Pharma Clinical Trial Data Sharing General Description of the Industry / Use Case: Under an industry trade group proposal, clinical trial data for new drugs will be shared outside intra-enterprise warehouses. Regulatory submissions commonly exceed “millions of pages.” Mapping to the Security Reference Architecture: RA Component Security & Privacy Topic Use Case Mapping Sources → End-Point Input Validation Opaque – company-specific Transformation Real Time Security Monitoring None Data Discovery and Classification Opaque – company-specific Secure Data Aggregation 3rd party aggregator Transformation → Privacy-preserving Data Analytics Data to be reported in aggregate Uses but preserving potentially small-cell demographics Compliance with Regulations Responsible developer & 3rd party custodian Govt access to data and freedom of None considered: research limited expression concerns community use; possible future public health data concern. Clinical Study Reports only, but possibly selectively at study-, patient-level Transformation Data Centric Security such as TBD ↔ Data identity/policy-based encryption Infrastructure Policy management for access control Internal roles; 3rd party custodian roles; researcher roles; participating patients’ physicians Computing on the encrypted data: TBD searching/filtering/deduplicate/fully homomorphic encryption Audits Release audit by 3rd party Securing Data Storage and Transaction logs TBD Key Management Internal varies by firm; external TBD Security Best Practices for non-relational TBD data stores Security against DoS attacks Unlikely to become public Data Provenance TBD – critical issue
Pharma Clinical Trial Data Sharing General Description of the Industry / Use Case: Under an industry trade group proposal, clinical trial data for new drugs will be shared outside intra-enterprise warehouses. Regulatory submissions commonly exceed “millions of pages.” Mapping to the Security Reference Architecture: RA Component Security & Privacy Topic Use Case Mapping Sources → Transformation End-Point Input Validation Opaque – company-specific Real Time Security Monitoring None Data Discovery and Classification Opaque – company-specific Secure Data Aggregation 3rd party aggregator Transformation → Uses Privacy-preserving Data Analytics Data to be reported in aggregate but preserving potentially small-cell demographics Compliance with Regulations Responsible developer & 3rd party custodian Govt access to data and freedom of expression concerns None considered: research limited community use; possible future public health data concern. Clinical Study Reports only, but possibly selectively at study-, patient-level Transformation ↔ Data Infrastructure Data Centric Security such as identity/policy-based encryption TBD Policy management for access control Internal roles; 3rd party custodian roles; researcher roles; participating patients’ physicians Computing on the encrypted data: searching/filtering/deduplicate/fully homomorphic encryption TBD Audits Release audit by 3rd party Securing Data Storage and Transaction logs TBD Key Management Internal varies by firm; external TBD Security Best Practices for non-relational data stores TBD Security against DoS attacks Unlikely to become public Data Provenance TBD – critical issue