In this episode,
we're going to talk about sensitive information that you need to
keep at the forefront of your mind as a security analyst.
These include concepts like pi I or personal identifiable information,
protected health information or PH I.
Both of these really have to do with
understanding the different information that you as an
analyst need to secure or help keep secure as you're going through in your career.
We're also going to discuss hardware data and what specifically
you need to is secure in that aspect of it
and find
data loss protection and how that data loss protection holds with both pi I our
card holder data and our pi I is we're moving through as a major factor
as you as a security analyst need to go through.
The first one I want to discuss is pi I now you
should have a basic concept of pi I from security plus,
but just in case you don't, we'll kind of go into this, right?
So pi I is your full name and social security number.
Most often people forget the full name aspect
and I'm not just talking about your first and
last name we're talking about your middle name as
well because you have to understand that if I have your full name as in your first,
your middle and your last name, depending how it's spelled,
that means that it can be very limited in scope and
I can quickly grab a lot of information about it.
For instance,
my full name Chester with A K is somewhat
easy to find on linkedin Facebook and you name it
and it probably wouldn't be that difficult to find my associated information.
I believe there's like three maybe four people in the entire world with
Bolli of my first name.
But if you were to throw my middle name into the context,
I'm pretty sure there's only one of me,
there's also date of birth.
This is an important aspect of pi I as well because if you identify the date of birth,
how many times have you called a credit
card agency or some type of sensitive framework?
And they're like, oh,
can you give me the last four digits of your social security number?
What's your date of birth?
Those are important aspects when identifying yourself over a telephone call,
your address, both phone numbers and then the biometric
data is valuable for any attacker if I can
get your fingerprint or Iris print or facial recognition,
all of those play in the role of biometric
data and with two factor authentication and multifactor authentication,
becoming more and more of a thing withec security.
That data as a part of your biometric information is going to
become more compelling for an attacker to assume or to gather.
And then finally your financial information.
If I know your full name,
your social security number or even just the
last four digits of your social security number,
your date of birth, your address and your phone number.
How difficult would it be to call the
telephone bank
and then gain access to that person's bank account information.
It's incredibly easy with a spoofing number to call in a bank account
or a banking institution and then go
through the process of identifying yourself with just
the date of birth of the last four digits of your social security number.
It may not seem like much,
but this is information that we take for granted that needs to be protected and you as
a security analyst really need to shine in on the fact that we don't want to store
that data specifically within our banks. If it's not properly secured,
our protected health information or PH I includes some
identifiers that need to be aware of for mono
HPA. But also from an aspect of just common sense,
medical record numbers are a big one.
This could be the medical information that a patient
or even a psychology patient or psychiatric patient may have
and having that medical record number pinpoints to a
specific case or a specific person associated with that case
by keeping that data safe and secure.
We are able to then protect our patients or protect
the information of those that are under our care.
And I sound like a doctor when I say that,
but you have to remember as a security analyst,
those people that information truly is under your care.
The diagnosis information under HPA we are required to keep that information
safe and secure both through encryption methodologies and within our technology,
but not just the diagnosis information, but the treatment as well.
We need to go through and make sure that any associated health information is
secured and only available to the doctors
and nurses associated specifically with that patient
and the patient themselves.
That means that not only is a nurse, not always able to gather that information
but have access to that information.
You have to remember, it's just like our classification,
even though you have the capability and you have
the permissions to access secret or top secret information,
there's also that need to know basis associated with it.
If a nurse is a nurse, that doesn't necessarily mean they have access to it,
the nurse has to be working on that patient as
well in order to gain access to that specific health information
and then payment information,
we don't likely or often associate
payment information with protected health information,
but just having that patient and health information
and payment information associated with that specific patient,
it needs to be secured as well.
When you look at cardholder data specifically associated with a credit
card number or the specific information associated with that card number,
you'd be surprised how often or how secure
or unsecure rather those cards actually are.
Uh if you think about it and I get access to your credit card,
I only need to take a photograph of both the front and the back
and I have full access to the data associated with that specific card.
So keeping this card verification code, the service code, the expiration date,
all of that information secured.
Our databases is a major undertaking
and we need to go through and make sure that data specifically with
that credit card numbers are all kept secure regardless if it's a loan or
with a specific account via retirement account or the credit card itself.
We need to make sure that that information
is highly secured and not processed appropriately.
We process credit cards but we shouldn't
be typing down or writing down the information
because when we're done,
it needs to be destroyed or it needs to only have the
specific data that we need to process the payment on our machines,
usually the last four digits of the credit card and then the name associated with it.
