Security Monitoring Without Unnecessary Data Collection

Problem statement

Investigate how Black Wall can provide useful security monitoring while minimizing the collection, exposure, and retention of sensitive information.

Why it matters

Security telemetry frequently captures far more than the event it is meant to detect, turning a monitoring system into a store of sensitive data. Minimising collection and retention reduces the value of that store to an attacker without giving up detection.

Research questions

1. 01 Which fields are genuinely required to detect the target security events, and which can be discarded at source?
2. 02 How should access controls and retention limits be enforced over security events?
3. 03 What can be processed locally instead of being exported for central analysis?
4. 04 How much detection quality is lost when data is minimised, and how should that trade-off be measured?

Research objectives

• Define a minimal security-event schema.
• Establish access controls and retention policies.
• Evaluate local processing and data minimization.
• Protect log integrity.
• Measure the trade-off between privacy and detection quality.

Technical challenges

• The fields that aid detection are often the same fields that reveal sensitive behaviour.
• Local processing needs enough context without centralising raw events.
• Retention limits must be enforced even when consumers request more data.
• Log integrity mechanisms can preserve content that minimisation was meant to remove.

Expected outcome

A privacy-conscious telemetry design with documented data flows and evaluation criteria.

Tags

privacytelemetrydata minimisationretentionsecurity monitoringlog integrity

Related research

• Tamper-Evident Integrity Monitoring for Critical OS Components

  Detect unauthorised changes to protected files, executables, configuration and security policy, and distinguish them from legitimate updates.

  Open Research Problem · Cybersecurity
• Designing a Self-Defending Operating System Architecture

  Design an operating-system architecture that continuously evaluates security conditions, detects suspicious system changes and applies controlled defensive responses.

  Open Research Problem · Cybersecurity