Instructor: Data criticality. 2 2
Data criticality is extremely important to think about 3 3
all the way back in your preparation phase. 4 4
This is going to affect 5 5
your different standard operating procedures 6 6
and your playbooks 7 7
as well as your incident response plans overall. 8 8
Now, the reason this is so important is because 9 9
everything we deal with is really concerned 10 10
with the data on those systems. 11 11
When I'm looking at a system, 12 12
I don't really care that this server or that server 13 13
has been attacked by a hacker 14 14
but I do care what information on those systems is there 15 15
that could have been accessed by those attackers. 16 16
And data criticality helps me prioritize 17 17
what response I'm going to do. 18 18
This is extremely important 19 19
because I don't have enough resources 20 20
to protect everything all of the time. 21 21
Instead, I have to allocate my resources 22 22
and so things that are more important 23 23
or have a higher criticality are going to be things 24 24
I spend more money protecting 25 25
and the things that I don't care about as much 26 26
I'm going to spend less time and money protecting. 27 27
This is the whole idea of allocating our resources. 28 28
Now, this becomes extremely important 29 29
when you're dealing with a data breach. 30 30
Depending on what type of data you're dealing with, 31 31
you're going to spend more money 32 32
and more resources cleaning up that mess. 33 33
For example, if a data breach involves 34 34
private or confidential data, this is going to take priority 35 35
over all the other incidents you have 36 36
because here's the sad truth. 37 37
When you look at a big organization, 38 38
they are getting attacked constantly 39 39
by attackers and hackers. 40 40
Now, they stop a lot of the attacks 41 41
but some are going to get through, 42 42
and so one of the things they have to do is triage 43 43
and prioritize and figure out 44 44
where they're going to spend their time and money 45 45
to fix things and stop things 46 46
and then recover from these different attacks. 47 47
Depending on that data criticality. 48 48
This is going to make a difference. 49 49
Now, when we start looking at this, 50 50
we're going to talk about a bunch of different types of data. 51 51
We have things like PII and SPI and PHI 52 52
and financial information and intellectual property 53 53
and corporate information and high value assets. 54 54
In this lesson, we're going to talk about 55 55
each of these seven types of data criticality 56 56
and how we can categorize them. 57 57
Let's start with PII. 58 58
PII is personally identifiable information. 59 59
This is data that can be used to identify, contact 60 60
or impersonate an individual. 61 61
Now, when you're dealing with PII, 62 62
this is information like a birthday, 63 63
a social security number, a place of birth, your full name, 64 64
your biometric ID like your fingerprint or your retina scan. 65 65
All of this is data that identifies you personally. 66 66
As an attacker if I can get this data, 67 67
I can identify you as an individual, 68 68
and that's why we call it 69 69
personally identifiable information. 70 70
This data can be combined with things like IP addresses 71 71
and geolocation data, and then we can actually target you, 72 72
physically in the real world too. 73 73
So this is a big area of concern for us, 74 74
and so PII is one of the most common data criticality issues 75 75
that you're going to be faced with 76 76
and that you're going to be trying to protect 77 77
as an organization. 78 78
Next, we have SPI, which is sensitive personal information. 79 79
Sensitive personal information is information 80 80
about a person or subject's opinions, beliefs and nature 81 81
that's afforded specially protected status 82 82
by privacy legislation. 83 83
When we talk about privacy legislation here, 84 84
we're talking about things like GDPR, 85 85
the general data privacy regulation 86 86
and its definition of SPI includes things 87 87
like religious belief, political opinions, 88 88
trade union membership, gender, sexual orientation, 89 89
racial and ethnic origin, 90 90
genetic data and health information. 91 91
All of this is data that needs to be protected. 92 92
Now in the US, we don't have an overarching definition 93 93
of SPI or privacy regulation for it 94 94
but certain parts of this we do. 95 95
For instance, health information is one 96 96
that we actually cover in the United States under HIPAA 97 97
and this can bring us to our next category 98 98
which is PHI, which is personal health information. 99 99
Now, this is information 100 100
that identifies somebody as a subject of a medical record, 101 101
insurance record, hospital results 102 102
or laboratory test results. 103 103
Essentially, it's anything that has to do 104 104
with your health or your body. 105 105
Now, when we're dealing with PHI, 106 106
you may hear this called personal health information 107 107
or protected health information. 108 108
Both those acronyms are used. 109 109
But anytime you see PHI, I just want you to remember 110 110
we're talking about healthcare information here 111 111
and this is protected by HIPAA. 112 112
Now, when you're dealing with this health information, 113 113
sometimes this information can be sent around 114 114
and used in other places. 115 115
For example, you can anonymize or de-identify the data set 116 116
based on the data that's there 117 117
by removing the identifying information 118 118
and a lot of times companies will do this. 119 119
For example, if you have a fitness tracker in your watch, 120 120
you can actually use that data. 121 121
It is considered PHI 122 122
because it's taking things like your heart rate, 123 123
your breathing and respiration. 124 124
Some of these watches can even test your oxygen levels. 125 125
All of that is health data and health records 126 126
and so it should be protected as PHI. 127 127
Now, if that company wants to sell that data, 128 128
