Chapter 13 — Data systems

Chapter 13 — Data systems

Lesson map

Lesson 13 published. Map, example, EX037.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 A data model"]
  N2["13.2 Minimisation and retention"]
  N3["13.3 Preventing misuse"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX037"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 A data model"]
  N2["13.2 Minimisation and retention"]
  N3["13.3 Preventing misuse"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX037"]

[Learning outcomes]
    |
    v
[13.1 A data model]
    |
    v
[13.2 Minimisation and retention]
    |
    v
[13.3 Preventing misuse]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX037]

Learning outcomes

You will (1) design a data model for awareness and reporting data; (2) apply minimisation and retention; (3) prevent misuse of behaviour data.

13.1 A data model

Aiko designs a small database for Greyford's awareness programme. Tables hold campaigns, lure difficulty ratings, aggregate results by group and reported email fingerprints. She deliberately omits a table linking individual staff to simulation clicks. Prof. Kerr asks why; Aiko explains that individual click records invite misuse, such as appearing in performance reviews, and are not needed to evaluate the programme. Design choices in data systems encode policy decisions about how people will be treated. She presents the schema to human resources and staff representatives before building it.

13.2 Minimisation and retention

Where individual data is unavoidable, such as training completion required by regulation, Aiko stores only completion dates, not quiz scores. Records are deleted two years after a person leaves. Aggregate results are kept longer for trend analysis. She documents each field's purpose and retention in a data dictionary. ISO/IEC 27001:2022 expects information to be handled according to agreed rules, and a data dictionary is an easy way to show what the rules are. She reviews the dictionary with the data protection officer, who signs it off.

13.3 Preventing misuse

Aiko adds controls: only two security staff can query the database; every query is logged; and group results are suppressed below twenty people. She also writes a policy statement, approved by human resources and staff representatives, that awareness data will not be used for discipline. Technical and policy controls together build the trust that keeps staff reporting their mistakes, which is the behaviour the programme most needs. She also schedules an annual review of the query logs by someone outside the security team, so that any attempt to look up individuals or bypass the twenty-person threshold would be noticed and challenged.

Worked example

Aiko designs an awareness database without individual click records, sets minimisation and retention rules and adds access, logging and use limits.

Synthetic case. The database is synthetic; ISO/IEC 27001:2022 is real.

Errors and limits

Regulators may require individual records. Aggregation thresholds can be bypassed by repeated queries.

Exercises

• EX037 — Omitted table. Which table did Aiko deliberately omit? Rubric: 3 = individual staff linked to simulation clicks;; 2 = click table;; 1 = vague;; 0 = none.
• EX038 — Completion record. What is stored for required training completion? Rubric: 3 = completion dates only, not quiz scores;; 2 = dates;; 1 = scores;; 0 = none.
• EX039 — Use policy. What did the approved policy statement say? Rubric: 3 = awareness data will not be used for discipline;; 2 = no discipline;; 1 = vague;; 0 = none.

Synthesis

Data system design encodes how people are treated, so minimise, restrict and limit use of behaviour data.

Continue studying — chapter 13 of 50

← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →