Presenter: Legal requirements. 2 2
In this lesson, we're going to talk about 3 3
some of the legal requirements around privacy. 4 4
Now, any type of information or asset 5 5
needs to consider how a compromise of that information 6 6
can threaten the three core security attributes 7 7
of the CIA triad, 8 8
confidentiality, integrity and availability. 9 9
And I mentioned this a lot in my courses 10 10
but if you're thinking about CIA, 11 11
I like to think about confidentiality 12 12
usually has to do with encryption, 13 13
integrity usually has to do something with hashing, 14 14
and availability usually has to do 15 15
something with redundancy. 16 16
And so if you keep those three key words in mind, 17 17
it'll help you figure out what the right answer is 18 18
when you're dealing with CIA triad, 19 19
and things associated with it. 20 20
Now, what we're going to really focus on in this lesson 21 21
is the difference between privacy and security. 22 22
Now, when we talk about security controls, 23 23
there is that focus on CIA attributes 24 24
of the processing system. 25 25
So if I say, "This data is encrypted." 26 26
Well, that is a security control, that's confidentiality. 27 27
If I say, "This data has been hashed 28 28
so I have a digital fingerprint of it." 29 29
That tells me we have integrity of it, 30 30
but that's all security 31 31
that doesn't tell me whether or not that data is private, 32 32
if it's been kept private from other people. 33 33
And so that's something we have to think about, 34 34
when we talk about privacy 35 35
we're really talking about a data governance requirement 36 36
that arises when you're collecting 37 37
and processing personal data 38 38
to ensure the rights of the subject's data. 39 39
So if I collect information from you 40 40
when you sign up for my course, 41 41
I get your name, your email, 42 42
maybe your credit card information. 43 43
I have to keep that information private. 44 44
It doesn't necessarily mean 45 45
that I have to have it encrypted in my database, 46 46
although we do that, 47 47
we just have to make sure 48 48
that nobody else can get that data 49 49
who doesn't have a need to know inside our organization. 50 50
That's the idea of privacy. 51 51
Now, one of the things that I think is unique 52 52
is the way privacy is seen across the globe. 53 53
Depending on where you are and where you live, 54 54
privacy is either a bigger or less deal to you. 55 55
For instance, when you go to a website 56 56
and you look at the privacy policy, 57 57
do you actually read through all of the pages 58 58
of legalese to figure out what they're saying 59 59
they can do with your private information? 60 60
Most people don't. 61 61
But if you're in someplace like Europe, 62 62
they take privacy much more seriously 63 63
and they have things like the right to be forgotten, 64 64
and they have GDPR 65 65
which says that you have to write your privacy policy 66 66
in a very clear and easy-to-understand method, 67 67
not legalese like we do here in the States. 68 68
So even just the difference between European countries 69 69
and the United States has a big difference 70 70
in the way we view privacy. 71 71
Now because of the cultural differences 72 72
and the cultural pressure that's been applied, 73 73
there are different legal requirements in different areas. 74 74
There are legal requirements 75 75
that will affect your corporate governance and policies 76 76
in regards to privacy of your user's data. 77 77
As a company that works worldwide with people, 78 78
we have students all over the world, 79 79
we have to be aware of that. 80 80
And so we keep in mind what the legal requirements are 81 81
in the different areas we're operating in. 82 82
Now, one of the biggest requirements 83 83
and one of the best requirements 84 84
in terms of privacy is GDPR. 85 85
This is the General Data Protection Regulation, 86 86
and this says that personal data cannot be collected, 87 87
processed or retained 88 88
without the individual's informed consent. 89 89
Now, when I talk about informed consent, 90 90
this means that the data must be collected 91 91
and processed only for the stated purpose, 92 92
and that purpose must be clearly described 93 93
to the user in plain language, not legalese. 94 94
So if you go to a website and they say, 95 95
"Give us your name, your email, and your home address, 96 96
so that we can sell you this product 97 97
and then deliver it to your house," 98 98
that's the state of purpose. 99 99
That doesn't mean that they can now 100 100
send you mailers every single week to your home address 101 101
to try to get you to buy more stuff, 102 102
unless that was part of their privacy policy 103 103
that you accepted. 104 104
So GDPR says they have to be upfront with this. 105 105
Now, GDPR also provides the right for a user 106 106
to withdraw consent at any time, 107 107
it also gives 'em the ability to inspect, 108 108
amend or erase data that's held about them. 109 109
We like to call this the right to be forgot. 110 110
If you're a resident and citizen of the European Union 111 111
you can call up the company or fill out their form and say, 112 112
"I want you to forget 113 113
everything you've ever known about me." 114 114
and they have to go into their database 115 115
and scrub you out of it. 116 116
That is part of that law, 117 117
it gives you a lot of protections 118 118
if you're a European citizen. 119 119
Now, if you're an American citizen 120 120
we don't have that right. 121 121
So if I'm sitting in Maryland and I want to be forgotten, 122 122
I can't do it, that's just not something 123 123
that the companies have to do for me. 124 124
I can request they do that 125 125
but they are not by law required to do it. 126 126
So there are different protections 127 127
depending on where you live in the world, 128 128
and as a company operating in different areas 129 129
you need to be aware of this. 130 130
Now, what happens if you have a data breach? 131 131
Well, this depends, again, where you are 132 132
and what laws you fall under. 133 133
For instance, if you deal with GDPR 134 134
you have responsibilities, 135 135
within 72 hours, if you're doing business within Europe, 136 136
you have to notify the regulators and the users 137 137
that you had a data breach. 138 138
So, once again, this is an area 139 139
