- Welcome to lesson 12,
Compare and Contrast Concepts
and Strategies to Protect Data.
Now in lesson 12.1, we're gonna take a look
at what are the different data types
that we're attempting to protect.
So let's start with a survey of categories of data.
Regulated data, personally identifiable data,
intellectual property, contractually protected,
and organizationally classified data.
Regulatory protected data is data that is protected
by law or by industry standards.
Personally identifiable data refers to data
that can be used to identify a specific individual,
like you or me.
Intellectual property refers to intangible creations.
Contractually protected data refers to data
that is specified in a contract or an agreement
of how we're going to protect it and use it.
And then organizationally classified data refers to data
that meets certain classification criteria.
And we'll be talking about classifications pretty shortly.
So let's go a little deeper into each of these.
So regulated data refers to data
that's subject to specific laws or regulations
or industry standards that govern its collection,
its use, its storage, and its disclosure.
Now jurisdiction is the power or right of a legal
or political agency to exercise its authority
over a person's subject matter or territory.
So based on your jurisdiction,
you may have different types of regulated data.
Now in relation to information security,
jurisdiction pertains to the location of data
and its systems in all its states, processing,
transmission, and storage.
The type of data we have, is it healthcare data?
Is it financial data?
Is it data that has a minor?
Is it personally identifiable data?
The residents of the data owner,
so that would be the organization
that that owns the data,
as well as the resident of the data subject,
which is who the data is about.
Now compliance means acting in accordance
with applicable rules, laws, policies, and obligations.
And organizations are expected to comply with local,
with state, with federal, and with union,
like a union of countries,
like the European Union or the European Economic Area,
laws and regulations, international agreements and treaties,
and contractual obligations.
Now GRC, governance, risk, and compliance,
is a system that's used by organizations
to structure governance, risk management,
and regulatory compliance.
And the concept is to unify
and align an organization's approach to risk management
and regulatory compliance.
Why are we talking about this here?
Because we will have regulations
that govern how we need to protect the data
that's in our possession.
Now let me give you sort of an overview
of some U.S. federal regulations that pertain to data
that we may have in our organizations.
GLBA, it stands for Gramm-Leach-Bliley Act, HIPAA,
sometimes referred to as HITECH,
that's sort of the second generation of HIPAA,
FERPA, and COPPA.
GLBA is a Gramm-Leach-Bliley Act
and it regulates the security
and privacy of consumer financial records.
HIPAA, which is the Health Insurance Portability
and Accountability Act, regulates the security
and the privacy of medical records.
FERPA, which is the Family Educational Rights
and Privacy Act, regulates the security
and privacy of student educational records.
COPPA, which is Children's Online Privacy Protection Act,
regulates the security and privacy
related to the online data collection
of data for minors under the age of 13.
Now personally identifiable data known as PII,
or sometimes it's just referred to as PI,
personal information, refers to data
that can be used to identify a specific individual.
The compromise of PII can result in identity theft,
fraud, and a whole myriad of other really malicious uses.
So what's in PII?
PII may include a person's name, address,
date of birth, social security number here in the U.S.,
a passport number, a driver's license number,
an email address, a phone number,
could have biometric data such as your fingerprints
or facial recognition data
or any other information that can be used
to identify a person uniquely.
Now we think about a PII profile,
we really kind of have three buckets.
Information that can be used to distinguish somebody,
information that can be used to sort of trace them,
and information that can be linked to them
to learn more about them and build a profile.
So information that could distinguish someone
or things like your name, your government ID,
social security number, biometric data,
date of birth, gender, age, sexual orientation.
Type of information could be used to trace you, right?
Would be having information about your physical movements
or your data interaction including your browsing habits.
And then linked data,
data that can be used to build a bigger profile of you
include things like medical records, educational records,
financial records, criminal records, employment history,
even shopping habits.
And when you put this all together,
you really can get a very comprehensive person
of an individual that certainly could be used
for malicious purposes.
And so that's why understanding what regulated data we have
and what regulations we are responsible for complying with
and just really kind of taking care of it in the right way
because we're good people is so very important.
So here are some PII-related regulations
that you wanna be aware of.
GDPR, that's a General Data Protection Regulation,
and CCPA.
The GDPR, the objective is to protect people
in the European Union, EU,
and the European Economic Area, the EEA,
from unlawful data collection or processing
and works to increase consent requirements
and to provide enhanced user rights.
Now the CCPA is the California Consumer Privacy Act
and its objective is to protect California residents.
Now the U.S. doesn't have one overall
PII-related regulation.
We have some state level like California,
we'll talk more about that in just a sec.
And then of course, we have components of PII
in the other regulations, the financial regulations,
GLBA, the healthcare regulations, HIPAA.
But the CCPA is interesting because it draws the scope
of personal information so broadly
to mean any information that identifies, relates to,
describes, or is capable of being associated with
or could reasonably be linked directly
or indirectly with a particular household or a consumer.
