Stay ahead of the regulatory tsunami - Model driven compliance and governance

In this talk, Yong Albert, co-founder and CEO of Data and Motion, discusses the broader implications of compliance regulations in the software industry, particularly focusing on the Critical Reporting Act (CRA) and GDPR. He highlights the challenges organizations face in understanding their software components and ensuring compliance with regulations stemming from various incidents like the Equifax breach and ransomware attacks. The speaker introduces a model-driven compliance approach utilizing EMF models for architecture representation, which aids in mapping compliance requirements to technical infrastructures across different regulations, including NIS2 and the EU AI Act. He emphasizes the importance of building tools that generate compliance documentation automatically, alleviating the manual burdens typically faced by organizations. Ultimately, the talk aims to demonstrate how this approach can facilitate compliance by integrating seamlessly with existing systems and fostering an ongoing compliance culture.

Um yeah, I'd like to talk about uh a topic which is scraped on here in this uh this uh this track uh already uh but I think is a little bit bigger than everybody is talking about. So because everybody's just talking about the CRA and what they do and uh I think the the the the picture is actually bigger we have to look at. So, but maybe

first um maybe to give you some background uh about me um I'm Yong Albert, co-h founder and CEO of data and motion. Um we are an open source company basically. So we are involved in a lot of projects. Um I'm a chair of the work steering committee. I help write specifications. I implement um and project lead in different uh things. So as you can see I'm I'm

a technical guy. actually and um most of the talks we have seen here had been more from uh lawyers or the the security uh persons other people that look at it from that perspective. Um and I'm coming from the real world so to speak without belittling the others there. Um, and yeah, I first want to go a little bit into uh a topic that I've also didn't

really hear something about because uh that's why do we have CRA and stuff like that. So because most of us look at it and think like oh god it's annoying because we have to do things it forces us in in certain directions. Um but actually it is codified it codifies Murphy's law. So what do I mean by that? we have a bunch of regulations in response to

incidents. So somebody some up basically. So that's what happened and then somebody said okay we have to react to that. So we had just a few examples. So the lock for shell I guess everybody had some issues with that as well. So uh and what does it showed? it showed the cracks uh in the system because a lot of organizations know which components are in their actual

software and in which version. So you have other things like uh hospitals attacked by ransomware. Why is this the case? Because basically uncrucial systems turned out to be actually crucial for the operation of the whole hospital in this and this is critical infrastructure. There was something called the Equifax breach in 2017. They had an unpatched version of Apache Struts in for a couple of days and uh

some hackers came in and extracted 147 million records of uh US and UK data about citizens social security numbers and and stuff like that. So, so really critical things. So um we have companies who still don't care about uh uh GDPR and uh they now get applied fines because nobody cares or nobody looked at what data is around and where data goes through and where it's coming

from and all of these things or these examples what they show is uh you have an architecture of plan for things but when things go wrong you have a blast radius which might hit other people other systems uh other ecosystems if push push comes to shove there and Murphy will always apply in some shape or form. So by itself by entropy or by external means hackers and

things like that. So and in response to that the law makers reacted. So they created things like the CRA because nobody knew what components were on which products. um they we have something like NIS 2 which looks at critical infrastructure what needs to be done there to prevent some uh things being being that vulnerable. The same thing for Dura for the financial system. So uh that they

get more resilience. Um, the EU is trying to get a little bit ahead of the curve with the EU AI act. So, uh, AI doesn't run rampant and because AI is now everywhere, but nobody knows what they're doing. And GDPR around for a couple of years and it's more than just a cookie banner, uh, which annoys every one of us, uh, it actually should force the people

who work with this data to think about what data do we need? Should we work with that data um, in that way? and what it does or these regulations do. So you can discuss in detail about certain aspects but they regul give regulations for things you should already care about. So in your infrastructure in your software and everything the annoying part is it ends up being a

lot of paperwork. So in the end, so there are certain platforms and tools that help you becoming compliant with this stuff and this is usually that these are better task trackers. So so it directs a little bit your work uh and how you can go about it but it doesn't really help you accomplishing that goal. Uh it barely gives you the tooling. So we have tooling for

