Chapter 4 — Data models | Technologist Human factors and cyber policy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Data models

Lesson map

Lesson 04 published. Map, example, EX010.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Modelling reports"]
  N2["4.2 Fields and values"]
  N3["4.3 Minimising personal data"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX010"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Modelling reports"]
  N2["4.2 Fields and values"]
  N3["4.3 Minimising personal data"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX010"]

[Learning outcomes]
    |
    v
[4.1 Modelling reports]
    |
    v
[4.2 Fields and values]
    |
    v
[4.3 Minimising personal data]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX010]

Learning outcomes

You will (1) design a simple data model for reports and verdicts; (2) define fields and allowed values; (3) avoid storing unnecessary personal data.

4.1 Modelling reports

Lucas designs a data model for Brightwell's reports. Each report has an identifier, the date and time received, the clinic, a category, a verdict and the time the verdict was sent. He links reports about the same email using a cluster identifier, so twenty reports of one phishing email count as one incident with twenty reporters. This model lets IT answer useful questions, such as how quickly the first report arrived and how fast a verdict was sent. The contractor reviews the model and agrees to it.

4.2 Fields and values

For each field, Lucas defines allowed values. Verdict can be malicious, harmless, spam or unknown. Category has a short list, such as fake invoice, fake login and other. Times use one format with a time zone. Fixed values prevent spelling variants that would split counts. He writes the definitions in a table and shares it with the IT contractor, so everyone records data the same way and analyses can be compared across months. He also adds a notes field for anything unusual, limited to a short sentence.

4.3 Minimising personal data

Lucas decides not to store the reporter's name. A random reporter code allows counting repeat reporters without identifying them, and the code-to-person link is not kept. He explains to the practice manager that naming reporters could make staff feel watched and discourage reporting. The model keeps what is needed to improve the service and leaves out what could cause harm, applying data minimisation in a practical way. The practice manager agrees, and the data protection lead records the decision and the reasons for it in the processing register kept for audits.

Worked example

Lucas models reports with clusters, defines allowed values and replaces names with random codes.

Synthetic case. The model is synthetic.

Errors and limits

Random codes may still be linked through other data. Categories need review.

Exercises

EX010 — Cluster purpose. What does the cluster identifier do? Rubric: 3 = groups reports of the same email;; 2 = grouping;; 1 = vague;; 0 = none.
EX011 — Fixed values. Why use fixed allowed values? Rubric: 3 = to prevent spelling variants splitting counts;; 2 = consistency;; 1 = vague;; 0 = none.
EX012 — Reporter code. Why use a random reporter code? Rubric: 3 = count repeat reporters without identifying them;; 2 = anonymity;; 1 = names;; 0 = none.

Synthesis

A clear data model with fixed values and minimal personal data supports useful analysis.

Continue studying — chapter 04 of 30

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →