1
00:00:06,510 --> 00:00:09,330
- Welcome to lesson 12, deep dive quiz.

2
00:00:09,330 --> 00:00:11,100
Now lesson 12 was all about comparing

3
00:00:11,100 --> 00:00:15,030
and contrasting concepts and
strategies to protect data.

4
00:00:15,030 --> 00:00:16,920
So in support of that,
we did three lessons.

5
00:00:16,920 --> 00:00:19,140
12.1, we talked about data types;

6
00:00:19,140 --> 00:00:21,180
12.2, data classification;

7
00:00:21,180 --> 00:00:23,220
and 12.3, data protection

8
00:00:23,220 --> 00:00:25,200
and data protection strategies.

9
00:00:25,200 --> 00:00:27,720
So let's do a five question quiz together.

10
00:00:27,720 --> 00:00:30,090
Make sure you have pen or
pencil and a piece of paper

11
00:00:30,090 --> 00:00:31,290
so you can write your answers down

12
00:00:31,290 --> 00:00:33,543
and put me on pause as
often as you need to.

13
00:00:35,520 --> 00:00:36,353
Ready?

14
00:00:36,353 --> 00:00:37,590
Let's start.

15
00:00:37,590 --> 00:00:39,330
Okay, in relation to cyber,

16
00:00:39,330 --> 00:00:41,610
what does jurisdiction apply to?

17
00:00:41,610 --> 00:00:43,800
We're gonna choose all that apply.

18
00:00:43,800 --> 00:00:45,600
Residents of data owners,

19
00:00:45,600 --> 00:00:48,810
the type of data, the age of data,

20
00:00:48,810 --> 00:00:51,120
the resonance of data subjects,

21
00:00:51,120 --> 00:00:53,373
or the location of data and systems.

22
00:00:54,600 --> 00:00:56,730
What does jurisdiction apply to?

23
00:00:56,730 --> 00:00:58,730
I'm gonna choose all of them that apply.

24
00:00:59,820 --> 00:01:00,750
It's take your time.

25
00:01:00,750 --> 00:01:01,830
You can put me on pause.

26
00:01:01,830 --> 00:01:03,093
Make those choices.

27
00:01:04,994 --> 00:01:07,126
Well, we know it does
apply to the residents

28
00:01:07,126 --> 00:01:09,120
of the data owner.

29
00:01:09,120 --> 00:01:11,190
Definitely applies to
the type of data, right?

30
00:01:11,190 --> 00:01:12,090
Is it medical data?

31
00:01:12,090 --> 00:01:13,410
Is it healthcare data?

32
00:01:13,410 --> 00:01:15,543
Is it personally identifiable data?

33
00:01:17,910 --> 00:01:20,550
Doesn't really apply
to how old the data is.

34
00:01:20,550 --> 00:01:22,560
That's not a criteria.

35
00:01:22,560 --> 00:01:23,790
It does definitely apply

36
00:01:23,790 --> 00:01:25,890
to the resident of the data subject.

37
00:01:25,890 --> 00:01:29,249
So for example, if you live
in the EU or EEA, right?

38
00:01:29,249 --> 00:01:32,370
Then GDPR will apply to you.

39
00:01:32,370 --> 00:01:35,520
And it does definitely
apply to where our data

40
00:01:35,520 --> 00:01:36,353
and systems are.

41
00:01:36,353 --> 00:01:39,060
So the location of our data and systems.

42
00:01:39,060 --> 00:01:41,700
So really jurisdiction is
gonna apply to all of these.

43
00:01:41,700 --> 00:01:44,400
Residents of data owners, type of data,

44
00:01:44,400 --> 00:01:45,810
residents of data subjects,

45
00:01:45,810 --> 00:01:47,880
and location of data and systems.

46
00:01:47,880 --> 00:01:50,520
The only one on this list
not really applicable

47
00:01:50,520 --> 00:01:52,347
is gonna be age of data.

48
00:01:52,347 --> 00:01:53,670
Do you agree?

49
00:01:53,670 --> 00:01:54,825
Let's check.

50
00:01:54,825 --> 00:01:56,433
And that is correct.

51
00:01:58,740 --> 00:02:00,480
Okay, we're gonna choose
one correct answer

52
00:02:00,480 --> 00:02:03,720
about classification
in each dropdown list.

53
00:02:03,720 --> 00:02:05,040
We have information assets

54
00:02:05,040 --> 00:02:07,560
are generally classified by blank.

55
00:02:07,560 --> 00:02:08,790
I'm gonna read you all the sentences

56
00:02:08,790 --> 00:02:10,230
then we'll look at the list.

57
00:02:10,230 --> 00:02:11,940
Infrastructure and physical assets

58
00:02:11,940 --> 00:02:14,490
are generally classified by blank.

59
00:02:14,490 --> 00:02:16,500
And a blank is a determination made

60
00:02:16,500 --> 00:02:18,450
that an individual is eligible

61
00:02:18,450 --> 00:02:20,760
to access classified information

62
00:02:20,760 --> 00:02:21,990
up to a certain level.

63
00:02:21,990 --> 00:02:24,490
Of course, assuming they
also have a need to know.

64
00:02:25,440 --> 00:02:28,500
So information assets
are generally classified

65
00:02:28,500 --> 00:02:33,500
by sensitivity, severity,
confidentiality, or content.

66
00:02:36,120 --> 00:02:38,910
How will we classifying
our information assets?

67
00:02:38,910 --> 00:02:43,413
Sensitivity, severity,
confidentiality, or content.

68
00:02:44,940 --> 00:02:46,563
I'm gonna choose sensitivity.

69
00:02:48,210 --> 00:02:50,340
Infrastructure and physical assets

70
00:02:50,340 --> 00:02:55,340
are generally classified by
MTD, maximum tolerable downtime,

71
00:02:56,190 --> 00:03:01,190
context, operational criticality,
or their asset value.

72
00:03:02,040 --> 00:03:03,480
So how are we going to classify

73
00:03:03,480 --> 00:03:06,480
our infrastructure and physical assets?

74
00:03:06,480 --> 00:03:08,040
Again, maximum tolerable downtime,

75
00:03:08,040 --> 00:03:12,480
context, operational
criticality, or asset value.

76
00:03:12,480 --> 00:03:13,380
I hear ya.

77
00:03:13,380 --> 00:03:15,810
Operational criticality.

78
00:03:15,810 --> 00:03:17,280
All right, lastly.

79
00:03:17,280 --> 00:03:19,448
A blank, a security clearance,

80
00:03:19,448 --> 00:03:22,950
a security designation,
a security assignment,

81
00:03:22,950 --> 00:03:25,530
or a security classification.

82
00:03:25,530 --> 00:03:26,430
And then I'm gonna close these up

83
00:03:26,430 --> 00:03:27,750
so we can read it for a sec.

84
00:03:27,750 --> 00:03:29,880
Is a determination made that an individual

85
00:03:29,880 --> 00:03:32,910
is eligible to access
classified information

86
00:03:32,910 --> 00:03:35,280
up to a certain level,
and I wanna keep adding,

87
00:03:35,280 --> 00:03:36,930
plus having a need to know.

88
00:03:36,930 --> 00:03:38,490
But what's that gonna be called?

89
00:03:38,490 --> 00:03:40,020
Is that clearance, a designation,

90
00:03:40,020 --> 00:03:42,063
and assignment, or a classification?

91
00:03:43,680 --> 00:03:46,260
It's gonna be a security clearance.

92
00:03:46,260 --> 00:03:47,430
So information assets

93
00:03:47,430 --> 00:03:49,560
are generally classified by sensitivity.

94
00:03:49,560 --> 00:03:51,270
Infrastructure and physical assets

95
00:03:51,270 --> 00:03:53,850
are generally classified
by operational criticality.

96
00:03:53,850 --> 00:03:56,340
And a security clearance
is a determination made

97
00:03:56,340 --> 00:03:57,480
that an individual

98
00:03:57,480 --> 00:03:59,670
is eligible to access
classified information

99
00:03:59,670 --> 00:04:02,727
up to a certain level, assuming
they have a need to know.

100
00:04:02,727 --> 00:04:04,680
Are you ready to check it out?

101
00:04:04,680 --> 00:04:06,963
All right, and that is correct.

102
00:04:08,610 --> 00:04:10,230
Let's do question three.

103
00:04:10,230 --> 00:04:13,230
Data abstraction, data
hiding, and steganography,

104
00:04:13,230 --> 00:04:15,240
which we talked about quite a while ago,

105
00:04:15,240 --> 00:04:17,310
can all be classified as this type

106
00:04:17,310 --> 00:04:19,380
of data protection control.

107
00:04:19,380 --> 00:04:22,260
Privacy enhancing, access management,

108
00:04:22,260 --> 00:04:25,000
cryptographic, or obfuscation

109
00:04:27,900 --> 00:04:31,260
Data abstraction, data hiding,
and steganography, right?

110
00:04:31,260 --> 00:04:32,970
How are we gonna classify them?

111
00:04:32,970 --> 00:04:35,970
Privacy enhancing, access management,

112
00:04:35,970 --> 00:04:39,003
cryptographic, or obfuscation.

113
00:04:40,050 --> 00:04:40,883
What do you think?

114
00:04:40,883 --> 00:04:41,793
Make your choice.

115
00:04:42,749 --> 00:04:45,180
I'm gonna choose obfuscation.

116
00:04:45,180 --> 00:04:46,140
Do you agree?

117
00:04:46,140 --> 00:04:47,610
All right, let's check it out.

118
00:04:47,610 --> 00:04:48,573
And it's correct.

119
00:04:50,310 --> 00:04:53,370
Question four, the distinguishing feature

120
00:04:53,370 --> 00:04:55,770
of this type of intellectual property

121
00:04:55,770 --> 00:04:58,470
is that it remains undisclosed.

122
00:04:58,470 --> 00:05:03,470
Trademark, copyright, an
EULA, or a trade secret.

123
00:05:04,350 --> 00:05:05,940
Okay, so the key here is, right?

