Common Core K-12 Student Reporting General Description of the Industry / Use Case: Cradle-to-grave student performance metrics for every student are now possible – at least within the community and probably beyond. This could include every test result ever administered. Mapping to the Security Reference Architecture: RA Component Security & Privacy Topic Use Case Mapping Sources → End-Point Input Validation Application-dependent. Spoofing is Transformation possible. Real Time Security Monitoring Vendor-specific monitoring of tests, test-takers, administrators & data. Data Discovery and Classification unknown Secure Data Aggregation Typical: Classroom level Transformation → Privacy-preserving Data Analytics Various: e.g., teacher level analytics Uses across all same-grade classrooms. Compliance with Regulations Parent-, student-, taxpayer disclosure & privacy rules apply Govt access to data and freedom of Yes. May be required for grants, expression concerns funding, performance metrics for teachers, administrators, districts. Transformation Data Centric Security such as Support both individual access ↔ Data identity/policy-based encryption (student) & partitioned aggregate Infrastructure Policy management for access control Vendor (e.g., Pearson) controls, state level policies, federal level policies; probably 20-50 roles? Computing on the encrypted data: unknown searching/filtering/deduplicate/fully homomorphic encryption Audits Support 3rd party audits by unions, state agencies, resp to subpoenas Data Securing Data Storage and Transaction logs Large enterprise security, trx Infrastructure controls – classroom to Feds Key Management CSO’s from classroom level to national Security Best Practices for non-relational unknown data stores Security against DoS attacks standard Data Provenance Traceability to measurement event requires capturing tests @ point in
Common Core K-12 Student Reporting General Description of the Industry / Use Case: Cradle-to-grave student performance metrics for every student are now possible – at least within the community and probably beyond. This could include every test result ever administered. Mapping to the Security Reference Architecture: RA Component Security & Privacy Topic Use Case Mapping Sources → Transformation End-Point Input Validation Application-dependent. Spoofing is possible. Real Time Security Monitoring Vendor-specific monitoring of tests, test-takers, administrators & data. Data Discovery and Classification unknown Secure Data Aggregation Typical: Classroom level Transformation → Uses Privacy-preserving Data Analytics Various: e.g., teacher level analytics across all same-grade classrooms. Compliance with Regulations Parent-, student-, taxpayer disclosure & privacy rules apply Govt access to data and freedom of expression concerns Yes. May be required for grants, funding, performance metrics for teachers, administrators, districts. Transformation ↔ Data Infrastructure Data Centric Security such as identity/policy-based encryption Support both individual access (student) & partitioned aggregate Policy management for access control Vendor (e.g., Pearson) controls, state level policies, federal level policies; probably 20-50 roles? Computing on the encrypted data: searching/filtering/deduplicate/fully homomorphic encryption unknown Audits Support 3rd party audits by unions, state agencies, resp to subpoenas Data Infrastructure Securing Data Storage and Transaction logs Large enterprise security, trx controls – classroom to Feds Key Management CSO’s from classroom level to national Security Best Practices for non-relational data stores unknown Security against DoS attacks standard Data Provenance Traceability to measurement event requires capturing tests @ point in