1 1 00:00:00,240 --> 00:00:02,520 Data criticality. 2 2 00:00:02,520 --> 00:00:05,520 Data criticality is extremely important to think about 3 3 00:00:05,520 --> 00:00:08,250 all the way back in your preparation phase. 4 4 00:00:08,250 --> 00:00:09,330 This is going to affect 5 5 00:00:09,330 --> 00:00:11,010 your different standard operating procedures 6 6 00:00:11,010 --> 00:00:12,000 and your playbooks 7 7 00:00:12,000 --> 00:00:14,760 as well as your incident response plans overall. 8 8 00:00:14,760 --> 00:00:16,830 Now, the reason this is so important is because 9 9 00:00:16,830 --> 00:00:18,900 everything we deal with is really concerned 10 10 00:00:18,900 --> 00:00:21,180 with the data on those systems. 11 11 00:00:21,180 --> 00:00:22,410 When I'm looking at a system, 12 12 00:00:22,410 --> 00:00:24,960 I don't really care that this server or that server 13 13 00:00:24,960 --> 00:00:26,610 has been attacked by a hacker 14 14 00:00:26,610 --> 00:00:30,060 but I do care what information on those systems is there 15 15 00:00:30,060 --> 00:00:32,340 that could have been accessed by those attackers. 16 16 00:00:32,340 --> 00:00:34,890 And data criticality helps me prioritize 17 17 00:00:34,890 --> 00:00:37,110 what response I'm going to do. 18 18 00:00:37,110 --> 00:00:38,370 This is extremely important 19 19 00:00:38,370 --> 00:00:40,230 because I don't have enough resources 20 20 00:00:40,230 --> 00:00:42,750 to protect everything all of the time. 21 21 00:00:42,750 --> 00:00:45,420 Instead, I have to allocate my resources 22 22 00:00:45,420 --> 00:00:47,010 and so things that are more important 23 23 00:00:47,010 --> 00:00:49,320 or have a higher criticality are going to be things 24 24 00:00:49,320 --> 00:00:51,270 I spend more money protecting 25 25 00:00:51,270 --> 00:00:52,950 and the things that I don't care about as much 26 26 00:00:52,950 --> 00:00:55,440 I'm going to spend less time and money protecting. 27 27 00:00:55,440 --> 00:00:58,140 This is the whole idea of allocating our resources. 28 28 00:00:58,140 --> 00:01:00,240 Now, this becomes extremely important 29 29 00:01:00,240 --> 00:01:02,010 when you're dealing with a data breach. 30 30 00:01:02,010 --> 00:01:04,140 Depending on what type of data you're dealing with, 31 31 00:01:04,140 --> 00:01:05,430 you're going to spend more money 32 32 00:01:05,430 --> 00:01:08,070 and more resources cleaning up that mess. 33 33 00:01:08,070 --> 00:01:10,050 For example, if a data breach involves 34 34 00:01:10,050 --> 00:01:12,930 private or confidential data, this is going to take priority 35 35 00:01:12,930 --> 00:01:15,240 over all the other incidents you have 36 36 00:01:15,240 --> 00:01:17,040 because here's the sad truth. 37 37 00:01:17,040 --> 00:01:19,020 When you look at a big organization, 38 38 00:01:19,020 --> 00:01:20,760 they are getting attacked constantly 39 39 00:01:20,760 --> 00:01:22,650 by attackers and hackers. 40 40 00:01:22,650 --> 00:01:24,120 Now, they stop a lot of the attacks 41 41 00:01:24,120 --> 00:01:25,770 but some are going to get through, 42 42 00:01:25,770 --> 00:01:27,900 and so one of the things they have to do is triage 43 43 00:01:27,900 --> 00:01:29,280 and prioritize and figure out 44 44 00:01:29,280 --> 00:01:31,230 where they're going to spend their time and money 45 45 00:01:31,230 --> 00:01:33,240 to fix things and stop things 46 46 00:01:33,240 --> 00:01:35,640 and then recover from these different attacks. 47 47 00:01:35,640 --> 00:01:37,290 Depending on that data criticality. 48 48 00:01:37,290 --> 00:01:39,300 This is going to make a difference. 49 49 00:01:39,300 --> 00:01:40,830 Now, when we start looking at this, 50 50 00:01:40,830 --> 00:01:43,920 we're going to talk about a bunch of different types of data. 51 51 00:01:43,920 --> 00:01:47,880 We have things like PII and SPI and PHI 52 52 00:01:47,880 --> 00:01:50,700 and financial information and intellectual property 53 53 00:01:50,700 --> 00:01:54,030 and corporate information and high value assets. 54 54 00:01:54,030 --> 00:01:55,740 In this lesson, we're going to talk about 55 55 00:01:55,740 --> 00:01:58,230 each of these seven types of data criticality 56 56 00:01:58,230 --> 00:02:00,210 and how we can categorize them. 57 57 00:02:00,210 --> 00:02:02,070 Let's start with PII. 58 58 00:02:02,070 --> 00:02:05,520 PII is personally identifiable information. 59 59 00:02:05,520 --> 00:02:08,580 This is data that can be used to identify, contact 60 60 00:02:08,580 --> 00:02:10,740 or impersonate an individual. 61 61 00:02:10,740 --> 00:02:11,753 Now, when you're dealing with PII, 62 62 00:02:11,753 --> 00:02:14,430 this is information like a birthday, 63 63 00:02:14,430 --> 00:02:18,420 a social security number, a place of birth, your full name, 64 64 00:02:18,420 --> 00:02:21,750 your biometric ID like your fingerprint or your retina scan. 65 65 00:02:21,750 --> 00:02:25,110 All of this is data that identifies you personally. 66 66 00:02:25,110 --> 00:02:27,480 As an attacker if I can get this data, 67 67 00:02:27,480 --> 00:02:29,820 I can identify you as an individual, 68 68 00:02:29,820 --> 00:02:30,780 and that's why we call it 69 69 00:02:30,780 --> 00:02:33,180 personally identifiable information. 70 70 00:02:33,180 --> 00:02:35,760 This data can be combined with things like IP addresses 71 71 00:02:35,760 --> 00:02:38,640 and geolocation data, and then we can actually target you, 72 72 00:02:38,640 --> 00:02:40,740 physically in the real world too. 73 73 00:02:40,740 --> 00:02:42,840 So this is a big area of concern for us, 74 74 00:02:42,840 --> 00:02:46,440 and so PII is one of the most common data criticality issues 75 75 00:02:46,440 --> 00:02:47,610 that you're going to be faced with 76 76 00:02:47,610 --> 00:02:49,050 and that you're going to be trying to protect 77 77 00:02:49,050 --> 00:02:50,820 as an organization. 78 78 00:02:50,820 --> 00:02:55,230 Next, we have SPI, which is sensitive personal information. 79 79 00:02:55,230 --> 00:02:57,600 Sensitive personal information is information 80 80 00:02:57,600 --> 00:03:01,140 about a person or subject's opinions, beliefs and nature 81 81 00:03:01,140 --> 00:03:03,240 that's afforded specially protected status 82 82 00:03:03,240 --> 00:03:05,280 by privacy legislation. 83 83 00:03:05,280 --> 00:03:07,470 When we talk about privacy legislation here, 84 84 00:03:07,470 --> 00:03:09,390 we're talking about things like GDPR, 85 85 00:03:09,390 --> 00:03:11,760 the general data privacy regulation 86 86 00:03:11,760 --> 00:03:13,680 and its definition of SPI includes things 87 87 00:03:13,680 --> 00:03:15,990 like religious belief, political opinions, 88 88 00:03:15,990 --> 00:03:19,380 trade union membership, gender, sexual orientation, 89 89 00:03:19,380 --> 00:03:20,820 racial and ethnic origin, 90 90 00:03:20,820 --> 00:03:23,340 genetic data and health information. 91 91 00:03:23,340 --> 00:03:26,100 All of this is data that needs to be protected. 92 92 00:03:26,100 --> 00:03:29,010 Now in the US, we don't have an overarching definition 93 93 00:03:29,010 --> 00:03:31,770 of SPI or privacy regulation for it 94 94 00:03:31,770 --> 00:03:33,600 but certain parts of this we do. 95 95 00:03:33,600 --> 00:03:35,550 For instance, health information is one 96 96 00:03:35,550 --> 00:03:38,460 that we actually cover in the United States under HIPAA 97 97 00:03:38,460 --> 00:03:40,650 and this can bring us to our next category 98 98 00:03:40,650 --> 00:03:44,310 which is PHI, which is personal health information. 99 99 00:03:44,310 --> 00:03:45,450 Now, this is information 100 100 00:03:45,450 --> 00:03:48,270 that identifies somebody as a subject of a medical record, 101 101 00:03:48,270 --> 00:03:50,340 insurance record, hospital results 102 102 00:03:50,340 --> 00:03:52,410 or laboratory test results. 103 103 00:03:52,410 --> 00:03:54,540 Essentially, it's anything that has to do 104 104 00:03:54,540 --> 00:03:56,790 with your health or your body. 105 105 00:03:56,790 --> 00:03:58,410 Now, when we're dealing with PHI, 106 106 00:03:58,410 --> 00:04:00,870 you may hear this called personal health information 107 107 00:04:00,870 --> 00:04:02,910 or protected health information. 108 108 00:04:02,910 --> 00:04:04,800 Both those acronyms are used. 109 109 00:04:04,800 --> 00:04:07,440 But anytime you see PHI, I just want you to remember 110 110 00:04:07,440 --> 00:04:09,540 we're talking about healthcare information here 111 111 00:04:09,540 --> 00:04:11,760 and this is protected by HIPAA. 112 112 00:04:11,760 --> 00:04:13,830 Now, when you're dealing with this health information, 113 113 00:04:13,830 --> 00:04:16,680 sometimes this information can be sent around 114 114 00:04:16,680 --> 00:04:18,270 and used in other places. 115 115 00:04:18,270 --> 00:04:22,110 For example, you can anonymize or de-identify the data set 116 116 00:04:22,110 --> 00:04:23,580 based on the data that's there 117 117 00:04:23,580 --> 00:04:26,040 by removing the identifying information 118 118 00:04:26,040 --> 00:04:28,050 and a lot of times companies will do this. 119 119 00:04:28,050 --> 00:04:31,260 For example, if you have a fitness tracker in your watch, 120 120 00:04:31,260 --> 00:04:32,520 you can actually use that data. 121 121 00:04:32,520 --> 00:04:34,020 It is considered PHI 122 122 00:04:34,020 --> 00:04:36,180 because it's taking things like your heart rate, 123 123 00:04:36,180 --> 00:04:37,860 your breathing and respiration. 124 124 00:04:37,860 --> 00:04:40,590 Some of these watches can even test your oxygen levels. 125 125 00:04:40,590 --> 00:04:43,110 All of that is health data and health records 126 126 00:04:43,110 --> 00:04:45,750 and so it should be protected as PHI. 127 127 00:04:45,750 --> 00:04:47,880 Now, if that company wants to sell that data, 128 128 00:04:47,880 --> 00:04:51,240 they can do this through de-identification or anonymization. 129 129 00:04:51,240 --> 00:04:52,740 Essentially, they take out everything 130 130 00:04:52,740 --> 00:04:54,750 that identifies it with you and says, 131 131 00:04:54,750 --> 00:04:58,800 we have 50 people who are all between 50 and 60 years old, 132 132 00:04:58,800 --> 00:05:00,750 and their average heart rate is this. 133 133 00:05:00,750 --> 00:05:02,790 That would be an anonymized data set 134 134 00:05:02,790 --> 00:05:04,740 that they can then give to researchers and others 135 135 00:05:04,740 --> 00:05:06,750 who need that type of information. 136 136 00:05:06,750 --> 00:05:10,650 Now, PHI is also valuable to attackers, and why is that? 137 137 00:05:10,650 --> 00:05:12,570 Well, because there's a high value for it 138 138 00:05:12,570 --> 00:05:14,010 on the black market. 139 139 00:05:14,010 --> 00:05:15,510 The reason for this is because 140 140 00:05:15,510 --> 00:05:18,060 these criminals can actually exploit that dataset 141 141 00:05:18,060 --> 00:05:20,220 and use it to commit insurance fraud. 