they can do this through de-identification or anonymization. 129 129
Essentially, they take out everything 130 130
that identifies it with you and says, 131 131
we have 50 people who are all between 50 and 60 years old, 132 132
and their average heart rate is this. 133 133
That would be an anonymized data set 134 134
that they can then give to researchers and others 135 135
who need that type of information. 136 136
Now, PHI is also valuable to attackers, and why is that? 137 137
Well, because there's a high value for it 138 138
on the black market. 139 139
The reason for this is because 140 140
these criminals can actually exploit that dataset 141 141
and use it to commit insurance fraud. 142 142
Unlike a credit card number or a bank number, 143 143
when this information is out there, 144 144
it uniquely identifies you based on your biometrics 145 145
and because of that, 146 146
it can be used for a lot of different things 147 147
including fraud and blackmail. 148 148
And so this is something 149 149
that we really have to be concerned with, 150 150
especially if we're in an industry or an organization 151 151
that maintains this type of information. 152 152
Our next category of data is financial information. 153 153
This is data that's stored about bank accounts, 154 154
investment accounts, payroll accounts, 155 155
tax returns, credit card data 156 156
and other data about commercial transactions. 157 157
All of this is basically information about money 158 158
and it's worth money, and so because of that, 159 159
it is is always coming under attack. 160 160
If your organization accepts credit card payments, 161 161
you probably follow the PCI DSS standard 162 162
which is the payment card industry data security standard. 163 163
This defines the safe handling 164 164
and storage of payment card data 165 165
because you're dealing with credit cards 166 166
and credit cards can be used to buy things, 167 167
this data comes under attack a lot 168 168
and so you really need to make sure 169 169
you're protecting it the way it needs to be protected. 170 170
The next category of data criticality refers to information 171 171
about intellectual property. 172 172
This is information that's created by an organization 173 173
usually about the products or services 174 174
that it makes or provides. 175 175
Now, there is lots of different types 176 176
of intellectual property. 177 177
This includes things that can be copyrighted, 178 178
things that can be patented, things that can be trademarked 179 179
or things that are trade secrets. 180 180
All of these can be a type of intellectual property 181 181
and they all have value to your organization. 182 182
For example, one of the largest trade secrets 183 183
has been kept for decades is the original recipe 184 184
of 11 herbs and spices for KFC's chicken. 185 185
Now, this is a famous trade secret 186 186
because Colonel Sanders has kept it secret since the 1930s. 187 187
This recipe has never been patented. 188 188
Why? 189 189
Because when you patent something, 190 190
you have to put the details of what it is inside that patent 191 191
and there's an expiration date to it. 192 192
So instead, they've held it as a trade secret 193 193
because that means it remains its intellectual property 194 194
and they can hold onto it in perpetuity, meaning forever. 195 195
Now, they have taken special precautions to make sure 196 196
that their recipe for these 11 herbs and spices 197 197
are maintained secret. 198 198
In fact, when they produce it for their restaurants, 199 199
half of it is produced by one laboratory 200 200
and the other half is produced by another laboratory 201 201
and they are then delivered and combined by the restaurants. 202 202
This is how far they go to protect this trade secret. 203 203
So do you think they want to have this on a computer system 204 204
that a hacker can get into? 205 205
Of course not. 206 206
And so these are the type of things you have to think about 207 207
when you're dealing with intellectual property. 208 208
Let me give you another example of intellectual property. 209 209
This is one from my own company. 210 210
We have video courses 211 211
just like the one you're watching right now. 212 212
These are intellectual property of my company, 213 213
Dion Training. 214 214
Now, one of the reasons these videos can't be downloaded 215 215
on a lot of different systems is because 216 216
we have to protect our intellectual property, 217 217
and so our licensing agreements have it set up 218 218
so that if you're watching this video on a site, 219 219
it either has to be streamed to you 220 220
or if they're going to allow downloads, 221 221
they have to have it inside a closed experience, 222 222
like a mobile app where you can download it 223 223
and it's encrypted and uses digital rights management. 224 224
This helps protect our intellectual property 225 225
and tries to keep our videos from getting out there 226 226
into the wild so that it's not on pirate sites. 227 227
Now, when they're found on pirate sites, 228 228
those videos are then taken down 229 229
because they're breaking our copyright 230 230
which is a form of intellectual property. 231 231
For us, our intellectual property is the product we make. 232 232
It's the videos that you're watching right now. 233 233
For Colonel Sanders and KFC, 234 234
their intellectual property is just one component 235 235
of the overall product they make, 236 236
which is their delicious chicken. 237 237
Similarly, when you take a CompTIA exam, 238 238
the questions on that exam itself 239 239
are considered intellectual property 240 240
and they are copyrighted by CompTIA. 241 241
They work really hard to protect those exam questions 242 242
from being released to the general public. 243 243
This is why brain dump sites are constantly being sued 244 244
and being forced to take those things down 245 245
because they're infringing 246 246
on CompTIA's copyrighted materials 247 247
