1 00:00:06,510 --> 00:00:07,920 - Welcome to lesson 12, 2 00:00:07,920 --> 00:00:09,750 Compare and Contrast Concepts 3 00:00:09,750 --> 00:00:12,150 and Strategies to Protect Data. 4 00:00:12,150 --> 00:00:14,880 Now in lesson 12.1, we're gonna take a look 5 00:00:14,880 --> 00:00:17,130 at what are the different data types 6 00:00:17,130 --> 00:00:18,780 that we're attempting to protect. 7 00:00:20,010 --> 00:00:23,070 So let's start with a survey of categories of data. 8 00:00:23,070 --> 00:00:25,920 Regulated data, personally identifiable data, 9 00:00:25,920 --> 00:00:28,920 intellectual property, contractually protected, 10 00:00:28,920 --> 00:00:32,130 and organizationally classified data. 11 00:00:32,130 --> 00:00:35,220 Regulatory protected data is data that is protected 12 00:00:35,220 --> 00:00:38,313 by law or by industry standards. 13 00:00:39,270 --> 00:00:42,150 Personally identifiable data refers to data 14 00:00:42,150 --> 00:00:44,940 that can be used to identify a specific individual, 15 00:00:44,940 --> 00:00:46,053 like you or me. 16 00:00:46,920 --> 00:00:51,443 Intellectual property refers to intangible creations. 17 00:00:51,443 --> 00:00:54,270 Contractually protected data refers to data 18 00:00:54,270 --> 00:00:57,420 that is specified in a contract or an agreement 19 00:00:57,420 --> 00:01:00,480 of how we're going to protect it and use it. 20 00:01:00,480 --> 00:01:03,967 And then organizationally classified data refers to data 21 00:01:03,967 --> 00:01:07,530 that meets certain classification criteria. 22 00:01:07,530 --> 00:01:10,593 And we'll be talking about classifications pretty shortly. 23 00:01:11,460 --> 00:01:14,280 So let's go a little deeper into each of these. 24 00:01:14,280 --> 00:01:16,320 So regulated data refers to data 25 00:01:16,320 --> 00:01:20,190 that's subject to specific laws or regulations 26 00:01:20,190 --> 00:01:22,800 or industry standards that govern its collection, 27 00:01:22,800 --> 00:01:26,163 its use, its storage, and its disclosure. 28 00:01:27,390 --> 00:01:30,840 Now jurisdiction is the power or right of a legal 29 00:01:30,840 --> 00:01:34,860 or political agency to exercise its authority 30 00:01:34,860 --> 00:01:38,310 over a person's subject matter or territory. 31 00:01:38,310 --> 00:01:39,870 So based on your jurisdiction, 32 00:01:39,870 --> 00:01:42,510 you may have different types of regulated data. 33 00:01:42,510 --> 00:01:45,390 Now in relation to information security, 34 00:01:45,390 --> 00:01:49,140 jurisdiction pertains to the location of data 35 00:01:49,140 --> 00:01:51,690 and its systems in all its states, processing, 36 00:01:51,690 --> 00:01:54,510 transmission, and storage. 37 00:01:54,510 --> 00:01:57,360 The type of data we have, is it healthcare data? 38 00:01:57,360 --> 00:01:58,620 Is it financial data? 39 00:01:58,620 --> 00:02:00,210 Is it data that has a minor? 40 00:02:00,210 --> 00:02:02,730 Is it personally identifiable data? 41 00:02:02,730 --> 00:02:04,680 The residents of the data owner, 42 00:02:04,680 --> 00:02:05,790 so that would be the organization 43 00:02:05,790 --> 00:02:07,380 that that owns the data, 44 00:02:07,380 --> 00:02:10,320 as well as the resident of the data subject, 45 00:02:10,320 --> 00:02:12,573 which is who the data is about. 46 00:02:15,090 --> 00:02:17,580 Now compliance means acting in accordance 47 00:02:17,580 --> 00:02:22,140 with applicable rules, laws, policies, and obligations. 48 00:02:22,140 --> 00:02:25,351 And organizations are expected to comply with local, 49 00:02:25,351 --> 00:02:27,750 with state, with federal, and with union, 50 00:02:27,750 --> 00:02:29,220 like a union of countries, 51 00:02:29,220 --> 00:02:32,460 like the European Union or the European Economic Area, 52 00:02:32,460 --> 00:02:36,270 laws and regulations, international agreements and treaties, 53 00:02:36,270 --> 00:02:38,310 and contractual obligations. 54 00:02:38,310 --> 00:02:41,880 Now GRC, governance, risk, and compliance, 55 00:02:41,880 --> 00:02:44,550 is a system that's used by organizations 56 00:02:44,550 --> 00:02:46,830 to structure governance, risk management, 57 00:02:46,830 --> 00:02:48,420 and regulatory compliance. 58 00:02:48,420 --> 00:02:51,150 And the concept is to unify 59 00:02:51,150 --> 00:02:54,570 and align an organization's approach to risk management 60 00:02:54,570 --> 00:02:56,493 and regulatory compliance. 61 00:02:57,480 --> 00:02:58,830 Why are we talking about this here? 62 00:02:58,830 --> 00:03:00,960 Because we will have regulations 63 00:03:00,960 --> 00:03:03,780 that govern how we need to protect the data 64 00:03:03,780 --> 00:03:05,223 that's in our possession. 65 00:03:06,510 --> 00:03:08,160 Now let me give you sort of an overview 66 00:03:08,160 --> 00:03:12,690 of some U.S. federal regulations that pertain to data 67 00:03:12,690 --> 00:03:14,970 that we may have in our organizations. 68 00:03:14,970 --> 00:03:18,330 GLBA, it stands for Gramm-Leach-Bliley Act, HIPAA, 69 00:03:18,330 --> 00:03:19,710 sometimes referred to as HITECH, 70 00:03:19,710 --> 00:03:22,500 that's sort of the second generation of HIPAA, 71 00:03:22,500 --> 00:03:25,080 FERPA, and COPPA. 72 00:03:25,080 --> 00:03:27,060 GLBA is a Gramm-Leach-Bliley Act 73 00:03:27,060 --> 00:03:29,190 and it regulates the security 74 00:03:29,190 --> 00:03:32,103 and privacy of consumer financial records. 75 00:03:33,180 --> 00:03:35,610 HIPAA, which is the Health Insurance Portability 76 00:03:35,610 --> 00:03:38,370 and Accountability Act, regulates the security 77 00:03:38,370 --> 00:03:41,760 and the privacy of medical records. 78 00:03:41,760 --> 00:03:44,340 FERPA, which is the Family Educational Rights 79 00:03:44,340 --> 00:03:46,950 and Privacy Act, regulates the security 80 00:03:46,950 --> 00:03:50,640 and privacy of student educational records. 81 00:03:50,640 --> 00:03:54,300 COPPA, which is Children's Online Privacy Protection Act, 82 00:03:54,300 --> 00:03:56,820 regulates the security and privacy 83 00:03:56,820 --> 00:03:59,160 related to the online data collection 84 00:03:59,160 --> 00:04:02,193 of data for minors under the age of 13. 85 00:04:05,229 --> 00:04:08,250 Now personally identifiable data known as PII, 86 00:04:08,250 --> 00:04:10,650 or sometimes it's just referred to as PI, 87 00:04:10,650 --> 00:04:13,140 personal information, refers to data 88 00:04:13,140 --> 00:04:17,070 that can be used to identify a specific individual. 89 00:04:17,070 --> 00:04:20,400 The compromise of PII can result in identity theft, 90 00:04:20,400 --> 00:04:24,723 fraud, and a whole myriad of other really malicious uses. 91 00:04:25,680 --> 00:04:27,960 So what's in PII? 92 00:04:27,960 --> 00:04:30,810 PII may include a person's name, address, 93 00:04:30,810 --> 00:04:34,140 date of birth, social security number here in the U.S., 94 00:04:34,140 --> 00:04:36,960 a passport number, a driver's license number, 95 00:04:36,960 --> 00:04:39,240 an email address, a phone number, 96 00:04:39,240 --> 00:04:42,450 could have biometric data such as your fingerprints 97 00:04:42,450 --> 00:04:44,275 or facial recognition data 98 00:04:44,275 --> 00:04:47,143 or any other information that can be used 99 00:04:47,143 --> 00:04:50,403 to identify a person uniquely. 100 00:04:52,830 --> 00:04:55,290 Now we think about a PII profile, 101 00:04:55,290 --> 00:04:57,150 we really kind of have three buckets. 102 00:04:57,150 --> 00:05:00,000 Information that can be used to distinguish somebody, 103 00:05:00,000 --> 00:05:02,580 information that can be used to sort of trace them, 104 00:05:02,580 --> 00:05:04,710 and information that can be linked to them 105 00:05:04,710 --> 00:05:07,230 to learn more about them and build a profile. 106 00:05:07,230 --> 00:05:09,120 So information that could distinguish someone 107 00:05:09,120 --> 00:05:11,490 or things like your name, your government ID, 108 00:05:11,490 --> 00:05:13,590 social security number, biometric data, 109 00:05:13,590 --> 00:05:17,395 date of birth, gender, age, sexual orientation. 110 00:05:17,395 --> 00:05:20,490 Type of information could be used to trace you, right? 111 00:05:20,490 --> 00:05:23,460 Would be having information about your physical movements 112 00:05:23,460 --> 00:05:27,690 or your data interaction including your browsing habits. 113 00:05:27,690 --> 00:05:29,400 And then linked data, 114 00:05:29,400 --> 00:05:32,160 data that can be used to build a bigger profile of you 115 00:05:32,160 --> 00:05:35,340 include things like medical records, educational records, 116 00:05:35,340 --> 00:05:38,640 financial records, criminal records, employment history, 117 00:05:38,640 --> 00:05:39,750 even shopping habits. 118 00:05:39,750 --> 00:05:41,880 And when you put this all together, 119 00:05:41,880 --> 00:05:44,910 you really can get a very comprehensive person 120 00:05:44,910 --> 00:05:47,700 of an individual that certainly could be used 121 00:05:47,700 --> 00:05:49,200 for malicious purposes. 122 00:05:49,200 --> 00:05:52,830 And so that's why understanding what regulated data we have 123 00:05:52,830 --> 00:05:56,850 and what regulations we are responsible for complying with 124 00:05:56,850 --> 00:05:59,730 and just really kind of taking care of it in the right way 125 00:05:59,730 --> 00:06:02,613 because we're good people is so very important. 126 00:06:04,560 --> 00:06:07,560 So here are some PII-related regulations 127 00:06:07,560 --> 00:06:08,730 that you wanna be aware of. 128 00:06:08,730 --> 00:06:12,000 GDPR, that's a General Data Protection Regulation, 129 00:06:12,000 --> 00:06:13,593 and CCPA. 130 00:06:14,445 --> 00:06:18,060 The GDPR, the objective is to protect people 131 00:06:18,060 --> 00:06:20,220 in the European Union, EU, 132 00:06:20,220 --> 00:06:22,860 and the European Economic Area, the EEA, 133 00:06:22,860 --> 00:06:25,260 from unlawful data collection or processing 134 00:06:25,260 --> 00:06:28,080 and works to increase consent requirements 135 00:06:28,080 --> 00:06:31,590 and to provide enhanced user rights. 136 00:06:31,590 --> 00:06:34,875 Now the CCPA is the California Consumer Privacy Act 137 00:06:34,875 --> 00:06:39,030 and its objective is to protect California residents. 138 00:06:39,030 --> 00:06:41,850 Now the U.S. doesn't have one overall 139 00:06:41,850 --> 00:06:44,040 PII-related regulation. 140 00:06:44,040 --> 00:06:46,140 We have some state level like California, 141 00:06:46,140 --> 00:06:47,700 we'll talk more about that in just a sec. 142 00:06:47,700 --> 00:06:50,550 And then of course, we have components of PII 143 00:06:50,550 --> 00:06:54,030 in the other regulations, the financial regulations, 144 00:06:54,030 --> 00:06:57,213 GLBA, the healthcare regulations, HIPAA. 145 00:06:58,230 --> 00:07:01,500 But the CCPA is interesting because it draws the scope 146 00:07:01,500 --> 00:07:04,890 of personal information so broadly 147 00:07:04,890 --> 00:07:08,550 to mean any information that identifies, relates to, 148 00:07:08,550 --> 00:07:11,490 describes, or is capable of being associated with 149 00:07:11,490 --> 00:07:14,040 or could reasonably be linked directly 150 00:07:14,040 --> 00:07:17,880 or indirectly with a particular household or a consumer. 151 00:07:17,880 --> 00:07:20,670 So the CCPA really kind of blew out of the water 152 00:07:20,670 --> 00:07:25,080 how we define personally identifiable information. 153 00:07:25,080 --> 00:07:28,530 Now GDPR and CCPA are both built 154 00:07:28,530 --> 00:07:30,360 upon the OECD privacy principles 155 00:07:30,360 --> 00:07:31,890 that we talked about earlier on. 156 00:07:31,890 --> 00:07:34,350 And I do wanna make sure that I mention 157 00:07:34,350 --> 00:07:35,310 that there are other countries 158 00:07:35,310 --> 00:07:37,620 that certainly have PII-related regulations, 159 00:07:37,620 --> 00:07:40,980 Canada, Mexico Brazil, Japan, you know, 160 00:07:40,980 --> 00:07:43,650 among others that all have privacy regulations 161 00:07:43,650 --> 00:07:46,023 to regulate PII. 162 00:07:47,970 --> 00:07:51,360 Now another type of data that is regulated 163 00:07:51,360 --> 00:07:52,830 a little bit differently, though, 164 00:07:52,830 --> 00:07:55,620 is intellectual property law or IP law. 165 00:07:55,620 --> 00:07:57,750 Now don't confuse IP with, in this case, 166 00:07:57,750 --> 00:07:59,940 with internet protocol. 167 00:07:59,940 --> 00:08:02,040 Now intellectual property or IP law 168 00:08:02,040 --> 00:08:03,510 is a branch of law that deals 169 00:08:03,510 --> 00:08:07,080 with the protection of intangible creations. 170 00:08:07,080 --> 00:08:09,961 A book, PowerPoint slides, 171 00:08:09,961 --> 00:08:13,383 music, you know, a piece of artwork. 172 00:08:14,700 --> 00:08:18,600 Now the goal of IP law is to encourage innovation 173 00:08:18,600 --> 00:08:22,260 and creativity by granting exclusive rights to the creator 174 00:08:22,260 --> 00:08:25,380 and the owners of that IP, that intellectual property, 175 00:08:25,380 --> 00:08:26,400 while at the same time, 176 00:08:26,400 --> 00:08:29,147 balancing the interest of the public. 177 00:08:29,147 --> 00:08:30,870 Now, while there are definitely 178 00:08:30,870 --> 00:08:32,490 some international agreements and treaties 179 00:08:32,490 --> 00:08:35,880 that provide some standardization in IP protection, 180 00:08:35,880 --> 00:08:38,040 there really are very significant differences 181 00:08:38,040 --> 00:08:39,870 in how IP is protected 182 00:08:39,870 --> 00:08:43,473 and enforced across different jurisdictions worldwide. 183 00:08:45,407 --> 00:08:48,810 But here are the categories of IP protection 184 00:08:48,810 --> 00:08:49,980 that you need to know about 185 00:08:49,980 --> 00:08:52,620 because you'll be responsible for protecting that data, 186 00:08:52,620 --> 00:08:54,900 either from misuse or making sure 187 00:08:54,900 --> 00:08:58,860 that no one in your organization is misusing information. 188 00:08:58,860 --> 00:09:01,350 So we have patents, trademarks, copyrights, 189 00:09:01,350 --> 00:09:03,300 and trade secrets. 190 00:09:03,300 --> 00:09:05,880 Now a patent gives its owner the legal right 191 00:09:05,880 --> 00:09:08,580 to exclude others from making, selling, 192 00:09:08,580 --> 00:09:10,980 or using an invention for a period of time 193 00:09:10,980 --> 00:09:14,100 in exchange for public publishing a public disclosure 194 00:09:14,100 --> 00:09:15,300 of the invention. 195 00:09:15,300 --> 00:09:16,830 So they can publish it, 196 00:09:16,830 --> 00:09:19,650 but now they have the legal right to make use 197 00:09:19,650 --> 00:09:21,499 and sell that invention. 198 00:09:21,499 --> 00:09:23,010 A trademark, 199 00:09:23,010 --> 00:09:25,380 which sometimes you'll see with TM, trademark, 200 00:09:25,380 --> 00:09:27,060 SM if it's a service mark. 201 00:09:27,060 --> 00:09:29,160 Or you might see an R in a circle, 202 00:09:29,160 --> 00:09:32,670 that means it's been registered with a government agency, 203 00:09:32,670 --> 00:09:35,970 is intended to protect recognizable names, 204 00:09:35,970 --> 00:09:38,430 icons, shapes, colors, and sounds 205 00:09:38,430 --> 00:09:41,370 that are used to represent a brand, product, 206 00:09:41,370 --> 00:09:43,020 service, or a company. 207 00:09:43,020 --> 00:09:44,520 So if I said to you right now, 208 00:09:44,520 --> 00:09:47,850 close your eyes and I say, Coca-Cola, 209 00:09:47,850 --> 00:09:50,280 and I ask you to describe it, what would you say? 210 00:09:50,280 --> 00:09:52,230 I used to say, well, it's the color red 211 00:09:52,230 --> 00:09:53,580 and it's in script, right? 212 00:09:53,580 --> 00:09:55,380 We can all see that Coca-Cola. 213 00:09:55,380 --> 00:09:57,450 And I say, okay, well what if I just say Coke? 214 00:09:57,450 --> 00:09:58,950 Now describe what you see. 215 00:09:58,950 --> 00:10:00,182 Oh, same color, red, 216 00:10:00,182 --> 00:10:02,910 but now it's in more block letters, right? 217 00:10:02,910 --> 00:10:04,320 Those are trademarks, right? 218 00:10:04,320 --> 00:10:07,680 Those are recognizable, you know, names, icons, 219 00:10:07,680 --> 00:10:09,390 shapes, colors, right? 220 00:10:09,390 --> 00:10:11,940 They represent a brand, the Coca-Cola brand, 221 00:10:11,940 --> 00:10:13,200 but it could also be, you know, 222 00:10:13,200 --> 00:10:17,403 a service or a company in general, the Coca-Cola company. 223 00:10:19,110 --> 00:10:20,430 Then we come to copyrights. 224 00:10:20,430 --> 00:10:21,600 And this is the one right now 225 00:10:21,600 --> 00:10:23,430 that's one of our biggest issues. 226 00:10:23,430 --> 00:10:26,070 Copyright protections are intended to allow the creator 227 00:10:26,070 --> 00:10:29,222 of certain types of work to benefit from being created 228 00:10:29,222 --> 00:10:31,620 and being compensated for their work. 229 00:10:31,620 --> 00:10:34,020 And you know, with the explosion of the internet 230 00:10:34,020 --> 00:10:36,210 and so much information on the internet, 231 00:10:36,210 --> 00:10:38,340 this is a place where copy, you know, 232 00:10:38,340 --> 00:10:41,010 or copyright violations are happening all the time. 233 00:10:41,010 --> 00:10:42,300 Someone sees something on the internet, 234 00:10:42,300 --> 00:10:45,030 they copy and they paste it into their document. 