142 142 00:05:20,220 --> 00:05:22,500 Unlike a credit card number or a bank number, 143 143 00:05:22,500 --> 00:05:24,150 when this information is out there, 144 144 00:05:24,150 --> 00:05:27,510 it uniquely identifies you based on your biometrics 145 145 00:05:27,510 --> 00:05:28,343 and because of that, 146 146 00:05:28,343 --> 00:05:30,180 it can be used for a lot of different things 147 147 00:05:30,180 --> 00:05:31,980 including fraud and blackmail. 148 148 00:05:31,980 --> 00:05:32,970 And so this is something 149 149 00:05:32,970 --> 00:05:34,530 that we really have to be concerned with, 150 150 00:05:34,530 --> 00:05:37,020 especially if we're in an industry or an organization 151 151 00:05:37,020 --> 00:05:39,690 that maintains this type of information. 152 152 00:05:39,690 --> 00:05:42,690 Our next category of data is financial information. 153 153 00:05:42,690 --> 00:05:44,760 This is data that's stored about bank accounts, 154 154 00:05:44,760 --> 00:05:47,010 investment accounts, payroll accounts, 155 155 00:05:47,010 --> 00:05:49,020 tax returns, credit card data 156 156 00:05:49,020 --> 00:05:51,750 and other data about commercial transactions. 157 157 00:05:51,750 --> 00:05:54,510 All of this is basically information about money 158 158 00:05:54,510 --> 00:05:56,640 and it's worth money, and so because of that, 159 159 00:05:56,640 --> 00:05:58,620 it is is always coming under attack. 160 160 00:05:58,620 --> 00:06:01,170 If your organization accepts credit card payments, 161 161 00:06:01,170 --> 00:06:03,900 you probably follow the PCI DSS standard 162 162 00:06:03,900 --> 00:06:07,170 which is the payment card industry data security standard. 163 163 00:06:07,170 --> 00:06:08,760 This defines the safe handling 164 164 00:06:08,760 --> 00:06:11,160 and storage of payment card data 165 165 00:06:11,160 --> 00:06:12,630 because you're dealing with credit cards 166 166 00:06:12,630 --> 00:06:14,730 and credit cards can be used to buy things, 167 167 00:06:14,730 --> 00:06:16,860 this data comes under attack a lot 168 168 00:06:16,860 --> 00:06:18,210 and so you really need to make sure 169 169 00:06:18,210 --> 00:06:21,150 you're protecting it the way it needs to be protected. 170 170 00:06:21,150 --> 00:06:24,480 The next category of data criticality refers to information 171 171 00:06:24,480 --> 00:06:26,340 about intellectual property. 172 172 00:06:26,340 --> 00:06:28,740 This is information that's created by an organization 173 173 00:06:28,740 --> 00:06:30,450 usually about the products or services 174 174 00:06:30,450 --> 00:06:32,310 that it makes or provides. 175 175 00:06:32,310 --> 00:06:33,870 Now, there is lots of different types 176 176 00:06:33,870 --> 00:06:35,340 of intellectual property. 177 177 00:06:35,340 --> 00:06:37,350 This includes things that can be copyrighted, 178 178 00:06:37,350 --> 00:06:39,840 things that can be patented, things that can be trademarked 179 179 00:06:39,840 --> 00:06:41,850 or things that are trade secrets. 180 180 00:06:41,850 --> 00:06:44,670 All of these can be a type of intellectual property 181 181 00:06:44,670 --> 00:06:47,310 and they all have value to your organization. 182 182 00:06:47,310 --> 00:06:49,710 For example, one of the largest trade secrets 183 183 00:06:49,710 --> 00:06:52,620 has been kept for decades is the original recipe 184 184 00:06:52,620 --> 00:06:55,890 of 11 herbs and spices for KFC's chicken. 185 185 00:06:55,890 --> 00:06:57,600 Now, this is a famous trade secret 186 186 00:06:57,600 --> 00:07:01,980 because Colonel Sanders has kept it secret since the 1930s. 187 187 00:07:01,980 --> 00:07:04,230 This recipe has never been patented. 