124
00:05:05,940 --> 00:05:08,640
That distinguishing
feature is we don't see it.

125
00:05:08,640 --> 00:05:10,860
It remains undisclosed.

126
00:05:10,860 --> 00:05:14,913
Trademark, copyright,
EULA, or a trade secret.

127
00:05:14,913 --> 00:05:16,878
Remember, EULA is our end user

128
00:05:16,878 --> 00:05:18,873
license agreement for software.

129
00:05:21,390 --> 00:05:22,980
I think this one's pretty obvious, right?

130
00:05:22,980 --> 00:05:25,320
It's the one that has secret in its name.

131
00:05:25,320 --> 00:05:26,310
A trade secret.

132
00:05:26,310 --> 00:05:27,690
Let's check.

133
00:05:27,690 --> 00:05:28,683
And there we go.

134
00:05:29,550 --> 00:05:30,690
Our last question.

135
00:05:30,690 --> 00:05:33,960
We're gonna match the regulation
with its constituents.

136
00:05:33,960 --> 00:05:36,330
Now this is an interesting
way to approach this question.

137
00:05:36,330 --> 00:05:39,360
Not matching the regulation
with the type of data it covers,

138
00:05:39,360 --> 00:05:42,210
we're matching the regulation
with its constituents.

139
00:05:42,210 --> 00:05:43,290
So down the left hand side,

140
00:05:43,290 --> 00:05:48,290
we have GDPR, COPPA,
CCPA, HIPAA, and GLBA.

141
00:05:49,170 --> 00:05:50,130
On the right hand side,

142
00:05:50,130 --> 00:05:53,910
we have minors under 12,
EU and EEA residents,

143
00:05:53,910 --> 00:05:56,419
patients, residents of California,

144
00:05:56,419 --> 00:05:58,863
and financial services customers.

145
00:06:00,000 --> 00:06:01,170
So where do we wanna start?

146
00:06:01,170 --> 00:06:04,020
Let's start right up here
with minors under 12.

147
00:06:04,020 --> 00:06:06,993
Which one of these apply
to minors under 12?

148
00:06:08,310 --> 00:06:09,410
I'm gonna go to COPPA.

149
00:06:10,560 --> 00:06:12,330
Now you're welcome to
do these with me, right?

150
00:06:12,330 --> 00:06:13,500
In concert as I'm doing them,

151
00:06:13,500 --> 00:06:15,270
or you know, you can
always put me on pause

152
00:06:15,270 --> 00:06:16,230
and finish this up.

153
00:06:16,230 --> 00:06:17,780
Figure out what goes with what.

154
00:06:19,290 --> 00:06:20,190
All right, what do we have next?

155
00:06:20,190 --> 00:06:22,590
Here up here we have EU and EEA residents.

156
00:06:22,590 --> 00:06:24,420
Well, cool, it's right across from GDPR.

157
00:06:24,420 --> 00:06:26,550
So let's connect those.

158
00:06:26,550 --> 00:06:28,650
Going down our list, we have patients.

159
00:06:28,650 --> 00:06:29,853
That's gonna be HIPAA.

160
00:06:30,900 --> 00:06:32,520
We have residents of California,

161
00:06:32,520 --> 00:06:35,430
conveniently right next
to it's tab right there.

162
00:06:35,430 --> 00:06:38,220
And lastly, GLBA, Gramm-Leach-Bliley Act

163
00:06:38,220 --> 00:06:41,070
is financial services customers.

164
00:06:41,070 --> 00:06:43,230
So the regulation and the constituents.

165
00:06:43,230 --> 00:06:47,040
GDPR, which is a privacy
regulation, EU and EEA residents;

166
00:06:47,040 --> 00:06:52,040
COPA is for collecting data
of minors under 12 online;

167
00:06:52,110 --> 00:06:56,310
CCPA is our California privacy regulation,

168
00:06:56,310 --> 00:06:59,340
so it applies to the
residents of California;

169
00:06:59,340 --> 00:07:03,600
HIPAA is all about protecting
medical or healthcare data,

170
00:07:03,600 --> 00:07:04,950
so that would be patients;

171
00:07:04,950 --> 00:07:07,080
and GLBA, Gramm-Leach-Bliley

172
00:07:07,080 --> 00:07:09,270
is all about protecting financial data,

173
00:07:09,270 --> 00:07:12,690
so that would be financial
services customers.

174
00:07:12,690 --> 00:07:13,590
You like it?

175
00:07:13,590 --> 00:07:15,540
All right, let's check.

176
00:07:15,540 --> 00:07:17,580
And that is correct.

177
00:07:17,580 --> 00:07:19,320
Awesome, great job again.

178
00:07:19,320 --> 00:07:21,060
You're doing really, really wonderful.

179
00:07:21,060 --> 00:07:22,440
Just keep on going.

180
00:07:22,440 --> 00:07:25,920
Up next, we're gonna explain
the importance of resilience

181
00:07:25,920 --> 00:07:29,040
and recovery in security architecture.

182
00:07:29,040 --> 00:07:29,990
I'll see you there.