Tutor: Reporting Requirements. 2 2
In this lesson, 3 3
we are going to talk about the different reporting requirements 4 4
that you may have to face as an instant responder. 5 5
Now again, this is something we have to think about 6 6
all the way back in our preparation phase 7 7
to ensure we're ready to do our reporting 8 8
as required by law or regulation. 9 9
Now, when we talk about reporting requirements, 10 10
these are notifications that must be made 11 11
to the affected parties 12 12
in the event of a data breach, 13 13
as required by legislation or regulation. 14 14
Now, there are five different types of breaches that exist, 15 15
and depending on the breach, 16 16
there are different reporting requirements. 17 17
The first one is data exfiltration. 18 18
This occurs when an attacker breaks into a system 19 19
and transfers data to another system. 20 20
So if an attacker's being able to get into 21 21
your credit card database and take those numbers out, 22 22
that would be considered a data exfiltration attempt. 23 23
Now, in addition to that, 24 24
we might have another type of breach, 25 25
which is known as insider data exfiltration. 26 26
This occurs when an employee 27 27
or an ex-employee with privileges on the system 28 28
transfers data to another system. 29 29
So for example, if somebody at my office goes in 30 30
and downloads files from our share drive 31 31
onto a USB thumb drive and takes it home with them, 32 32
and then uploads it to WikiLeaks, 33 33
that would be considered an insider data exfiltration 34 34
because one of our employees is doing it 35 35
with their normal permissions and rights. 36 36
The third type of breach we might have 37 37
can occur when we have a device theft or loss. 38 38
This is when a device containing data is lost or stolen. 39 39
So one of the typical examples is a smartphone. 40 40
You have a smartphone 41 41
that has a lot of corporate data on it, 42 42
and if you leave it in the back of a taxi cab, for instance, 43 43
that would be device loss. 44 44
Another thing would be 45 45
if you had a laptop in the back of your car 46 46
and somebody broke into your car and stole that laptop. 47 47
Now, this has happened numerous times 48 48
to many organizations around the world, 49 49
and it does put your data at risk. 50 50
The fourth type we have 51 51
is known as an accidental data breach. 52 52
Now, this occurs 53 53
when there's public disclosure of information 54 54
or unauthorized transfer 55 55
that's caused by human error or a misconfiguration. 56 56
Essentially, this happened because somebody made a mistake, 57 57
it wasn't intentional. 58 58
And as you can see here as we're moving down the scale, 59 59
we're getting less and less severe. 60 60
And then finally, 61 61
we have integrity or availability breaches. 62 62
This occurs when there's corruption of the data 63 63
or destruction of a system that processes that data. 64 64
So if I had somebody 65 65
who was able to modify data in a database, 66 66
that would be an integrity breach. 67 67
If I do a denial of service attack against your web server, 68 68
that would be an availability breach. 69 69
And again, as we go forward, 70 70
starting with data exfiltration, 71 71
and then insider data exfiltration, 72 72
and then device theft or loss, 73 73
and then accidental data breach, 74 74
and finally, integrity and availability breach, 75 75
we go from the most significant, being data exfiltration 76 76
because an attacker broke into our systems, 77 77
all the way down to the least, 78 78
which is integrity or availability breaches, 79 79
that usually occurs 80 80
when something other than confidentiality is being breached, 81 81
which means it's data integrity 82 82
or availability that's being affected. 83 83
Now, depending on the type of breach you have, 84 84
there's going to be different laws and regulations 85 85
that govern your requirements for reporting. 86 86
These requirements are going to tell you 87 87
what you have to report 88 88
and in what timeframe you have to report, 89 89
and to who you have to report these things to. 90 90
For example, if you have a HIPAA issue, 91 91
which would be something that has to deal with PHI 92 92
or Protected Health Information, 93 93
you would have to actually report that. 94 94
Now, HIPAA is a law inside the United States, 95 95
and so if you have a data breach 96 96
affecting this type of data, 97 97
you are going to be required to notify the affected individuals 98 98
the Secretary of Health and Human Services, and the media 99 99
if there's over 500 people affected by that data breach. 100 100
Now, another example 101 101
of a regulatory requirement for reporting 102 102
would be under GDPR, 103 103
which is the General Data Protection Regulation. 104 104
This applies inside the European Union. 105 105
Now with GDPR, this is going to require 106 106
a notification within 72 hours 107 107
of becoming aware of the breach of personal data. 108 108
You need to notify the person 109 109
as well as the GDPR regulators, 110 110
which is the European Union. 111 111
Now, the final thing we want to talk about is disclosure, 112 112
and this is something that has to do with 113 113
how are you going to tell the person affected? 114 114
If we think back to Yahoo, 115 115
Yahoo has had a number of data breaches 116 116
over the last decade. 117 117
Now, if you're like most people, 118 118
you've probably received at some point in your life, 119 119
one of these notices from Yahoo. 120 120
This is because Yahoo has had the information 121 121
of over 1 billion people breached over the last decade. 122 122
Now, disclosure here would be, 123 123
when they tell you that this has happened, 124 124
they're going to say, "Dear user. 125 125
We want to let you know about this security issue. 126 126
We had some bad things happen. 127 127
Here's what they were, 128 128
and here's what we're doing about it." 129 129
Essentially, the disclosure's going to have key information 130 130
like a description of what information was breached, 131 131
the details of who the main point of contact is 132 132
if you have any questions, 133 133
and any likely consequences arising from that breach, 134 134
as well as measures that were taken to mitigate that breach. 135 135
All of this is the information that would be disclosed 136 136
to the person who was affected 137 137
and had their data lost or data stolen.