188 188 00:07:04,230 --> 00:07:05,063 Why? 189 189 00:07:05,063 --> 00:07:06,390 Because when you patent something, 190 190 00:07:06,390 --> 00:07:10,080 you have to put the details of what it is inside that patent 191 191 00:07:10,080 --> 00:07:12,150 and there's an expiration date to it. 192 192 00:07:12,150 --> 00:07:14,640 So instead, they've held it as a trade secret 193 193 00:07:14,640 --> 00:07:17,640 because that means it remains its intellectual property 194 194 00:07:17,640 --> 00:07:21,480 and they can hold onto it in perpetuity, meaning forever. 195 195 00:07:21,480 --> 00:07:24,030 Now, they have taken special precautions to make sure 196 196 00:07:24,030 --> 00:07:26,640 that their recipe for these 11 herbs and spices 197 197 00:07:26,640 --> 00:07:28,350 are maintained secret. 198 198 00:07:28,350 --> 00:07:30,960 In fact, when they produce it for their restaurants, 199 199 00:07:30,960 --> 00:07:33,480 half of it is produced by one laboratory 200 200 00:07:33,480 --> 00:07:36,090 and the other half is produced by another laboratory 201 201 00:07:36,090 --> 00:07:39,510 and they are then delivered and combined by the restaurants. 202 202 00:07:39,510 --> 00:07:42,540 This is how far they go to protect this trade secret. 203 203 00:07:42,540 --> 00:07:44,760 So do you think they want to have this on a computer system 204 204 00:07:44,760 --> 00:07:46,260 that a hacker can get into? 205 205 00:07:46,260 --> 00:07:47,310 Of course not. 206 206 00:07:47,310 --> 00:07:49,050 And so these are the type of things you have to think about 207 207 00:07:49,050 --> 00:07:51,180 when you're dealing with intellectual property. 208 208 00:07:51,180 --> 00:07:53,430 Let me give you another example of intellectual property. 209 209 00:07:53,430 --> 00:07:55,020 This is one from my own company. 210 210 00:07:55,020 --> 00:07:56,310 We have video courses 211 211 00:07:56,310 --> 00:07:58,080 just like the one you're watching right now. 212 212 00:07:58,080 --> 00:08:00,330 These are intellectual property of my company, 213 213 00:08:00,330 --> 00:08:01,590 Dion Training. 214 214 00:08:01,590 --> 00:08:03,990 Now, one of the reasons these videos can't be downloaded 215 215 00:08:03,990 --> 00:08:06,210 on a lot of different systems is because 216 216 00:08:06,210 --> 00:08:08,220 we have to protect our intellectual property, 217 217 00:08:08,220 --> 00:08:10,770 and so our licensing agreements have it set up 218 218 00:08:10,770 --> 00:08:13,020 so that if you're watching this video on a site, 219 219 00:08:13,020 --> 00:08:14,820 it either has to be streamed to you 220 220 00:08:14,820 --> 00:08:16,440 or if they're going to allow downloads, 221 221 00:08:16,440 --> 00:08:19,050 they have to have it inside a closed experience, 222 222 00:08:19,050 --> 00:08:21,150 like a mobile app where you can download it 223 223 00:08:21,150 --> 00:08:23,820 and it's encrypted and uses digital rights management. 224 224 00:08:23,820 --> 00:08:26,160 This helps protect our intellectual property 225 225 00:08:26,160 --> 00:08:28,380 and tries to keep our videos from getting out there 226 226 00:08:28,380 --> 00:08:31,290 into the wild so that it's not on pirate sites. 227 227 00:08:31,290 --> 00:08:32,970 Now, when they're found on pirate sites, 228 228 00:08:32,970 --> 00:08:34,470 those videos are then taken down 229 229 00:08:34,470 --> 00:08:36,150 because they're breaking our copyright 230 230 00:08:36,150 --> 00:08:38,250 which is a form of intellectual property. 