235 00:10:45,030 --> 00:10:46,590 They don't give attribution. 236 00:10:46,590 --> 00:10:48,780 There's no compensation back to the, you know, 237 00:10:48,780 --> 00:10:50,640 the author who might've written that. 238 00:10:50,640 --> 00:10:52,890 And there we have a copyright violation. 239 00:10:52,890 --> 00:10:55,350 Or bringing down a song that you're supposed to pay for. 240 00:10:55,350 --> 00:10:57,420 You know, music you're supposed to pay for and you don't. 241 00:10:57,420 --> 00:10:59,253 That's a copyright violation. 242 00:11:00,210 --> 00:11:03,390 You know, downloading a picture that is copyrighted 243 00:11:03,390 --> 00:11:04,890 and you're supposed to be, you know, 244 00:11:04,890 --> 00:11:06,780 paying rights or royalties to use it. 245 00:11:06,780 --> 00:11:09,000 But instead, you just download it and use it. 246 00:11:09,000 --> 00:11:11,430 That's a copyright violation. 247 00:11:11,430 --> 00:11:13,710 Now copyrights might say copyright 248 00:11:13,710 --> 00:11:15,060 on the bottom of a document. 249 00:11:15,060 --> 00:11:17,490 If a copyright has been registered with a government agency, 250 00:11:17,490 --> 00:11:20,190 you'll see it in the letter C with a circle around it. 251 00:11:21,540 --> 00:11:23,640 So patents, trademarks and copyrights 252 00:11:23,640 --> 00:11:26,010 are all information that's out in the public domain. 253 00:11:26,010 --> 00:11:26,843 We can all see it. 254 00:11:26,843 --> 00:11:28,830 There's nothing secretive about it, right? 255 00:11:28,830 --> 00:11:32,010 The protection really deals with how we use it. 256 00:11:32,010 --> 00:11:34,020 Trade secrets are the opposite. 257 00:11:34,020 --> 00:11:36,540 Trade secrets refer to proprietary business 258 00:11:36,540 --> 00:11:39,660 and technical information or processes or designs 259 00:11:39,660 --> 00:11:41,850 or practices that are confidential 260 00:11:41,850 --> 00:11:43,530 and critical to a business. 261 00:11:43,530 --> 00:11:45,120 So they are not exposed. 262 00:11:45,120 --> 00:11:47,160 And if they were exposed or compromised, 263 00:11:47,160 --> 00:11:49,650 it would really be detrimental to the organization. 264 00:11:49,650 --> 00:11:50,670 So trade secrets, 265 00:11:50,670 --> 00:11:53,130 we're really trying to keep this information secret. 266 00:11:53,130 --> 00:11:55,170 But if there's ever a civil dispute 267 00:11:55,170 --> 00:11:57,517 and you go to court, you know, the judge is gonna say, 268 00:11:57,517 --> 00:11:59,550 "Okay, tell me all the things you did 269 00:11:59,550 --> 00:12:02,070 to keep that trade secret, well, secret." 270 00:12:02,070 --> 00:12:04,320 And if you can't show that you've done 271 00:12:04,320 --> 00:12:06,330 a lot of work to keep it secret, 272 00:12:06,330 --> 00:12:07,830 well, then the judge just might rule 273 00:12:07,830 --> 00:12:09,813 that it's just not a trade secret. 274 00:12:11,610 --> 00:12:13,470 Another type of intellectual property 275 00:12:13,470 --> 00:12:15,930 that you'll be interacting with is software. 276 00:12:15,930 --> 00:12:18,237 And there are different types of software. 277 00:12:18,237 --> 00:12:20,430 Freeware, shareware, open source, 278 00:12:20,430 --> 00:12:21,690 and what's known as COTS, 279 00:12:21,690 --> 00:12:24,390 or Commercial Off the Shelf software. 280 00:12:24,390 --> 00:12:26,610 I'm gonna talk about what each one of these are. 281 00:12:26,610 --> 00:12:29,130 How do you know what type of software it is? 282 00:12:29,130 --> 00:12:32,970 Well, it's always going to be clearly defined in the EULA. 283 00:12:32,970 --> 00:12:36,538 That's a software End User Licensing Agreement. 284 00:12:36,538 --> 00:12:39,570 So freeware is gonna be copyrighted software 285 00:12:39,570 --> 00:12:42,870 that's available at no cost for unlimited usage, 286 00:12:42,870 --> 00:12:45,600 but the developer retains all rights to the program 287 00:12:45,600 --> 00:12:47,313 and controls distribution. 