where the European citizens have better rights 140 140
than the Americans do, 141 141
based on the laws that are in each of those countries 142 142
at the time of this filming. 143 143
Now, let me give you a quick word of warning, 144 144
data breaches can happen both accidentally 145 145
and through malicious interference. 146 146
Just because you had a data breach 147 147
doesn't mean that some hacker got in, 148 148
it could have been assistant (indistinct) 149 149
did the wrong thing. 150 150
They entered the wrong command in the database 151 151
and they dumped it to the screen, 152 152
and now people are able to see 153 153
everybody's social security numbers, 154 154
or their dates of birth or their names. 155 155
This is all types of things that have happened in the past 156 156
so just keep that in mind, 157 157
it's not always a malicious actor, it's not always a hacker, 158 158
sometimes it's our own internal staff who makes mistakes. 159 159
Now, I've mentioned GDPR a couple of times 160 160
here are already in this lesson, 161 161
but I want you to remember when I'm talking about GDPR 162 162
I'm talking about a law inside of Europe, 163 163
and GDPR does provide stronger protections 164 164
than most federal or state laws in the United States. 165 165
Most of the laws here in the United States 166 166
are very industry specific or state specific, 167 167
so we might have laws that affect the financial industry 168 168
or the healthcare industry, but we don't have ones 169 169
that protect all of our citizens all of the time. 170 170
And for the rest of this lesson we're really going to focus 171 171
on those narrower definitions of personal data 172 172
in industry specific areas. 173 173
So the first one I want to talk about 174 174
is SOX, or Sarbanes-Oxley. 175 175
When we talk about Sarbanes-Oxley, 176 176
this sets forth the requirement 177 177
for the storage and retention of documents 178 178
that are relating to an organization's 179 179
financial and business operations, 180 180
including the type of documents to be stored 181 181
and their retention periods. 182 182
This applies to publicly traded companies, 183 183
companies listed on the stock exchange, 184 184
and they have to have a value of at least $75 million 185 185
to be required to follow SOX. 186 186
SOX came out of all the scandals in the early 2000s, 187 187
things like WorldCom and Enron. 188 188
And so after that, Congress stepped in and said, 189 189
"All these companies need to retain their documents. 190 190
We want to be able to go back and look at those records, 191 191
and see what they've been doing. 192 192
And that way we could try to protect the people." 193 193
Another law that came out of the '90s and early 2000s 194 194
was GLBA, the Gramm-Leach-Bliley Act. 195 195
Now, this sets forth requirements 196 196
that will help protect the privacy 197 197
of an individual's financial information 198 198
that's held by financial institutions and others. 199 199
When we talk here about financial institutions 200 200
we're talking about stockbrokers, banks, 201 201
and other things like that. 202 202
So if you're dealing with a mortgage company, 203 203
they fall under GLBA 204 204
and they have to protect the privacy of your information. 205 205
Next, we have FISMA, 206 206
and FISMA applies to the government itself. 207 207
FISMA is the Federal Information Security Management Act. 208 208
It sets forth the requirements for federal organizations 209 209
to adopt information assurance controls. 210 210
So if we're talking about government organizations 211 211
we're talking about things like 212 212
the Social Security Administration, 213 213
Health and Human Services, 214 214
the Department of Housing and Urban Development, 215 215
the Department of Defense, which is the military. 216 216
All of these folks fall under FISMA, 217 217
so if you work for the government 218 218
or a government contractor, FISMA applies to you. 219 219
And so a lot of folks in the cybersecurity world, 220 220
we end up working for the government, 221 221
for the military, or one of those type of organizations. 222 222
So keep FISMA in mind 223 223
because it probably applies to the place you work 224 224
if you're in the United States. 225 225
Next we have HIPAA, which is the Health Insurance 226 226
Portability and Accountability Act. 227 227
This sets forth the requirements to help protect the privacy 228 228
of individual's health information 229 229
that's held by healthcare providers, 230 230
hospitals, and insurance companies. 231 231
Now, again, HIPAA is going to deal with healthcare providers, 232 232
hospitals, doctors and insurance companies. 233 233
If they have information about your health records 234 234
it's protected by HIPAA. 235 235
And so if you work for one of those sectors of the economy, 236 236
make sure you're familiar with HIPAA as well. 237 237
Now all of those were reviewed for you from Security+ 238 238
but I do have one new one for you, and this is COSO, 239 239
which is the Committee of Sponsoring Organizations 240 240
of the Treadway Commission. 241 241
This provides guidance 242 242
on a variety of governance related topics, 243 243
including fraud, controls, finance, and ethics, 244 244
and it relies on COSO's ERM integrated Framework, 245 245
which is Enterprise Risk Management Framework. 246 246
Now, this essentially is a bunch of best practices 247 247
and ways of working 248 248
to deal with fraud and controls and finance and ethics 249 249
inside your organizations. 250 250
So it's not necessarily a regulation or law 251 251
but it is a best practice way of doing things, 252 252
and so it is something you could consider as well. 253 253
Now, I know that was a lot of different laws and regulations 254 254
that we talked about in terms of privacy, 255 255
and there are countless other laws and regulations 256 256
around the globe. 257 257
We really did focus on really only two main areas, 258 258
Europe with GDPR, and then America with all the rest. 259 259
But if you're located in Canada or India, or someplace else, 260 260
there are laws and regulations that apply to you 261 261
based on your own countries. 262 262
But if you know the ones I talked about in this lesson, 263 263
you're going to do fine on the exam 264 264
in terms of privacy and legal requirements.