So the CCPA really kind of blew out of the water
how we define personally identifiable information.
Now GDPR and CCPA are both built
upon the OECD privacy principles
that we talked about earlier on.
And I do wanna make sure that I mention
that there are other countries
that certainly have PII-related regulations,
Canada, Mexico Brazil, Japan, you know,
among others that all have privacy regulations
to regulate PII.
Now another type of data that is regulated
a little bit differently, though,
is intellectual property law or IP law.
Now don't confuse IP with, in this case,
with internet protocol.
Now intellectual property or IP law
is a branch of law that deals
with the protection of intangible creations.
A book, PowerPoint slides,
music, you know, a piece of artwork.
Now the goal of IP law is to encourage innovation
and creativity by granting exclusive rights to the creator
and the owners of that IP, that intellectual property,
while at the same time,
balancing the interest of the public.
Now, while there are definitely
some international agreements and treaties
that provide some standardization in IP protection,
there really are very significant differences
in how IP is protected
and enforced across different jurisdictions worldwide.
But here are the categories of IP protection
that you need to know about
because you'll be responsible for protecting that data,
either from misuse or making sure
that no one in your organization is misusing information.
So we have patents, trademarks, copyrights,
and trade secrets.
Now a patent gives its owner the legal right
to exclude others from making, selling,
or using an invention for a period of time
in exchange for public publishing a public disclosure
of the invention.
So they can publish it,
but now they have the legal right to make use
and sell that invention.
A trademark,
which sometimes you'll see with TM, trademark,
SM if it's a service mark.
Or you might see an R in a circle,
that means it's been registered with a government agency,
is intended to protect recognizable names,
icons, shapes, colors, and sounds
that are used to represent a brand, product,
service, or a company.
So if I said to you right now,
close your eyes and I say, Coca-Cola,
and I ask you to describe it, what would you say?
I used to say, well, it's the color red
and it's in script, right?
We can all see that Coca-Cola.
And I say, okay, well what if I just say Coke?
Now describe what you see.
Oh, same color, red,
but now it's in more block letters, right?
Those are trademarks, right?
Those are recognizable, you know, names, icons,
shapes, colors, right?
They represent a brand, the Coca-Cola brand,
but it could also be, you know,
a service or a company in general, the Coca-Cola company.
Then we come to copyrights.
And this is the one right now
that's one of our biggest issues.
Copyright protections are intended to allow the creator
of certain types of work to benefit from being created
and being compensated for their work.
And you know, with the explosion of the internet
and so much information on the internet,
this is a place where copy, you know,
or copyright violations are happening all the time.
Someone sees something on the internet,
they copy and they paste it into their document.
They don't give attribution.
There's no compensation back to the, you know,
the author who might've written that.
And there we have a copyright violation.
Or bringing down a song that you're supposed to pay for.
You know, music you're supposed to pay for and you don't.
That's a copyright violation.
You know, downloading a picture that is copyrighted
and you're supposed to be, you know,
paying rights or royalties to use it.
But instead, you just download it and use it.
That's a copyright violation.
Now copyrights might say copyright
on the bottom of a document.
If a copyright has been registered with a government agency,
you'll see it in the letter C with a circle around it.
So patents, trademarks and copyrights
are all information that's out in the public domain.
We can all see it.
There's nothing secretive about it, right?
The protection really deals with how we use it.
Trade secrets are the opposite.
Trade secrets refer to proprietary business
and technical information or processes or designs
or practices that are confidential
and critical to a business.
So they are not exposed.
And if they were exposed or compromised,
it would really be detrimental to the organization.
So trade secrets,
we're really trying to keep this information secret.
But if there's ever a civil dispute
and you go to court, you know, the judge is gonna say,
"Okay, tell me all the things you did
to keep that trade secret, well, secret."
And if you can't show that you've done
a lot of work to keep it secret,
well, then the judge just might rule
that it's just not a trade secret.
Another type of intellectual property
that you'll be interacting with is software.
And there are different types of software.
Freeware, shareware, open source,
and what's known as COTS,
or Commercial Off the Shelf software.
I'm gonna talk about what each one of these are.
How do you know what type of software it is?
Well, it's always going to be clearly defined in the EULA.
That's a software End User Licensing Agreement.
So freeware is gonna be copyrighted software
that's available at no cost for unlimited usage,
but the developer retains all rights to the program
and controls distribution.
Shareware is also copyrighted software
that is available at no cost for unlimited usage.
Users are encouraged, though, to share the software
to promote a larger distribution and sales.
Open source is where the copyright holder
grants the users the right to use, to study,
to change or modify, and distribute the software
to anyone for any purpose.
And lastly, COTS or Commercial Off the Shelf software.
COTS is copyrighted software
that a company designs and develops to sell a license
and the company retains all rights of the program
and the company controls distribution.
And then we have this really new one
called AI-generated intellectual property.
And this is a fascinating area.
So you use GPT Chat or another program.
Is that copyrighted?