certain things. We can create soms and stuff nowadays. Uh but there's a lot of things that that uh keeps to be desired. um given that starting point uh maybe a little bit of a history so because what I'm talking about is uh it's it's a little bit more complex and you need to know where we are coming from. So what we actually do at the moment is

uh we are around as an open source company we've built different projects and in recent years we started building data platforms especially urban data platforms uh for smart cities so for open data for sensor networks uh for citizen services and stuff like that. Um and we usually try not to solve a specific use case. We want to give the cities the means to solve these use cases

themselves. So without uh using developer or using money to hire a developer to do a certain thing or do the same basic thing all over again uh each time. So we have kind of a low code platform there um which works with classical Eclipse ecosystem uh applications and technologies. So in our case everything we do we do with EMF models. So we build a model from everything.

We build a model from the the data which is in the database. We have a model from the process on how to uh transform the data. We have a model of the APIs and from there we can basically read data from nearly every source and print it out in or give it out in any kind of API or form we want. So if it's uh rest with

JSON, XML, uh GraphQL, whatever, we don't care. You can do it with that. You can define it in a low code fashion and the employees of the city can do it themselves with a little bit of training. So without having to be a developer in that regard. So and all of this is built on classical Eclipse technology like I said, OCI among them because OGI that's what

we do. Um so nothing exotic but quite unique how we stack this all this uh things together. Um this however brought us to a point uh in the discussion with the cities they are forced to think about GDPR and uh when they use the platform to let's say uh providing a use case where they have to work with personal data because they do scheduling for their janitors

to do certain things. Maybe there's his name involved and stuff like that. Um or they provide uh grab data from an arbitrary database and uh want to publish this as as public data. You need to check is this GDPR relevant? Should this data go out? So thus we started looking at the data and creating some kind of a warning mechanism. So hey you working with a person

that has a first name and a last name. You might need to think about is this okay? So or you need to do you get approval in the end. So we implement an approval process so the GDPR officer can come there and look at what somebody else has done say that's okay in this regard and here this is the description why it is okay such a description

in Germany is called a so-called fans classical German word there's even a newer word that is uh it's actually three words um I I don't I've forgotten it so fans is the easier word so record of processing activities is um it's mandatory for them. So if they have somewhere personal data involved, they need to explain why it is involved, why it is involved here and okay in

this case and they have to write a rather complex document and this is annoying. This is a lot of work uh they have to put into that because they have to put a lot of information in there. And we realized and we looked at the whole thing and realized hm we basically have all the information available there already. So we can support them and generate this or

suggest things from the models because we know which data we are working with how this data looks like how it runs through the system and uh we can give suggestions to the uh to the uh GDPR office for there. So to make his life a little bit easier his or her life in that regard and uh this is how we started with the whole thing. So and

we thought like okay we helped them to get GDPR compliant and what they are doing in there. So which was not our goal intentionally at the beginning and then we started thinking about the whole thing a little bit more and and pulled on the threat a little bit more and then we realized hm we can model how GDPR uh yeah GDPR uh affects these processes and how

this can be mapped uh to the to the regulations. Why can't we do this for other things? So we heard a lot about CRA. So CRA have requires for example uh an SBOM. So um you need to know which components are there. So we can represent all these as the same models as we use for the processes in the system. We can use the same kind of

models to represent an ESBOM and stuff like that. Um NIS 2 requires incident response plans. So what is it? A process description in the end. So what do we describe processes? The only thing we need to know is what environment are we working in? So which components are there? So what are your how does your infrastructure look? Everything can be done via a model. So you have

dura uh which requires resilience. Um basically the same thing as above. Um so we found that regulations ask different questions because they come from different perspectives but they always ask the questions about the same thing. It's your data, it's your code, it's your infrastructure. So that's repeatedly in there and uh what we have we have shared models, we have a common tooling. Yeah. But different regulations. So

and then we started looking into how to apply the whole thing. So we came up with this model driven compliance approach. Um and it basically is a layout system. So at the core you have this EMF layer where you can model everything. you can model your APIs, your infrastructure and things like that. On top of that, you have a little bit like a semantic layer which gives

meaning to these models. You can describe how why things are with connected with each other. Uh so you understand things better. Then you have something like policy adapter. So which basically is a model which represents each article of CRA of uh GDPR and whatever uh on this and uh which can then map on your models and give you uh ideas about how things work or should work

in there and in the end you have uh a form of generators to apply some compliance frameworks on it because what are maybe you have seen the the talk about the um the compliance framework the Eclipse proposes uh uh newly what is it a bunch of text files. So and this text can be generated basically if you know what needs to go needs to go in there.