288 00:12:48,240 --> 00:12:51,000 Shareware is also copyrighted software 289 00:12:51,000 --> 00:12:54,030 that is available at no cost for unlimited usage. 290 00:12:54,030 --> 00:12:56,700 Users are encouraged, though, to share the software 291 00:12:56,700 --> 00:13:00,093 to promote a larger distribution and sales. 292 00:13:01,080 --> 00:13:03,120 Open source is where the copyright holder 293 00:13:03,120 --> 00:13:06,930 grants the users the right to use, to study, 294 00:13:06,930 --> 00:13:09,933 to change or modify, and distribute the software 295 00:13:09,933 --> 00:13:12,990 to anyone for any purpose. 296 00:13:12,990 --> 00:13:16,830 And lastly, COTS or Commercial Off the Shelf software. 297 00:13:16,830 --> 00:13:18,480 COTS is copyrighted software 298 00:13:18,480 --> 00:13:22,350 that a company designs and develops to sell a license 299 00:13:22,350 --> 00:13:25,110 and the company retains all rights of the program 300 00:13:25,110 --> 00:13:27,573 and the company controls distribution. 301 00:13:30,330 --> 00:13:31,860 And then we have this really new one 302 00:13:31,860 --> 00:13:34,890 called AI-generated intellectual property. 303 00:13:34,890 --> 00:13:36,870 And this is a fascinating area. 304 00:13:36,870 --> 00:13:39,662 So you use GPT Chat or another program. 305 00:13:39,662 --> 00:13:41,670 Is that copyrighted? 306 00:13:41,670 --> 00:13:43,440 Is that intellectual property? 307 00:13:43,440 --> 00:13:45,090 How do we handle that? 308 00:13:45,090 --> 00:13:48,000 Well, this past March, on March 15th, 2023, 309 00:13:48,000 --> 00:13:49,860 the U.S. Copyright Office announced 310 00:13:49,860 --> 00:13:51,780 that works created with the assistance 311 00:13:51,780 --> 00:13:55,710 of artificial intelligence or AI may be copyrightable, 312 00:13:55,710 --> 00:13:59,910 provided the work involves sufficient human authorship. 313 00:13:59,910 --> 00:14:01,860 Now according to the policy statement, 314 00:14:01,860 --> 00:14:05,550 works created by AI without human intervention 315 00:14:05,550 --> 00:14:08,130 or involvement still cannot be copyrighted 316 00:14:08,130 --> 00:14:12,030 as they fail to meet the human authorship requirement. 317 00:14:12,030 --> 00:14:13,050 So this is really interesting. 318 00:14:13,050 --> 00:14:15,690 There's this long debate that's gonna go on, right, 319 00:14:15,690 --> 00:14:18,000 about what can be copyrighted and what can't 320 00:14:18,000 --> 00:14:20,760 once we have AI in the mix. 321 00:14:20,760 --> 00:14:22,950 And this was the U.S. Copyrights Office 322 00:14:22,950 --> 00:14:25,530 first ever formal guidance on the issue. 323 00:14:25,530 --> 00:14:26,363 So stay tuned. 324 00:14:26,363 --> 00:14:28,260 I know that there'll be a lot more coming. 325 00:14:30,570 --> 00:14:33,690 Next, let's look at a contractual obligation example. 326 00:14:33,690 --> 00:14:35,760 So you may have data in your possession 327 00:14:35,760 --> 00:14:38,910 that you are contractually obligated to protect. 328 00:14:38,910 --> 00:14:41,280 A very common contractual obligation 329 00:14:41,280 --> 00:14:44,730 is being obligated to comply with PCIDSS. 330 00:14:44,730 --> 00:14:46,230 That stands with Payment Card Industry 331 00:14:46,230 --> 00:14:47,460 Data Security Standard. 332 00:14:47,460 --> 00:14:49,350 And this is going to apply to anyone 333 00:14:49,350 --> 00:14:53,193 who accepts credit cards, processes credit cards, 334 00:14:54,090 --> 00:14:55,680 distributes credit cards, right? 335 00:14:55,680 --> 00:14:57,120 If and you touch credit cards 336 00:14:57,120 --> 00:14:58,982 or debit cards in any way, right? 337 00:14:58,982 --> 00:15:02,700 You have a PCIDSS obligation. 338 00:15:02,700 --> 00:15:04,230 Now it's a contractual obligation, again, 339 00:15:04,230 --> 00:15:07,080 for any entity that accepts, processes, transmits, 340 00:15:07,080 --> 00:15:09,723 or stores payment cardholder data. 341 00:15:10,980 --> 00:15:14,250 The dual objectives of PCIDSS are to protect cardholders 342 00:15:14,250 --> 00:15:16,860 against misuse of their personal information 343 00:15:16,860 --> 00:15:20,400 and to minimize the payment card channel losses. 