{"id":"https://openalex.org/W4387857661","doi":"https://doi.org/10.56553/popets-2024-0013","title":"Mitigating Inference Risks with the NIST Privacy Framework","display_name":"Mitigating Inference Risks with the NIST Privacy Framework","publication_year":2023,"publication_date":"2023-10-22","ids":{"openalex":"https://openalex.org/W4387857661","doi":"https://doi.org/10.56553/popets-2024-0013"},"language":"en","primary_location":{"id":"doi:10.56553/popets-2024-0013","is_oa":true,"landing_page_url":"https://doi.org/10.56553/popets-2024-0013","pdf_url":"https://petsymposium.org/popets/2024/popets-2024-0013.pdf","source":{"id":"https://openalex.org/S4210183172","display_name":"Proceedings on Privacy Enhancing Technologies","issn_l":"2299-0984","issn":["2299-0984"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320322","host_organization_name":"De Gruyter Open","host_organization_lineage":["https://openalex.org/P4310320322","https://openalex.org/P4310313990"],"host_organization_lineage_names":["De Gruyter Open","De Gruyter"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings on Privacy Enhancing Technologies","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://petsymposium.org/popets/2024/popets-2024-0013.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5004862883","display_name":"Christopher B. Landis","orcid":"https://orcid.org/0009-0000-6220-5843"},"institutions":[{"id":"https://openalex.org/I35364215","display_name":"Naval Postgraduate School","ror":"https://ror.org/033yfkj90","country_code":"US","type":"education","lineage":["https://openalex.org/I1330347796","https://openalex.org/I3130687028","https://openalex.org/I35364215"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Christopher B. Landis","raw_affiliation_strings":["Naval Postgraduate School","Naval Postgraduate School Monterey, California, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Naval Postgraduate School","institution_ids":["https://openalex.org/I35364215"]},{"raw_affiliation_string":"Naval Postgraduate School Monterey, California, USA","institution_ids":["https://openalex.org/I35364215"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5041167419","display_name":"Joshua A. Kroll","orcid":"https://orcid.org/0000-0002-4079-2175"},"institutions":[{"id":"https://openalex.org/I35364215","display_name":"Naval Postgraduate School","ror":"https://ror.org/033yfkj90","country_code":"US","type":"education","lineage":["https://openalex.org/I1330347796","https://openalex.org/I3130687028","https://openalex.org/I35364215"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Joshua A. Kroll","raw_affiliation_strings":["Naval Postgraduate School","Naval Postgraduate School Monterey, California, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Naval Postgraduate School","institution_ids":["https://openalex.org/I35364215"]},{"raw_affiliation_string":"Naval Postgraduate School Monterey, California, USA","institution_ids":["https://openalex.org/I35364215"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I35364215"],"apc_list":null,"apc_paid":null,"fwci":0.8546,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":{"value":0.80101106,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":95,"max":96},"biblio":{"volume":"2024","issue":"1","first_page":"217","last_page":"231"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9961000084877014,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9961000084877014,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.993399977684021,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.9480999708175659,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.7006536722183228},{"id":"https://openalex.org/keywords/nist","display_name":"NIST","score":0.6320632696151733},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5689676403999329},{"id":"https://openalex.org/keywords/corporate-governance","display_name":"Corporate governance","score":0.4990549087524414},{"id":"https://openalex.org/keywords/information-privacy","display_name":"Information privacy","score":0.49708107113838196},{"id":"https://openalex.org/keywords/risk-management","display_name":"Risk