231 231 00:08:38,250 --> 00:08:41,520 For us, our intellectual property is the product we make. 232 232 00:08:41,520 --> 00:08:43,740 It's the videos that you're watching right now. 233 233 00:08:43,740 --> 00:08:45,780 For Colonel Sanders and KFC, 234 234 00:08:45,780 --> 00:08:47,730 their intellectual property is just one component 235 235 00:08:47,730 --> 00:08:49,200 of the overall product they make, 236 236 00:08:49,200 --> 00:08:51,090 which is their delicious chicken. 237 237 00:08:51,090 --> 00:08:53,430 Similarly, when you take a CompTIA exam, 238 238 00:08:53,430 --> 00:08:55,380 the questions on that exam itself 239 239 00:08:55,380 --> 00:08:57,180 are considered intellectual property 240 240 00:08:57,180 --> 00:08:59,550 and they are copyrighted by CompTIA. 241 241 00:08:59,550 --> 00:09:02,040 They work really hard to protect those exam questions 242 242 00:09:02,040 --> 00:09:04,200 from being released to the general public. 243 243 00:09:04,200 --> 00:09:06,840 This is why brain dump sites are constantly being sued 244 244 00:09:06,840 --> 00:09:08,850 and being forced to take those things down 245 245 00:09:08,850 --> 00:09:09,870 because they're infringing 246 246 00:09:09,870 --> 00:09:11,790 on CompTIA's copyrighted materials 247 247 00:09:11,790 --> 00:09:13,890 which are a form of intellectual property. 248 248 00:09:13,890 --> 00:09:15,360 When you take your exam, 249 249 00:09:15,360 --> 00:09:17,910 you can choose whether to take it at a local testing center 250 250 00:09:17,910 --> 00:09:20,010 where a proctor's going to ensure you aren't cheating 251 251 00:09:20,010 --> 00:09:21,630 and you're not copying down the questions 252 252 00:09:21,630 --> 00:09:23,310 to try to take them home with you, 253 253 00:09:23,310 --> 00:09:24,990 or you could take it online. 254 254 00:09:24,990 --> 00:09:26,100 If you take it online, 255 255 00:09:26,100 --> 00:09:28,920 you're using the OnView proctor service, and again, 256 256 00:09:28,920 --> 00:09:31,860 you're being watched over your webcam during the exam 257 257 00:09:31,860 --> 00:09:33,780 to ensure the integrity of that exam 258 258 00:09:33,780 --> 00:09:36,483 and the protection of CompTIA's intellectual property. 259 259 00:09:37,440 --> 00:09:39,120 The six type of information we have 260 260 00:09:39,120 --> 00:09:40,830 is corporate information. 261 261 00:09:40,830 --> 00:09:42,510 Now, this type of information contains 262 262 00:09:42,510 --> 00:09:44,700 confidential data owned by a company 263 263 00:09:44,700 --> 00:09:47,700 such as products, sales, marketing, legal 264 264 00:09:47,700 --> 00:09:49,710 and contract information. 265 265 00:09:49,710 --> 00:09:52,260 Now, this type of information is very important 266 266 00:09:52,260 --> 00:09:55,320 but it's not the same as intellectual property. 267 267 00:09:55,320 --> 00:09:57,600 For example, when you're dealing with corporate information, 268 268 00:09:57,600 --> 00:10:00,360 you're talking about things like profit and cash flow 269 269 00:10:00,360 --> 00:10:03,840 and salaries and market shares and key customers. 270 270 00:10:03,840 --> 00:10:07,260 All of this could be of interest to a company's competitors 271 271 00:10:07,260 --> 00:10:10,350 but it is not the actual intellectual property itself. 272 272 00:10:10,350 --> 00:10:13,080 It's just proprietary corporate information. 273 273 00:10:13,080 --> 00:10:17,040 For example, my videos are considered intellectual property 274 274 00:10:17,040 --> 00:10:19,470 but the information about how many videos we sell 275 275 00:10:19,470 --> 00:10:21,990 and how many students we have and how much profit we made 276 276 00:10:21,990 --> 00:10:23,820 that is corporate information. 