>> Governance and compliance Part 1.
The learning objectives for this lesson
are to define the different types of data,
to explain data ownership and classification,
and to explore legal considerations
of data. Let's get started.
Organizations are constantly collecting
data with the individuals that they do business with.
This is normal in the course of doing business,
but not all data is equal.
Some data has to have additional levels of
protection on it based on the type of data that it is.
We're going to go over some of those.
We've created data types to help us better
differentiate the types of information
that need additional levels of protection on them.
We'll begin with the personally
identifiable information or PII.
This is data that can be used to directly or even
indirectly identify a specific person.
Examples of this would be name,
address, social security number, phone number.
Any of that type of information
would need to have higher levels of
protection placed on it
because it is of a sensitive nature.
Next, we have the protected health information or PHI.
This is data that can be used to identify
an individual concerning their health care.
It also includes their past,
present, or future health needs.
In the United States, this is governed by HIPAA.
HIPAA has 18 different unique identifiers
of what is considered PHI under HIPAA laws.
Something that might surprise you is
that their IP address that
they use to visit your website
would be included with this.
It's not just their individual health record,
it could also be a voiceprint, a fingerprint,
a photo of the patient,
all of that would be considered PHI, and then,
therefore, is required to be protected.
The entities that are under
HIPAA regulations have to go to
fairly complex steps to
ensure that that data is not disclosed.
Next, we have financial.
This covers financial information,
including payment histories,
credit ratings, and financial statements.
A subset of this is the
personally identifiable financial information.
This is information provided to
a financial institution about a specific consumer.
It's generally used to gain access
to financial services or products.
Your credit history will be judged,
will help to verify your creditworthiness
so a bank could either give you
a credit card or a bank account, that type of thing.
Then we have intellectual property.
These are the intangible products
created by human thought and ingenuity.
They are protected by trademarks,
copyrights, patents, and trade secrets.
Data ownership is who is responsible for the data,
and what are they responsible to
do with the data that's under their control?
The entity that is responsible for this,
they have to determine what are
the levels of restrictions based
on the laws and legal frameworks that I am subjected to.
Based on those, what levels of protection do I need to
place on the data that I have in my possession?
Data classification.
We went over this briefly in our previous lesson.
But I'm going to hit it again because based
on the way the data is classified,
that determines the type of protections
and controls that must be placed on them.
With public,
this is information that if it were disclosed,
it's not going to harm anyone,
including your organization.
Sensitive data, however, if it were disclosed,
it would cause harm to the organization as
well as the individuals the information is about.
Then lastly, we have confidential.
This is information that if it were disclosed,
would cause considerable harm to
the organization or
the individuals that it might be about.
Because of that, the highest levels of protection must
be put in place to ensure that it is not released.
Data destruction. When we have data that has gone
through the entire data life cycle and we've
reached the stage where we need to get rid of the data,
we have to find the appropriate way to do that.
Based on the type of data that we have,
there may be different ways of doing that.
The more sensitive data might need
more stringent requirements to
ensure that it is not recoverable.
Sanitization is where we remove
all the data from the media using methods such as clear,
purge, damage,
and removing all labels, markings, and logs.
Clear is multiple block-level overwriting
of data that protects against recovery,
except in maybe in the sense of a cleanroom.
Clear would be overwriting the data with random data
on the drive over and over again with multiple passes.
This makes it very difficult to recover it.
Bringing into a clean room,
they can dissect the drive and use things like
an electron microscope to go through,
and really try to piece
together items that may be recoverable.
However, if we need to ensure
that even that is not possible,
we want to use purge.
This will protect against
all recovery methods including clean rooms.
We also can use damage,
where we physically break
the storage medium to make it useless.
This may be putting into
an industrial shredder or a degausser,
or you may want to just totally melt the device.
If you want to ensure that
your data is completely unrecoverable,
damage is the way you want to go.
Then finally, we have crypto erase.
This is where we'll remove the key
that was used to encrypt the data on the device.
If there's no way for that key to be recovered,
then that data is totally useless.
Instructor side note. There have been
numerous stories in the news over the years of
people when they purchase
used drives from eBay or other type places,
only to find that those drives
contain sensitive information on them.
In 2009, British Telecom
performed research where they purchased drives,
and they even found US THAAD missile system data
on some of the drives that they purchased.
It wasn't deleted and hard to recover it,
it was just on the drive right there.
When you're disposing of old drives and devices,
it's very important that you go
through the process to destroy it
properly based on the classification level of that data.
Usually, wiping them with programs like DBAN,
which will do the overwriting
of the data with multiple passes
, that's usually sufficient.
If you want to donate a computer or resell a computer,
you run it through DBAN,
ensure that everything on the drive is
destroyed, and it's good to go.
However, for more sensitive type data,
you need to go through the destruction process.
I would consider using a reputable service to
handle this because they know the proper ways to do it,
and they'll ensure it's done for you.
But if you don't want to go that route,
thermite is always an option.
Data sovereignty. This is based on
the laws in the country where the data is stored.
That governs how the data can be
collected and how it's used in the global economy.
Regulations will vary widely,
and these can impact how the data is stored,
transmitted to another country,
and what types of encryption
must be used to protect the data.
Cloud computing has demonstrated
this complexity as legal risks
in different jurisdictions can
limit how resources can be used.
>> Attestation of compliance.
The set of policies, contracts,
and standards between two entities that have been
designated as essential is
your attestation of compliance.
It will identify how the relationship will be governed,
including how incidences will
be reported and then addressed,
the use of independent auditors
and data protection requirements in violation agreements.