344 00:15:20,400 --> 00:15:23,040 Now the PCIDSS framework includes stipulations 345 00:15:23,040 --> 00:15:25,080 regarding storage, transmission, 346 00:15:25,080 --> 00:15:27,630 and processing of payment card data. 347 00:15:27,630 --> 00:15:31,980 And the PCIDSS standard includes six core principles, 348 00:15:31,980 --> 00:15:34,140 12 categories of required technical 349 00:15:34,140 --> 00:15:36,390 and operational security controls 350 00:15:36,390 --> 00:15:40,410 and testing requirements, as well as a validation 351 00:15:40,410 --> 00:15:42,720 and a certification process. 352 00:15:42,720 --> 00:15:45,593 So knowing the type of data you have is really important 353 00:15:45,593 --> 00:15:49,080 because is this data that's PI or PII? 354 00:15:49,080 --> 00:15:52,320 Is this data that's under a regulatory requirement? 355 00:15:52,320 --> 00:15:54,900 Is this contractual obligation, right? 356 00:15:54,900 --> 00:15:57,180 Is this intellectual property? 357 00:15:57,180 --> 00:15:58,260 Understanding the types 358 00:15:58,260 --> 00:15:59,700 of data you have in your organization 359 00:15:59,700 --> 00:16:02,220 and then understanding what your requirements 360 00:16:02,220 --> 00:16:04,860 and obligations are is absolutely critical 361 00:16:04,860 --> 00:16:07,953 to appropriately and properly protecting that data. 362 00:16:08,940 --> 00:16:11,700 And that, my friends, brings us to a three-second challenge. 363 00:16:11,700 --> 00:16:13,650 Five challenge questions, three seconds each. 364 00:16:13,650 --> 00:16:15,510 You know how to do it. 365 00:16:15,510 --> 00:16:17,670 Number one, the power or right of a legal 366 00:16:17,670 --> 00:16:20,160 or political agency to exercise its authority 367 00:16:20,160 --> 00:16:23,193 over a person's subject matter or territory. 368 00:16:24,030 --> 00:16:26,790 One, two, three. 369 00:16:26,790 --> 00:16:28,263 That is jurisdiction. 370 00:16:29,940 --> 00:16:32,310 Number two, the objective of this regulation 371 00:16:32,310 --> 00:16:34,950 is to protect people in the EU and EEA 372 00:16:34,950 --> 00:16:38,013 from unlawful data collection and processing. 373 00:16:38,910 --> 00:16:40,503 One, two, three. 374 00:16:41,340 --> 00:16:42,813 It's gonna be GDPR. 375 00:16:44,100 --> 00:16:45,630 Number three. 376 00:16:45,630 --> 00:16:48,840 This IP protection is intended to allow the creator 377 00:16:48,840 --> 00:16:51,690 of certain types of original works to benefit 378 00:16:51,690 --> 00:16:54,723 from being created and compensated for their work. 379 00:16:55,710 --> 00:16:57,603 One, two, three. 380 00:16:58,830 --> 00:17:00,330 And that's gonna be copyright. 381 00:17:01,200 --> 00:17:02,520 Number four. 382 00:17:02,520 --> 00:17:04,980 This type of software license grants users 383 00:17:04,980 --> 00:17:08,520 the rights to use to study, to change, 384 00:17:08,520 --> 00:17:12,363 and to distribute the software to anyone for any purpose. 385 00:17:13,320 --> 00:17:14,973 One, two, three. 386 00:17:15,810 --> 00:17:18,030 That's gonna be open source. 387 00:17:18,030 --> 00:17:19,863 And lastly, number five. 388 00:17:21,240 --> 00:17:22,560 This type of data can be used 389 00:17:22,560 --> 00:17:25,293 to identify a specific individual. 390 00:17:26,370 --> 00:17:27,960 One, two, three. 391 00:17:27,960 --> 00:17:29,430 You got it? 392 00:17:29,430 --> 00:17:33,030 That's gonna be personally identifiable information, PII, 393 00:17:33,030 --> 00:17:35,973 sometimes referred to as personal information, PI. 394 00:17:38,040 --> 00:17:41,580 Let's do a security in action about compliance. 395 00:17:41,580 --> 00:17:45,270 You've just been hired as a CISO, good job, 396 00:17:45,270 --> 00:17:47,817 for Health for Life, HFL. 397 00:17:47,817 --> 00:17:50,370 Now one of the services that HFL provides 398 00:17:50,370 --> 00:17:52,770 is personalized weight loss programs 399 00:17:52,770 --> 00:17:54,840 through their web portal. 400 00:17:54,840 --> 00:17:58,063 HFL serves patients from multiple countries. 401 00:17:58,063 --> 00:18:02,850 HFL collects health, demographic, statistical, 402 00:18:02,850 --> 00:18:06,300 and personally identifiable information, PII, 403 00:18:06,300 --> 00:18:08,730 from program enrollees. 404 00:18:08,730 --> 00:18:12,031 Now the program payment is by credit card. 405 00:18:12,031 --> 00:18:14,850 Now HFL has been so focused on its mission, right? 