management","score":0.49559247493743896},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.43730059266090393},{"id":"https://openalex.org/keywords/information-sensitivity","display_name":"Information sensitivity","score":0.437033087015152},{"id":"https://openalex.org/keywords/knowledge-management","display_name":"Knowledge management","score":0.3325781524181366},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.29867690801620483},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.2653932571411133}],"concepts":[{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.7006536722183228},{"id":"https://openalex.org/C111219384","wikidata":"https://www.wikidata.org/wiki/Q6954384","display_name":"NIST","level":2,"score":0.6320632696151733},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5689676403999329},{"id":"https://openalex.org/C39389867","wikidata":"https://www.wikidata.org/wiki/Q380767","display_name":"Corporate governance","level":2,"score":0.4990549087524414},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.49708107113838196},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.49559247493743896},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.43730059266090393},{"id":"https://openalex.org/C137822555","wikidata":"https://www.wikidata.org/wiki/Q2587068","display_name":"Information sensitivity","level":2,"score":0.437033087015152},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.3325781524181366},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.29867690801620483},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.2653932571411133},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.0},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.0},{"id":"https://openalex.org/C10138342","wikidata":"https://www.wikidata.org/wiki/Q43015","display_name":"Finance","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.56553/popets-2024-0013","is_oa":true,"landing_page_url":"https://doi.org/10.56553/popets-2024-0013","pdf_url":"https://petsymposium.org/popets/2024/popets-2024-0013.pdf","source":{"id":"https://openalex.org/S4210183172","display_name":"Proceedings on Privacy Enhancing Technologies","issn_l":"2299-0984","issn":["2299-0984"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320322","host_organization_name":"De Gruyter Open","host_organization_lineage":["https://openalex.org/P4310320322","https://openalex.org/P4310313990"],"host_organization_lineage_names":["De Gruyter Open","De Gruyter"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings on Privacy Enhancing Technologies","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.56553/popets-2024-0013","is_oa":true,"landing_page_url":"https://doi.org/10.56553/popets-2024-0013","pdf_url":"https://petsymposium.org/popets/2024/popets-2024-0013.pdf","source":{"id":"https://openalex.org/S4210183172","display_name":"Proceedings on Privacy Enhancing Technologies","issn_l":"2299-0984","issn":["2299-0984"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320322","host_organization_name":"De Gruyter Open","host_organization_lineage":["https://openalex.org/P4310320322","https://openalex.org/P4310313990"],"host_organization_lineage_names":["De Gruyter Open","De Gruyter"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings on Privacy Enhancing Technologies","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.5899999737739563}],"awards":[],"funders":[{"id":"https://openalex.org/F4320306078","display_name":"U.S. Department of Defense","ror":"https://ror.org/0447fe631"},{"id":"https://openalex.org/F4320332178","display_name":"National Institute of Standards and Technology","ror":"https://ror.org/05xpvk416"},{"id":"https://openalex.org/F4320332923","display_name":"U.S. Navy","ror":"https://ror.org/03ar0mv07"}],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4387857661.pdf"},"referenced_works_count":60,"referenced_works":["https://openalex.org/W1525067466","https://openalex.org/W1668469472","https://openalex.org/W1822140064","https://openalex.org/W1847843939","https://openalex.org/W1994029189","https://openalex.org/W2039292858","https://openalex.org/W2056430114","https://openalex.org/W2065076704","https://openalex.org/W2095881341","https://openalex.org/W2115240023","https://openalex.org/W2135930857","https://openalex.org/W2202138802","