- In this lesson, 21.5, we're gonna focus
on disclosure if there is an incident and notification.
Now, a data breach is an incident
where unauthorized individuals or entities gain access
to legally protected or confidential information stored
by an organization resulting in potential misuse, loss,
theft, or exposure of that data.
Now, specific types of information compromised
in a data breach can vary depending upon the industry,
the organization, and the attacker's objectives.
So examples include personally identifiable information
or PII, login credentials, government records,
payment card information, PCI, personal health information,
PHI, trade secrets or intellectual property.
Now, a security incident is also considered a data breach
if there is a loss of control of the system
that the data is stored upon.
Now, the dark web is part of the internet that's not indexed
by search engines, and it's known for its anonymity.
That compromised data often ends up on the dark web
after a data breach occurs.
The dark web hosts various illicit marketplaces
and forms where stolen data is bought, sold, and exchanged.
These marketplaces provide a platform for cyber criminals
to profit from the data obtained through data breaches.
Now, they may offer databases of compromised information
or sell individual records to interested buyers.
So let's say you've had a data breach.
What do you do, do you have to disclose
that you've had a data breach?
Do you have to notify impacted individuals?
Well, it's going to depend.
It's going to depend on one, your jurisdiction.
And as a refresher, jurisdiction is an area
of legal authority.
In relation to cyber, jurisdiction pertains to the location
of the data and systems in all its forms,
processing, transmission, and storage,
the residence of the data owners, the type of data,
and the residence of the data subjects.
Now, jurisdictional requirements
may necessitate disclosure and notification.
And disclosure is a requirement to reveal a situation.
Notification is the actual act
of informing affected parties.
Now, the purpose of disclosure and notification
is to inform others of potential risk
so they can make informed decisions
and take appropriate action.
Organizations have an obligation to comply
with regulatory and contractual requirements.
Now, here in the US, all states and territories
have enacted data breach notification legislation.
We don't have one at the national level.
Each one of our states and each
of our territories have all enacted
their own data breach notification legislation.
And what's crazy is that many
of them conflict with each other.
At the federal level,
we have some sector-specific security legislation.
So for example, Gramm-Leach-Bliley, GLBA,
and HIPAA have risk assessment
and breach notification requirements,
GLBA for a breach of financial information,
HIPAA for a breach of healthcare information.
Now, the EU/EEA GDPR,
that's General Data Protection Regulation,
has very, very stringent breach disclosure
and notification requirements.
The Payment Card Industry Data Security Standard,
PCI-DSS, has breach notification requirements,
so if you handle credit cards,
you are responsible to comply with that.
And then you just may have other contractual obligations
that have notification requirements.
Now, aside from notifying from a regulatory perspective,
you may also wanna share information
with other trusted parties.
So information sharing describes a means
of conveying information or experience
from one trusted party to another.
In the US, we have what's known as ISACs,
Information Sharing and Analysis Centers.
And those are trusted sector-specific entities
that facilitate sector-specific
and/or geographic specific information sharing
about vulnerabilities, threats,
and incidents including data breaches.
Now, there are 20 plus ISACs that range
from an aviation ISAC to a water ISAC,
and if you wanna learn more about them,
you can go out to nationalisacs.org.
They're industry-specific, but they also have some
that are geographically-specific.
Now, ISACs, government and agencies
and industry actually uses STIX and TAXII,
we're gonna talk about those in just a second,
to facilitate the exchange and the sharing
of threat intelligence information.
Now, you may not wanna share the specifics
of the data that may have been breached,
but what you may wanna be sharing, right,
is how did it happen, what happened?
What do you see for indicators of compromise?
What do you see for indicators of attack?
All of that is great information
to share in a trusted forum.
So STIX is Structured Threat Information Expression
and TAXII is Trusted Automation Exchange
of Intelligence Information.
So these are two components
of automated information sharing.
STIX is the standardized language developed by MITRE
and the OASIS Cyber Threat Intelligence, or CTI,
technical committee for describing cyber threat information.
STIX is structured to describe a threat in terms
of motivations, abilities, capabilities, and response.
Where TAXII defines how cyber threat information
can be shared via services and message exchanges
by defining an API, an application programming interface.
And it's designed to specifically
to support STIX information.