406 00:18:14,850 --> 00:18:17,040 The personalized weight loss programs 407 00:18:17,040 --> 00:18:20,160 that it hasn't dedicated any resources to compliance. 408 00:18:20,160 --> 00:18:22,830 And now that's your responsibility. 409 00:18:22,830 --> 00:18:24,783 So where do you start? 410 00:18:26,250 --> 00:18:27,390 So what do we have here? 411 00:18:27,390 --> 00:18:29,640 While they provide personalized weight loss 412 00:18:29,640 --> 00:18:31,170 through a web portal, 413 00:18:31,170 --> 00:18:33,810 they serve patients from multiple countries. 414 00:18:33,810 --> 00:18:37,290 They collect health, demographic, statistical, 415 00:18:37,290 --> 00:18:40,140 and personally identifiable information 416 00:18:40,140 --> 00:18:41,640 from their enrollees. 417 00:18:41,640 --> 00:18:44,250 And payment is by credit card. 418 00:18:44,250 --> 00:18:46,530 And they haven't really paid any attention to compliance. 419 00:18:46,530 --> 00:18:49,110 And now they're saying, "Okay, we just brought you in. 420 00:18:49,110 --> 00:18:51,120 Help us with compliance." 421 00:18:51,120 --> 00:18:52,830 Where are you gonna start? 422 00:18:52,830 --> 00:18:54,840 So go ahead and put me on pause, jot down some notes, 423 00:18:54,840 --> 00:18:57,440 come on back, and we'll talk through an action plan. 424 00:19:00,300 --> 00:19:01,650 Well, the first thing we wanna do is identify, 425 00:19:01,650 --> 00:19:04,080 specifically, what information, right? 426 00:19:04,080 --> 00:19:07,800 What data set is collected and why we're collecting it? 427 00:19:07,800 --> 00:19:09,990 Remember, earlier when we talked about privacy, 428 00:19:09,990 --> 00:19:12,090 we said one of the things that we wanna make sure 429 00:19:12,090 --> 00:19:15,000 is we're not collecting anything that we don't need. 430 00:19:15,000 --> 00:19:17,730 And we're always specifying the reason, right, 431 00:19:17,730 --> 00:19:19,440 at the time of collection. 432 00:19:19,440 --> 00:19:22,140 So we wanna look at what data sets are being collected 433 00:19:22,140 --> 00:19:23,430 and why they're being collected. 434 00:19:23,430 --> 00:19:26,520 And if it's not necessary, let's not collect it. 435 00:19:26,520 --> 00:19:28,920 And then we wanna identify all locations 436 00:19:28,920 --> 00:19:31,650 where the information is stored, processed, 437 00:19:31,650 --> 00:19:34,919 and transmitted, including third parties. 438 00:19:34,919 --> 00:19:38,670 We wanna identify everywhere where the enrollees live, 439 00:19:38,670 --> 00:19:40,770 so the enrollee jurisdiction. 440 00:19:40,770 --> 00:19:43,530 So again, what are all of the different countries 441 00:19:43,530 --> 00:19:46,290 that we have patients in that we're serving? 442 00:19:46,290 --> 00:19:50,100 And then we're going to identify the corresponding legal, 443 00:19:50,100 --> 00:19:54,150 regulatory, and contractual obligations. 444 00:19:54,150 --> 00:19:56,460 And at that point, then we can begin the process 445 00:19:56,460 --> 00:19:59,130 of cross-referencing compliance requirements 446 00:19:59,130 --> 00:20:01,350 with our current controls and processes, 447 00:20:01,350 --> 00:20:03,930 and determine what it is we need to do. 448 00:20:03,930 --> 00:20:06,480 But we can't just start with putting controls in place 449 00:20:06,480 --> 00:20:07,560 because we really have to start 450 00:20:07,560 --> 00:20:09,720 with what do we have and why do we have it? 451 00:20:09,720 --> 00:20:10,783 Where is it? 452 00:20:10,783 --> 00:20:15,390 You know, where do our enrollees, right, live? 453 00:20:15,390 --> 00:20:17,850 What are all the corresponding legal regulatory 454 00:20:17,850 --> 00:20:19,290 and contractual obligations? 455 00:20:19,290 --> 00:20:21,030 And there's gonna be a lot of them here. 456 00:20:21,030 --> 00:20:25,140 And then we can figure out, okay, what do we need to do? 457 00:20:25,140 --> 00:20:27,540 And being able to develop this action plan 458 00:20:27,540 --> 00:20:29,863 and then execute on an action plan like this 459 00:20:29,863 --> 00:20:33,270 is definitely security in action. 460 00:20:33,270 --> 00:20:36,090 Wow, that's a big word cloud, you know what to do. 461 00:20:36,090 --> 00:20:38,490 When you're ready, I'll see you the next lesson.