https://openalex.org/W2210025384","https://openalex.org/W2303276850","https://openalex.org/W2304458857","https://openalex.org/W2331687181","https://openalex.org/W2339215545","https://openalex.org/W2395936978","https://openalex.org/W2518665553","https://openalex.org/W2523579862","https://openalex.org/W2550898138","https://openalex.org/W2557607105","https://openalex.org/W2565345046","https://openalex.org/W2583237626","https://openalex.org/W2792626313","https://openalex.org/W2792731836","https://openalex.org/W2888303200","https://openalex.org/W2889247751","https://openalex.org/W2890707666","https://openalex.org/W2891168584","https://openalex.org/W2892759841","https://openalex.org/W2899579542","https://openalex.org/W2901211505","https://openalex.org/W2914972854","https://openalex.org/W2981210924","https://openalex.org/W2981347044","https://openalex.org/W2982058499","https://openalex.org/W3004321912","https://openalex.org/W3014648098","https://openalex.org/W3030902227","https://openalex.org/W3094287401","https://openalex.org/W3100897712","https://openalex.org/W3124212500","https://openalex.org/W3124308429","https://openalex.org/W3157915803","https://openalex.org/W3192142816","https://openalex.org/W4205228770","https://openalex.org/W4221052436","https://openalex.org/W4226318410","https://openalex.org/W4232589829","https://openalex.org/W4234388477","https://openalex.org/W4244143958","https://openalex.org/W4244838166","https://openalex.org/W4245587674","https://openalex.org/W4250907298","https://openalex.org/W4252326153","https://openalex.org/W4288345394","https://openalex.org/W4300071243","https://openalex.org/W4323349042","https://openalex.org/W6924600435"],"related_works":["https://openalex.org/W2106922437","https://openalex.org/W2158491338","https://openalex.org/W2133733652","https://openalex.org/W2606392311","https://openalex.org/W2058260585","https://openalex.org/W4384027004","https://openalex.org/W4309503015","https://openalex.org/W2596305496","https://openalex.org/W2577220285","https://openalex.org/W58529046"],"abstract_inverted_index":{"The":[0,62],"NIST":[1],"Privacy":[2,28],"Framework":[3],"describes":[4],"itself":[5],"as":[6],"a":[7],"comprehensive":[8,80],"approach":[9],"to":[10,44,69,74,86,110,114,129],"organization-wide":[11],"privacy":[12,42,70,103,126],"program":[13],"management.":[14,82],"However,":[15],"inferences":[16],"can":[17,99],"yield":[18],"sensitive":[19],"information":[20,92],"of":[21,79,134],"identities":[22],"or":[23],"attributes":[24],"from":[25],"nonsensitive":[26],"information.":[27,33],"governance":[29],"must":[30],"protect":[31],"this":[32],"Although":[34],"many":[35],"people":[36],"and":[37,123,146,153],"organizations":[38,98],"are":[39,56],"expanding":[40],"their":[41],"definitions":[43],"include":[45],"inferences,":[46],"our":[47],"gap":[48],"analysis":[49],"reveals":[50],"that":[51,139],"the":[52,84,111],"framework's":[53,112],"mapped":[54],"controls":[55,113,128,138],"insufficient":[57],"for":[58,117],"managing":[59],"inference-driven":[60],"risk.":[61],"framework":[63,85],"does":[64],"not":[65],"attend":[66],"organizational":[67],"focus":[68],"inference":[71,135],"risk":[72,81,127],"sufficiently":[73],"support":[75],"its":[76],"stated":[77],"claim":[78],"Applying":[83],"past":[87],"incidents":[88],"where":[89],"ostensibly":[90],"protected":[91],"was":[93],"re-inferred,":[94],"we":[95,106],"analyze":[96],"how":[97],"better":[100,116],"mitigate":[101],"inference-based":[102],"violations.":[104],"Finally,":[105],"recommend":[107],"detailed":[108],"improvements":[109],"account":[115],"inferences.":[118],"Our":[119],"recommendations":[120],"encompass":[121],"augmenting":[122],"mapping":[124],"additional":[125],"increase":[130],"implementing":[131],"organizations'":[132,148],"awareness":[133],"risks,":[136],"updating":[137],"depend":[140],"on":[141],"protecting":[142],"specific":[143],"PII":[144],"categories,":[145],"enhancing":[147],"proficiency":[149],"in":[150],"translating":[151],"legal":[152],"policy":[154],"requirements":[155],"into":[156],"technical":[157],"implementations.":[158]},"counts_by_year":[{"year":2025,"cited_by_count":2}],"updated_date":"2026-06-26T08:34:08.712188","created_date":"2025-10-10T00:00:00"}