277 277 00:10:23,820 --> 00:10:25,740 So hopefully, that helps you understand the distinction 278 278 00:10:25,740 --> 00:10:26,820 between the two. 279 279 00:10:26,820 --> 00:10:29,400 Now, a great example of a leak of corporate information 280 280 00:10:29,400 --> 00:10:32,880 actually happened just last week as I'm writing this lesson. 281 281 00:10:32,880 --> 00:10:35,610 Now, Kodak, which used to be a big filmmaker, 282 282 00:10:35,610 --> 00:10:38,790 actually was receiving a contract from the US government 283 283 00:10:38,790 --> 00:10:41,070 to help become a chemical manufacturer 284 284 00:10:41,070 --> 00:10:44,250 to be able to help restart our manufacturing ability 285 285 00:10:44,250 --> 00:10:46,170 of drugs inside the United States 286 286 00:10:46,170 --> 00:10:48,660 for legal pharmaceutical purposes. 287 287 00:10:48,660 --> 00:10:51,720 Well, this contract was actually in secret 288 288 00:10:51,720 --> 00:10:53,970 and Kodak put out a press release 289 289 00:10:53,970 --> 00:10:55,860 and it was supposed to go out the next day, 290 290 00:10:55,860 --> 00:10:58,140 but they sent it out a little bit too early by accident, 291 291 00:10:58,140 --> 00:11:00,030 and then they asked for it to be rescinded, 292 292 00:11:00,030 --> 00:11:01,560 but it was too late. 293 293 00:11:01,560 --> 00:11:03,930 Because it had gone out and then was rescinded, 294 294 00:11:03,930 --> 00:11:05,370 other people had already seen it 295 295 00:11:05,370 --> 00:11:08,280 and it drove an enormous increase in their stock price. 296 296 00:11:08,280 --> 00:11:10,830 In fact, it went up from $2 a share 297 297 00:11:10,830 --> 00:11:13,830 up to over $60 a share in one day. 298 298 00:11:13,830 --> 00:11:16,110 That's like a 2700% increase. 299 299 00:11:16,110 --> 00:11:18,210 It was ridiculous and it was crazy 300 300 00:11:18,210 --> 00:11:20,820 and now they're actually coming under investigation 301 301 00:11:20,820 --> 00:11:22,350 for the release of that information 302 302 00:11:22,350 --> 00:11:25,050 because it may have been that somebody did this on purpose 303 303 00:11:25,050 --> 00:11:27,960 because if they did they could have made a lot of money. 304 304 00:11:27,960 --> 00:11:30,270 Think about it this way, if you had bought a thousand shares 305 305 00:11:30,270 --> 00:11:31,560 at $2 a share, 306 306 00:11:31,560 --> 00:11:34,050 and then the next day you could sell them at $60 a share, 307 307 00:11:34,050 --> 00:11:37,170 you would've made $58 a share times a thousand shares 308 308 00:11:37,170 --> 00:11:39,720 or $58,000 in one day. 309 309 00:11:39,720 --> 00:11:42,000 And so this is something that has to be looked at now 310 310 00:11:42,000 --> 00:11:44,940 by the SEC because this corporate information, 311 311 00:11:44,940 --> 00:11:46,740 this deals of this contract between them 312 312 00:11:46,740 --> 00:11:49,470 and the US government was let out prematurely. 313 313 00:11:49,470 --> 00:11:50,970 This is why it's so important 314 314 00:11:50,970 --> 00:11:52,770 that we protect our corporate information 315 315 00:11:52,770 --> 00:11:54,540 because good information 316 316 00:11:54,540 --> 00:11:56,400 can actually drive our share prices up. 317 317 00:11:56,400 --> 00:11:59,070 Bad information can drive our share prices down 318 318 00:11:59,070 --> 00:12:00,540 and this is something that people can use 319 319 00:12:00,540 --> 00:12:02,640 to manipulate the markets. 320 320 00:12:02,640 --> 00:12:04,290 Our final category we need to talk about 321 321 00:12:04,290 --> 00:12:06,240 is high value assets. 