc) while maintaining system data governance. (e.g. some data can leave the system, other data should not).

For example: I have built a data visualization from my companies secure data set that is compelling for my customers. I have determined that the data contained in the visualization does not impact company data security. I would like to publish the visualization on the companies public portal.

Data Cataloging / Valuation

As the Chief Data Officer I would like to understand my data catalog, what is sensitive and what is not. What can be shared internally and what is not.

Internal Communications

As the Chief Information Security Officer I would like to clearly label all assets to give my employees clear guidance on how they may be used.

More details

The embed process is too cumbersome for TLP:White data. Sharing data and visualizations which are not sensitive should be easily accomplished with a few clicks.

Original Idea Number: 2567484f24