And there are three principle models in TAXII
which include hub and spoke, where there's one repository
of information, source and subscriber,
where we have a single source of information,
and peer-to-peer, we have multiple groups share information.
If you have a data breach
or before you share information even with trusted parties,
you may wanna consider working with legal counsel.
And there are several scenarios
that consulting with legal counsel before acting
is really, really highly recommended.
So if there's a possibility that legally
or contractually protected information has been exposed
or compromised, call legal counsel.
If there's a potential violation
of a contract or a legal agreement,
including internal negligence, call legal counsel.
if there is potential downstream liability,
what do we mean by downstream liability?
Downstream liability is a responsibility for damages
that result from a security compromise in your business.
You're gonna wanna call legal counsel.
if you get notification from a third party service provider
or from a customer that they've experienced an incident,
call legal counsel.
And if you've been contacted by
or you plan to contact law enforcement,
definitely you want to contact legal counsel.
Now, you wanna make sure
that you're contacting legal counsel
who has expertise in security and specifically
in data breach notification and disclosure.
There may be scenarios where you need to work
with law enforcement, but bear in mind
that the primary focus of law enforcement is to identify,
catch, and prosecute criminals.
They probably won't get your data back or, you know,
deal with the extortion demand in itself, right,
they're looking to identify, catch, and prosecute criminals.
Now, while generally helpful, right, they have no obligation
to recover that stolen funds or property.
You do wanna consult in with legal counsel
before calling law enforcement.
Once you contact them, they can confiscate
what they will call crime scene evidence.
That means they can take a drive, they can take a machine,
they can take a device, they can take a router,
they can take control of your server room.
And they also may ask you to allow an attack,
if you're under an attack, to continue
while they investigate.
But unless court-ordered,
you do not have to comply with this request.
And here's the last thing you need to keep in mind.
They have no obligation to keep you updated
on their investigation, and in my experience,
they probably won't.
All right, that, my friends,
brings us to a three-second challenge,
five challenge questions, three seconds each, let's do it.
Incident that results in the disclosure
of data or loss of control.
One, two, three.
It's gonna be a data breach.
Number two, an area of legal authority.
One, two, three.
Jurisdiction.
Number three, the EU/EEA regulation
that has very stringent breach disclosures
and notification requirements.
One, two, three.
That's gonna be GDPR.
Number four, a trusted sector-specific entity
that facilitates information sharing
about vulnerabilities, threats, and incidents.
One, two, three.
That's gonna be an ISAC.
And lastly, number five, standardized language developed
for describing cyber threat information.
One, two, three.
And that's gonna be STIX.
All right, let's do a security-in-action
about a data breach.
You just received a call from your very panicked boss.
She just got off the phone with an investigative journalist
who informed her that there is a cache
of your organization's customer information
for sale on the dark web.
He sends her a snippet as evidence.
She's asking you what should she do.
So what are your recommendations?
So your boss just calls you really, really panicked.
Just heard from an investigative journalist
who said that there's a cache
of your organization's customer information
for sale on the web.
And to prove it, he sends her a snippet of evidence.
And she goes to you and it's like,
oh my God, what should I do?
So the question for you is, what are your recommendations?
Go ahead and put me on pause, jot some recommendations down,
then come on back.
Well, the very first action should be to inform
and involve executive management.
I don't know how far down or up the chain your boss is
or you are, but we wanna go right to the top.
We're gonna inform and involve executive management
and probably the board of directors as well.
Now, executive management should reach out
to legal counsel for guidance, always a great first step.
It's then time to activate your incident response plan,
right, including how you interact with law enforcements,
'cause you're gonna wanna contact law enforcement,
and your crisis communication plan.
How are you gonna be talking about this both internally
and externally?
In best case, you have prepared
for disclosure notification by already understanding all
of your applicable jurisdictions,
that you've done a massive whiteboard
and you understand all the jurisdictions that apply to you
as well as all of your compliance requirements.
And then lastly, you might wanna consider
sharing threat intelligence about your attack
with applicable agencies and trusted organizations.
There's your word cloud. Boy, there's a lot here.
Make sure that you know, right, all of these terms,
all of the concepts, you can speak to them,
you can explain them, you're comfortable with them.
And then when you're ready, you're confident, right,
you're ready to go.
Next, we're gonna do a 10-question quiz.
I'll see you there.