Maybe not everything but at least part of that. So things you don't have to do manually. and then we applied another thing we knew from our uh technical experience. uh we have an OCI something which is called the OCI resolver which works on the requirements and capabilities model because what a regulation wants from you it has certain requirements. If you do this you need secure uh communication.

When you have your infrastructure and annotators I have the capability to use SSL which is secure communication. You can start mapping these requirements to capabilities your system has. uh you can even chain them together and say okay we are compliant with this part of the rule because this resolves to that. So and if you have something which does not resolve you at least get a warning and

you might think about that part of the regulation in there. because you can get it that fine grained in there. Something that usually people do by hand. Um which is actually a powerful full system And then we started thinking when we do it like that. We now have uh systems have a life cycle. So a development cycle uh you have a planning stage, you have a development

stage, you have a deployment stage and then you have runtime. So and all of these are affected by the different regulations you need to be compliant with. But each auditing framework just looks at a certain part of that. So and when you do your auditing, you produce documents. What do these documents? They stay somewhere and they age silently basically and somebody needs to come around and put

them or uh and and keep them uh on track and uh to your to your current um version and um yeah in parts we have tooling for that but what people actually do is okay we have to be compliant with that process. They build their own test framework around it to make sure that these processes apply. Maybe you know about uh Netflix for example. They have this

mechanism where they they they have one component which randomly kills components in their infrastructure to see are we resilient at runtime. So is it really working what we are doing here? So that's a risky approach but works for them. That's not something everybody wants to do. But you actually have to prove it and this is something you can describe and say we have this mechanism and this

proves our resilience under this whatever. So uh that's the proven uh the the evidence for for our claim that we are compliant with that regulation. So and this is stuff many they they write the documents but they don't really do the actual work in there. too because it's in a lot of cases sometimes it's paper tigers in so and the complian the the the tooling that exists

helping you to giving the evidence for for this compliance again glorified task trackers. So they don't really help you with that. you have to write the document yourself or hope that the AI is good enough writing that document for you in the future. But uh you have to make sure that everything works out and uh works or and everything the AI says is something that is um

compliant. So what can we do in that regard? Again for us everything is a model and we can connect each layer of models if it's the the lowest level uh or if it's the highest level each can talk or can uh be be referenced with each other. So we have things in uh CI/CD pipelines already that create sbombs. Uh you have things like mave where you can

tell give me your your dependency graph which is also already part of the sbomb but things like that can be read and can be translated in such models. So and then can be stored and processed through the system. Um also test results and stuff like that. Um and this can be applied to basically every system. So or most systems in that regard. Um and this is kind

of your evidence for whatever claim you are making in regard to compliance to whatever. Um so with this you can cover uh with such an approach the development time. Um then we have the deployment time. Uh nowadays most things are somehow infrastructure as code. So simplest form you have a docker compose file. When you pass the docker compost files you know which components are there. So you

you know these component diagrams with your infrastructure where this is my servers and on my servers these systems are running and stuff like that. So from that we can already generate basically these representations not just as a picture but as something which is machine readable and uh which can be annotated with when you see there hey we are using a keylo for example then you already have

the attachment oh you are using uh identity management in your system. So there are some known factors you can derive from that automatically without again writing text for stuff like that. So for kubernetus terraform and stuff in hand charts is a little bit more complex but it's basically the same thing. So you can read the code um and and translate it to whatever is needed. Um and

with that you can also look at oh you have a secret here. There's some fields like username password. It's the same principle like with the GDPR stuff. So we can automatically scan for that and look is there really something in there or have you put in there a placeholder which is somehow taken from the vault or whatever. So things like that can be done as well at