322 322 00:12:06,240 --> 00:12:08,310 Now, when we talk about high value assets, 323 323 00:12:08,310 --> 00:12:10,890 it's not necessarily even the information at this point. 324 324 00:12:10,890 --> 00:12:13,620 It could be an information system itself. 325 325 00:12:13,620 --> 00:12:15,270 When we talk about a high value asset, 326 326 00:12:15,270 --> 00:12:18,390 it's an information system that processes data critical 327 327 00:12:18,390 --> 00:12:20,640 to a mission essential function. 328 328 00:12:20,640 --> 00:12:22,530 Now, the idea here is that we want to make sure, 329 329 00:12:22,530 --> 00:12:25,050 we're maintaining the confidentiality, integrity 330 330 00:12:25,050 --> 00:12:27,540 and availability of a high value asset 331 331 00:12:27,540 --> 00:12:30,900 because this is critical to our organization's success. 332 332 00:12:30,900 --> 00:12:33,000 Now, why is this so important for us to figure out 333 333 00:12:33,000 --> 00:12:34,740 in our preparation stage? 334 334 00:12:34,740 --> 00:12:37,860 Well, because all servers kind of look alike. 335 335 00:12:37,860 --> 00:12:39,360 If I go into this server room, 336 336 00:12:39,360 --> 00:12:41,640 which of these are the high value asset? 337 337 00:12:41,640 --> 00:12:43,410 Can I tell just by looking at those? 338 338 00:12:43,410 --> 00:12:45,570 Well, no, because some of those 339 339 00:12:45,570 --> 00:12:47,370 have different types of information on them. 340 340 00:12:47,370 --> 00:12:49,470 One of those might be doing our credit card processing 341 341 00:12:49,470 --> 00:12:51,960 and therefore has financial information on it. 342 342 00:12:51,960 --> 00:12:53,580 Another one might have our contracts 343 343 00:12:53,580 --> 00:12:55,020 and our corporate information. 344 344 00:12:55,020 --> 00:12:57,450 Another one might hold our trade secrets. 345 345 00:12:57,450 --> 00:13:00,390 Another one might just have our public facing website. 346 346 00:13:00,390 --> 00:13:03,360 And so all of these servers are different prioritization 347 347 00:13:03,360 --> 00:13:04,980 and some of them are going to be high value 348 348 00:13:04,980 --> 00:13:07,230 and some of them are just a hunk of metal 349 349 00:13:07,230 --> 00:13:08,940 that are just a regular asset. 350 350 00:13:08,940 --> 00:13:10,920 They're just doing our emails, for instance 351 351 00:13:10,920 --> 00:13:12,900 and so we have to be able to identify 352 352 00:13:12,900 --> 00:13:14,667 what is the high value assets 353 353 00:13:14,667 --> 00:13:17,220 and it's important to do this in the preparation phase 354 354 00:13:17,220 --> 00:13:19,950 because that way when we go to do an instant response 355 355 00:13:19,950 --> 00:13:21,690 we know which servers to check first. 356 356 00:13:21,690 --> 00:13:23,670 We know which ones have the higher priority. 357 357 00:13:23,670 --> 00:13:26,280 We know that when we look at server 001, 358 358 00:13:26,280 --> 00:13:27,570 that is our credit card server 359 359 00:13:27,570 --> 00:13:29,697 and 002 is our email server 360 360 00:13:29,697 --> 00:13:32,130 and 003 is our domain controller 361 361 00:13:32,130 --> 00:13:34,890 and 004 holds our trade secrets. 362 362 00:13:34,890 --> 00:13:35,940 Whatever those things are, 363 363 00:13:35,940 --> 00:13:38,280 we have to be able to identify it very quickly 364 364 00:13:38,280 --> 00:13:40,800 because that is going to help us keep the containment 365 365 00:13:40,800 --> 00:13:43,740 of an incident down and help us reduce our time 366 366 00:13:43,740 --> 00:13:45,990 and be able to protect our data even further.