Is that intellectual property?
How do we handle that?
Well, this past March, on March 15th, 2023,
the U.S. Copyright Office announced
that works created with the assistance
of artificial intelligence or AI may be copyrightable,
provided the work involves sufficient human authorship.
Now according to the policy statement,
works created by AI without human intervention
or involvement still cannot be copyrighted
as they fail to meet the human authorship requirement.
So this is really interesting.
There's this long debate that's gonna go on, right,
about what can be copyrighted and what can't
once we have AI in the mix.
And this was the U.S. Copyrights Office
first ever formal guidance on the issue.
So stay tuned.
I know that there'll be a lot more coming.
Next, let's look at a contractual obligation example.
So you may have data in your possession
that you are contractually obligated to protect.
A very common contractual obligation
is being obligated to comply with PCIDSS.
That stands with Payment Card Industry
Data Security Standard.
And this is going to apply to anyone
who accepts credit cards, processes credit cards,
distributes credit cards, right?
If and you touch credit cards
or debit cards in any way, right?
You have a PCIDSS obligation.
Now it's a contractual obligation, again,
for any entity that accepts, processes, transmits,
or stores payment cardholder data.
The dual objectives of PCIDSS are to protect cardholders
against misuse of their personal information
and to minimize the payment card channel losses.
Now the PCIDSS framework includes stipulations
regarding storage, transmission,
and processing of payment card data.
And the PCIDSS standard includes six core principles,
12 categories of required technical
and operational security controls
and testing requirements, as well as a validation
and a certification process.
So knowing the type of data you have is really important
because is this data that's PI or PII?
Is this data that's under a regulatory requirement?
Is this contractual obligation, right?
Is this intellectual property?
Understanding the types
of data you have in your organization
and then understanding what your requirements
and obligations are is absolutely critical
to appropriately and properly protecting that data.
And that, my friends, brings us to a three-second challenge.
Five challenge questions, three seconds each.
You know how to do it.
Number one, the power or right of a legal
or political agency to exercise its authority
over a person's subject matter or territory.
One, two, three.
That is jurisdiction.
Number two, the objective of this regulation
is to protect people in the EU and EEA
from unlawful data collection and processing.
One, two, three.
It's gonna be GDPR.
Number three.
This IP protection is intended to allow the creator
of certain types of original works to benefit
from being created and compensated for their work.
One, two, three.
And that's gonna be copyright.
Number four.
This type of software license grants users
the rights to use to study, to change,
and to distribute the software to anyone for any purpose.
One, two, three.
That's gonna be open source.
And lastly, number five.
This type of data can be used
to identify a specific individual.
One, two, three.
You got it?
That's gonna be personally identifiable information, PII,
sometimes referred to as personal information, PI.
Let's do a security in action about compliance.
You've just been hired as a CISO, good job,
for Health for Life, HFL.
Now one of the services that HFL provides
is personalized weight loss programs
through their web portal.
HFL serves patients from multiple countries.
HFL collects health, demographic, statistical,
and personally identifiable information, PII,
from program enrollees.
Now the program payment is by credit card.
Now HFL has been so focused on its mission, right?
The personalized weight loss programs
that it hasn't dedicated any resources to compliance.
And now that's your responsibility.
So where do you start?
So what do we have here?
While they provide personalized weight loss
through a web portal,
they serve patients from multiple countries.
They collect health, demographic, statistical,
and personally identifiable information
from their enrollees.
And payment is by credit card.
And they haven't really paid any attention to compliance.
And now they're saying, "Okay, we just brought you in.
Help us with compliance."
Where are you gonna start?
So go ahead and put me on pause, jot down some notes,
come on back, and we'll talk through an action plan.
Well, the first thing we wanna do is identify,
specifically, what information, right?
What data set is collected and why we're collecting it?
Remember, earlier when we talked about privacy,
we said one of the things that we wanna make sure
is we're not collecting anything that we don't need.
And we're always specifying the reason, right,
at the time of collection.
So we wanna look at what data sets are being collected
and why they're being collected.
And if it's not necessary, let's not collect it.
And then we wanna identify all locations
where the information is stored, processed,
and transmitted, including third parties.
We wanna identify everywhere where the enrollees live,
so the enrollee jurisdiction.
So again, what are all of the different countries
that we have patients in that we're serving?
And then we're going to identify the corresponding legal,
regulatory, and contractual obligations.
And at that point, then we can begin the process
of cross-referencing compliance requirements
with our current controls and processes,
and determine what it is we need to do.
But we can't just start with putting controls in place
because we really have to start
with what do we have and why do we have it?
Where is it?
You know, where do our enrollees, right, live?
What are all the corresponding legal regulatory
and contractual obligations?
And there's gonna be a lot of them here.
And then we can figure out, okay, what do we need to do?
And being able to develop this action plan
and then execute on an action plan like this
is definitely security in action.
Wow, that's a big word cloud, you know what to do.
When you're ready, I'll see you the next lesson.