Data loss prevention or D LP is not just a specific machine or a specific technology.
It's a wide range of technologies,
policies and procedures that we utilize to protect data.
This can be the identification and classification of specific data.
Some data is obviously more important than others,
whether it's P I IP H I or protected cardholder data,
all of that information needs protected. If it's sensitive information
associated specifically with a company or organization,
then we again need to keep that data protected.
So we need to identify and then classify it.
And what I mean by that is we need to
recognize that some data is more important than others.
So if we go through and we identify specific data,
say a credit card information or sensitive data, such as
a
our internal processes to handling secure information,
then we've identified it and then we need to classify it. Is it secret?
Is it top secret? Is it just classified?
All of this is covered as security plus.
But as a refresher, just realize for data loss prevention,
we need to identify and then classify that data,
we need to enforce our policies.
You'd be surprised how many people go through and
we write these policies and nobody follows it.
It's important to enforce those policies. When we see a mistake made.
We need to provide training when it comes to these policies and
we need to enforce the policies after the training is completed,
it does no good to write out a big document and make everybody sign it and then say,
oh you read the policy.
So of course you're going to follow it.
We need to go through and enforce that policy and then provide remediable
training after a policy is broken
and then just a little tidbits as we go
through to ensure that the policy is being followed.
Policy enforcement is probably the biggest barrier to any data loss prevention.
Uh to enforce the policies that are already written.
We need to provide real time monitoring.
Uh You'd be surprised with the different technologies that come
into play when it comes to data loss prevention.
I know that when I was working a long time ago with a company,
I was trying to mail myself my W-2 for taxes of the year
because the W-2 is provided to my email address for my specific
company and I needed that emailed over to my private email address.
But when I emailed it through the through the company,
the company flagged it instantly because it had
my social security number attached to the W-2.
So they blocked it
by monitoring.
That's a real time monitoring process that
stops sensitive data from leaving the network.
That's a technology based data loss prevention methodology
that we can utilize.
We also need to ensure that our data encryption standards are up to date.
If we're using AES and that's a symmetric encryption algorithm,
then we need to make sure that we're
providing the proper permissions associated with it.
Are we using 256? Are we only using 128? Are we going to use a specific measure or a
symmetric encryption algorithm.
First, before we use symmetric encryption to send that data across the internet,
whether we're using,
we need to follow the policies and we need to
ensure that data encryption is done not only in transit
but in storage as well.
How are we encrypting that data on our laptops or hard drives or even on our servers?
We need to make sure that data encryption is at the forefront of our minds.
When it comes to that technology that we're utilizing,
there is no way that you're going to be able to
remember all that training that you use when you onboard it
to the company from the start,
the three day marathon of training and awareness that you
had to go through from hr to security to operations.
All that training just
stacks on top of you on day one and you just aren't going to
remember it by providing user awareness training as we go through the process,
whether it's quarterly or
monthly or even annually, both in a formal and informal manner.
We increase our ability to follow policies and procedures
as it becomes the forefront of your employees' mind.
In this episode, we covered how to protect user data,
whether it's P I IP H I or cardholder data.
We've identified different topics and subtopics that you should be familiar with.
We've identified different techniques and strategies that
you can utilize to keep data private
and you really need to realize that it's your job
to know what types of data must be to secure,
but also how to secure it
using the different processes associated with data loss prevention.
You need to really think about CYS A is from
a top level medium point of view within your career,
meaning we're not really concerned about how the encryption method
work or the specific influxes of PI I and Ph I.
But more how you're going to protect that data.
So you may not get questions specifically asking about what Ph I is,
but you may get questions associated with this type of data is associated with PH I.
And what kind of encryption you might utilize to protect this data?
You're not going to see data like that or questions specific like that.
What you are going to see is questions like
uh this form of Ph I and it will give you a list of
them is associated with what type of policy or procedure you should utilize,
meaning that you need to understand the
specific policies and procedures associated with PH I
and how they can be utilized in the overall process.
You will also be expected to know specific frameworks
or governance is associated with it from a regulatory
point of view.
For instance,
you may be asked a question about Ph I
and be able to associate that specifically with HPA
or cardholder data and specifically tie cardholder data back to PCI DS S
now we're going to go through those different frameworks as we progress,
but just realize that you're not going to get basic questions
associated with Pi I and Ph I but more middle road question
from an analytical point of view associated with mid career.
So you need to specifically understand
the policies and procedures associated with Ph
I and Pi I that you may see in your own organization,
those policies and procedures aren't going to be specifically laid out.
But expect scenario based questions that associate specifically with
those types of terms that we learned today.