which are a form of intellectual property. 248 248
When you take your exam, 249 249
you can choose whether to take it at a local testing center 250 250
where a proctor's going to ensure you aren't cheating 251 251
and you're not copying down the questions 252 252
to try to take them home with you, 253 253
or you could take it online. 254 254
If you take it online, 255 255
you're using the OnView proctor service, and again, 256 256
you're being watched over your webcam during the exam 257 257
to ensure the integrity of that exam 258 258
and the protection of CompTIA's intellectual property. 259 259
The six type of information we have 260 260
is corporate information. 261 261
Now, this type of information contains 262 262
confidential data owned by a company 263 263
such as products, sales, marketing, legal 264 264
and contract information. 265 265
Now, this type of information is very important 266 266
but it's not the same as intellectual property. 267 267
For example, when you're dealing with corporate information, 268 268
you're talking about things like profit and cash flow 269 269
and salaries and market shares and key customers. 270 270
All of this could be of interest to a company's competitors 271 271
but it is not the actual intellectual property itself. 272 272
It's just proprietary corporate information. 273 273
For example, my videos are considered intellectual property 274 274
but the information about how many videos we sell 275 275
and how many students we have and how much profit we made 276 276
that is corporate information. 277 277
So hopefully, that helps you understand the distinction 278 278
between the two. 279 279
Now, a great example of a leak of corporate information 280 280
actually happened just last week as I'm writing this lesson. 281 281
Now, Kodak, which used to be a big filmmaker, 282 282
actually was receiving a contract from the US government 283 283
to help become a chemical manufacturer 284 284
to be able to help restart our manufacturing ability 285 285
of drugs inside the United States 286 286
for legal pharmaceutical purposes. 287 287
Well, this contract was actually in secret 288 288
and Kodak put out a press release 289 289
and it was supposed to go out the next day, 290 290
but they sent it out a little bit too early by accident, 291 291
and then they asked for it to be rescinded, 292 292
but it was too late. 293 293
Because it had gone out and then was rescinded, 294 294
other people had already seen it 295 295
and it drove an enormous increase in their stock price. 296 296
In fact, it went up from $2 a share 297 297
up to over $60 a share in one day. 298 298
That's like a 2700% increase. 299 299
It was ridiculous and it was crazy 300 300
and now they're actually coming under investigation 301 301
for the release of that information 302 302
because it may have been that somebody did this on purpose 303 303
because if they did they could have made a lot of money. 304 304
Think about it this way, if you had bought a thousand shares 305 305
at $2 a share, 306 306
and then the next day you could sell them at $60 a share, 307 307
you would've made $58 a share times a thousand shares 308 308
or $58,000 in one day. 309 309
And so this is something that has to be looked at now 310 310
by the SEC because this corporate information, 311 311
this deals of this contract between them 312 312
and the US government was let out prematurely. 313 313
This is why it's so important 314 314
that we protect our corporate information 315 315
because good information 316 316
can actually drive our share prices up. 317 317
Bad information can drive our share prices down 318 318
and this is something that people can use 319 319
to manipulate the markets. 320 320
Our final category we need to talk about 321 321
is high value assets. 322 322
Now, when we talk about high value assets, 323 323
it's not necessarily even the information at this point. 324 324
It could be an information system itself. 325 325
When we talk about a high value asset, 326 326
it's an information system that processes data critical 327 327
to a mission essential function. 328 328
Now, the idea here is that we want to make sure, 329 329
we're maintaining the confidentiality, integrity 330 330
and availability of a high value asset 331 331
because this is critical to our organization's success. 332 332
Now, why is this so important for us to figure out 333 333
in our preparation stage? 334 334
Well, because all servers kind of look alike. 335 335
If I go into this server room, 336 336
which of these are the high value asset? 337 337
Can I tell just by looking at those? 338 338
Well, no, because some of those 339 339
have different types of information on them. 340 340
One of those might be doing our credit card processing 341 341
and therefore has financial information on it. 342 342
Another one might have our contracts 343 343
and our corporate information. 344 344
Another one might hold our trade secrets. 345 345
Another one might just have our public facing website. 346 346
And so all of these servers are different prioritization 347 347
and some of them are going to be high value 348 348
and some of them are just a hunk of metal 349 349
that are just a regular asset. 350 350
They're just doing our emails, for instance 351 351
and so we have to be able to identify 352 352
what is the high value assets 353 353
and it's important to do this in the preparation phase 354 354
because that way when we go to do an instant response 355 355
we know which servers to check first. 356 356
We know which ones have the higher priority. 357 357
We know that when we look at server 001, 358 358
that is our credit card server 359 359
and 002 is our email server 360 360
and 003 is our domain controller 361 361
and 004 holds our trade secrets. 362 362
Whatever those things are, 363 363
we have to be able to identify it very quickly 364 364
because that is going to help us keep the containment 365 365
of an incident down and help us reduce our time 366 366
and be able to protect our data even further.