the uh at uh the also the deployment time or before the deployment happens. Yeah. And then we have the the part I've already talked about. So governance of the data in your system um if necessary as all I'm describing here is basically optional if you will do it or if you want to include it in your system. So you can attach it basically to your system and

say okay please from timeline look at the snapshots and validate the data which runs through it because it's not only important that there's much more to it than just saying hey there is a person object or a database which has person and last name first name and last name and its address. Uh maybe it's also there's a comment field. So and what can be in a comment

field basically everything. So you actually should check is somebody putting in their medical data or writing the the credit card number in their in the comment field for whatever reason. So if your process is in your this in your system, you would actually be liable under GDPR to somehow at least mark this um when you store it or something like that. But on the comment field, nobody

thinks about a comment field. So it's not free text. What should I do there? So but this is something that can actually be done uh in that regard. So flagging this personal information and with that we came around that we basically can cover all these steps with such a system and can this is something which I was like I said which I was was missing here. Everybody

was looking at the CRA which is basically just at build time you need to provide something this evidence but it also plays into all the other regulations because the the frameworks you have to um to to prove that you are compliant with something are usually based on EO 27001. So on top of that you then have in Germany the BSE techn and stuff like that that basically

sits upon these frameworks which again as a frameworks in the sense of documentation frameworks use repeated patterns for the same things. So and this is what the assessors look like at when they say okay I want to give you the certification that you are compliant with whatever um they they are all sitting on the same things and so everything is interconnected similar to how the regulations are

actually interconnected as I've shown before you have certain things they they give it a different name but it's actually the same thing they they want from you and they will force you to look at in that regard um and then we stumbled upon Another uh nice uh tidbit um when you know your system when you can describe your system in semantic models and in a semantic way

suddenly AI becomes feasible in many cases because a lot of the discussions I had with people here was yeah AI is nice but you can't trust it. because AI is like junior developer or whatever AI must it hallucinates and things like that but when you give AI the semantics around something and give it a specific task so uh this machine readable knowledge that's exactly what it needs

where it can work with and where it works nice with because you you ask it something uh with with a model in in your mind uh and say whatever the result is you have you can check against that model again with the these validation things and stuff like it's a little bit theoretical at the moment. Um so bear with me here and um maybe the best thing

is uh you can ask uh something like that. So you ask uh checkbt is something you can do or cloud code or whatever uh is my tool GDPR compliant? Cloud code will look at your code and give you heaps of information, good information and bad information and stuff like that. But there's a bunch of hallucination in there. Very very likely. So you really have to go through

it with a a fine combed uh the thing you do your hair with. Not sure. >> Yeah. Fine tooth comb. Thanks. And and see if everything is correct. When you tell it, however, validate my model against this GDPR model and give me the model of your assessment. You can automatically check whatever comes out there. if it's somehow valid. So it's never gives you the freedom to to

just take it and be yay no more work to be done. Uh but with that you get um AI to really make it accountable for what it is doing there without doing the manual checking and the manual work. Um what I uh like I said what what I have here is uh we we have this in parts in place in this urban data platform. Um I started

thinking about this uh roughly or we we we started uh going a step further than GDPR uh going in this compliance direction right as the calls for proposals came out. um we wanted to be a little bit further so I wanted to actually show you something but customers hit and we had to scramble to uh fulfill their needs. So uh that's a little bit a way off.

Uh but the overall goal is to provide this tooling in such a manner that you can plug it in in your existing system in your build system get the data in there and basically have a living compliance platform which generates the stuff for you for whatever perspective you need. So if it's CRA, if it's uh leocet or whatever or this and it on as in in an

ongoing process keeps your documentation alive and part of your process without having all the manual work to writing all these things. So and that's basically um the the overall goal. We are looking into what parts of this uh can be um open sourced as open source because we want to do open source but we have to pay our bills as well. So how to feed this into

the community that's why I thought this uh was really interesting today or the last couple of days what had been talked about here with all the different tooling which is already existing or starts to be uh coming into existence. So we don't have to reinvent everything because we can hook into everything and um yeah I want basically to ask you what do you think about the whole

thing? So would you use something like that? Would this be useful to you? So in in the the given the current context in the current uh world we are living in um would you be willing to participate if this would be an open source project? So I'd like to discuss with you if you still have the the mental capacity on this uh late stage of the conference.

