Towards measuring the linkage risk in information flows

Information is one of the most important assets in industry, infrastructures, government, and armed forces. Classified information can be handled according to organizational rules and well-established access control models. However, the free flow of information is a precondition for decision-making and efficient processes in many cases. Hence, lots of information is not classified by default or on such a low level that too many people and systems have access to it. Due to sophisticated analysis methods, this poses risks. We present a set of unlinkability metrics to determine the overall linkage risk of a collection of information processes. The metrics cover the linkage of storage location, of information flows, of sensitive data, and of sensitive data with (intelligence) sources. We developed a process simulator that allows comparing different process designs a priori and at runtime.