You're proving to another entity
that you are compliant and you're
doing a mutual agreement on what
that level of compliance means between the two of you.
Legal considerations.
Due to how rapidly technology
is being used in every area of our lives,
the laws are changing to keep pace.
Now they usually change it at a lot slower level,
but when they change, they really make big changes.
This can lead to additional complexities
due to these fast changes.
Legal jurisdictions is the first one.
The legal framework that will be used based
on the location of the data would be your jurisdiction.
This can include federal laws,
federal regulations, state laws,
international laws and laws in individual countries.
Do care and due diligence.
Due care is using the prudent man rule.
What is considered to be reasonable and expected?
What type of protection based on a given asset?
This is the baseline and it will vary
widely based on what is being protected.
Due diligence is the ongoing and documented processes
to continuously evaluate and
improve the ways we protect data.
Legal hold and e-Discovery.
Legal hold is also called litigation
hold and it is a notification
received by an entity that requires
the preservation of electronically stored information,
ESI, and paper records that
may be relevant to pending legal proceedings.
It's usually handled by your legal team,
but cybersecurity teams are
involved to place the hold on the data.
e-Discovery is identifying, collecting,
and providing the ESI identified in a legal hold.
This is becoming very common because
more and more important information is
in the digital side.
A opposing attorney will submit a demand
to hold all data related to an impending lawsuit say.
That could include email,
it could include documents,
it could include timestamps on various things.
As a cybersecurity professional,
your job is to go in there and
freeze all of that information so that it can be
collected and then given to
your legal department for them in turn to give to
their attorneys and then their attorneys to
give to the attorney that originally requested it.
It's a very serious process
that you need to make sure that you're
documenting each step of the way and to give
to the request exactly what is being asked for.
Because that opens up other issues
and typically cybersecurity people
won't just be handed this,
they'll be giving guidance
by your own internal legal team.
We've had to do this on two separate occasions
and we never dealt with opposing counsel.
It was always with
the attorney for the people that we were working
for and they provided us
with the details of what we needed to do.
We did the search, froze
everything and then copied it all for them,
and then they took it from there. Export controls.
National export controls.
Many countries may place
restrictions on different exports,
especially the ones that pose a national security risk.
These may include software, commodities,
and technology. The Wassenaar Agreement.
This was established in 1996 to define export controls
for conventional arms and
dual-use goods and technologies.
Forty-two participating states got together to
create this to help prevent
the sensitive technology from getting
to terrorist groups and rogue nations.
Also we have encryption laws.
These will vary between countries.
In some countries you may have no restrictions at all,
while others are very
serious and may not even allow encryption to be used.
This is a big deal.
In fact, simply using a VPN in
some countries can get you into a lot of trouble.
If you're going to be using any level of
encryption in the international setting,
you're going to want to make sure that you understand
those laws very well ahead of time.
I've actually done some international travel
and found a few places that I
visited that they frown heavily upon using a VPN.
Then you have nations such as China
where the locals are heavily
crack down on but tourists aren't targeted quite as much,
but VPNs are one of those things there
that are heavily regulated.
Contract and agreement types.
Legally enforceable documents that are
used to govern the relationship between parties.
The first one is the master service agreement or MSA.
This is an umbrella contract
establishing an agreement between
parties to conduct business
during a specific period of time.
It is defined by scopes of
work and expectations and deliverables.
A memorandum of understanding or MOU
is a non-binding document that's critical,
that formally defines roles
and the expectations of the two parties.
It's very important to remember that it is non-binding.
A non-disclosure agreement or an NDA.
This defines how an entity can use
data and what must be kept confidential,
also contains the legal ramifications
that serve as a deterrent to disclosure,
similar to those using and hiring new employees.
These govern the relationship between
the two companies working together.
For example, when hiring a third-party security service,
they will have access to
the company's sensitive information
that's normal in the course of doing business.
The NDA aims to ensure that
the data remains confidential and that
the third-party service will not do
things that don't allow that information to be disclosed.
We also have the interconnection
security agreement or ISA.
This is used when two parties need
to share data via an interface.
Then it will describe the expectations,
the roles, and the operating
parameters of that connection.
We also have the service level agreement or SLA.
This is how a service will be provided
and it will contain
measurable and repeatable levels
of service and penalties.
You're guaranteeing a certain level
of uptime, for example.
If you don't, what would be
the penalties for not delivering that level of service.
Operational level agreement or OLA.
This is an internal document that defines
the essential operational needs
so that an entity can maintain an SLA.
This is what an organization would use
internally to ensure that they
are delivering that level of
uptime because they don't want to suffer
that penalty if they do not
deliver that level of service.
We also have a privacy level agreement, or PLA.
This is commonly used when we're working with a CSP
and it details how
data will be kept private and protected.
Let's summarize. We went over
data types and classifications.
We also went over data destruction.
Then we went over
a third party compliance and contracts and agreements.
We went over export controls and e-Discovery.
Let's do some example questions.
Question 1, this is
a non-binding document that
establishes how two organizations will work together.
Memorandum of understanding or an MOU.
Question 2, this agreement
was created to prevent weapons and
dual-use technology from getting
to terror groups and rogue nations.
The Wassenaar Agreement.
Question 3, this is the term for
any health information that can
uniquely identify a patient.
Protected Health Information or PHI.
Finally Question 4, this type of data,
if it were disclosed would bring
considerable harm to an organization.
Confidential data. Hope this lesson
was helpful for you, and I'll see you in the next one.