Um what are your thoughts and what do you have questions >> we do? Yeah. >> Um thank you for the talk was really interesting. Um yes, open source and yes I would use it. Um my question would be so would you expect that at one point there would be some kind of catalog or repository of these models or ontologies that you were describing that people could just

pick and choose for their projects. let's say uh uh user ontology and with you know annotated fields that are uh um that need to be compliant with some standards so that I don't have to do this from scratch because you know there's only so much I can do with username and first name and last name and birth date and whatnot. >> Um just repeat it if I

understand it correctly. You mean the mappings from this is the GDPR or whatever and this is a way how it should map to whatever thing. Yes. Um >> uh this would be great if there would be such a central repository. Um one of our projects is a so-called model atlas which is such a repository where you can put models in there maybe not this models at the

moment this need to be hosted somewhere. Um the good thing is the for for example in Germany the BSE uh started giving out their suggestions and scenarios as machine readable things already. So not just as a PDF there is like a JSON where you can see hey uh and with parts of these mappings already in there. So when you uh when when this rule applies to you

this would be your mitigation strategy and this is what you have to do. So and things like these can be collected, translated and uh somehow given out in a unified manner. So uh yes this would be great. So so but somebody needs to host it in the end >> we could put it on Maven Central maybe. >> There you go. >> So >> thank you for the

talk. Great. Um this comment field um kind of frightens me. Can can you >> Yeah. The the comment field you mentioned that's kind of frightening me. Does from now on every comment field have an extensive verification code behind it to ensure compliance if you have to be compliant to this special um act. I mean this how can this be feasible? The thing is that that that's quite

a special case um because you you have to have a reasonable expectation in order to to do a check like that because you can't check every common field. So like in a GitHub or Jira Jira or something you have free text so nobody will check that. So it's like you say hey you are having a word you can write in everything there you have to check what's

the content there. Um this is more something which applies for example if you work with medical data. Yeah. And there when they say hey medical is highly highly sensitive in that regard and when you have a you have a patient object and uh there everything is clear and then you say okay I'm uh when I give out the data I anonymize my data and I put out

use do all the other things but if there is a common field the chances are high that somebody has put some medical information in the common field and maybe also personal information. In such cases you have to check um or you should check. So I don't know about anybody who's really hit by a fine. So um but when you are in an area know okay around me

is sensitive data how how big is it as at least what you need to do is in this for everybody should have as well actually um to to say okay here is a risk that somebody writes ABC in there but we can't do anything about it so what the heck at least you need to document it and then it's sorry so um in that regard so that's

It's and that's why the regulations they force you to think about things like that. So that's basically the the main gist of it. But yeah, don't worry, you don't have to check every comment field and every content of everything. >> Um, you mentioned that this system could essentially be implied from the ground up, right, which is obviously ideal, but also to an already existing piece of software

or or or system. Uh I can imagine that the workload to do that would be astronomical. You know, if you're running a piece of legacy software um worldwide, what does the process look like to plug this in? Are we talking a matter of days or is this a matter of months? Like how does that depend? Of course. Of course. Now the thing is as when as what

we actually what we are good at is uh automatically reading and transforming things. So when you have some kind of machine readable description of how your system looks like like an UML model or you have uh Kubernetes or whatever then you get at least some starting points and you don't have to do everything manual. when you only have the things in the heads of in people's heads,

then you have a problem anyway. Then it's a lot of work. Um, but yeah, so I don't we haven't applied it to any global Netflix style. I don't I got no no clue actually. So it's it can be quick, it can be easy depending on how state-of-the-art your systems are. So >> yeah. Okay. Cheers. >> Anybody else? If not then uh we can go into early preparations

for the end of the the conference. Thank you very much. >> Thank you Jurgen.