Operational Lifecycle - Protect

Operational Lifecycle - Protect

1. Data Life Cycle Management (DLM)

   • From creation to final disposition
   • Lowering risk of data breaches by reducing volume of data that is stored
   • A well written and well planned DLM strategy provides data-handling policy reviews for types of data, processing activities, storage, sharing and data destruction, as well as setting forth employee roles and responsibilities
   • In large orgs the DLM allows for identification and timely address of possible issues stemming from conflict of laws and differences in compliance with local legilsation. Challenge to recognize a problem before it becomes an emergency.

2. Data Life Cycle Management Principles

   • Info governane - decision rights and accountability framework to encourange desirable behavior in the treatment of information.
     • Main benefits are increase control over data, regulatory compliance (minimizing biz risk) and reduced costs.
   • 1. Enterprise Objectives - What Data is critical for the business. Data must be prioritized.
   • 2. Minamalism - Discard all data unless a business or legal reason exists to keep it
   • 3. Simplicity of Procedure and Effective Training - policy documents and training manuals should be easy to understand
   • 4. Adequacy of Infrastructure - ensure it can support the desired level of data management
   • 5. Infosec - crossfunctional efforts that include infosec personal during development of DLM framework ensures appropriate tech controls and depth of awareness across org.
   • 6. Authenticity and Accuracy of One's Own Records - how will you prove your records if challenged. Need proactive procedures.
   • 7. Retrievability - design into the system an easy/fast reliable way to access the data
   • 8. Distribution Controls - implement access controls and employ software to encrypt the data.
   • 9. Auditability - Companies should consider the use of 'hashing' 'digiital signatures' and logging of network events to provide a framework of testability
   • 10. Consistency of Policies - Data retention policies should be consistently implemented. Inconsistencies should be explained fully to ensure no gaps or misunderstandings.
   • 11. Enforcement - must be simple, consistent and accurate. Helps employees do the right thing.

3. Information Security Practices -

   • Security aims to ensure the confidentiality, integrity and availability of the data as stored, transmitted and used.
     • Security does not distinguish data from data that identifies an individual by default. Instead, security provides controls for risk management, including policies, procedures, guidelines and bst practic
       • Many types of controls
   • Privacy addresses the rights of individuals to control how and to what extent information about them is collected and processed.
     • Two types of controls
       • Negative controls
         • Enable privacy but constrain business (win/lose).
       • Positive controls
         • Enables privacy and business practices. Minimize or elimitate threats and take adv of opps to leverage data for realization of biz objectives
     • Security does not always need privacy but privacy always needs security.
   • Information security is build upon risk management practices to provide
     • Identification of risk
     • Selection and implementation of measures to mitigate risksis
     • Tracking and evaluation of risk to validate the fist tow parts
     • CIAAA (Confidentiality, Integrity. Availabliity. Accountability. Assurance.
   • Existence of risk does not imply data is insecure. Instead risk is identified, controls and selected and implemented and risk is tracked based on pre-defined categories
   • ISO 27000 best practice recommendations on info sec management.
   • Once risk management framework is determined, infosec provides management, technical and operational controls to reduce probably damange, loss, modification or unauthorized access.
   • Three high level roles
     • Executive -CEO, ISO etc
     • Functional
       • Security engineer/operations/professionals
     • Corollary
       • Support functional memebers.

4. Fourteen areas of competency from US-CERT IT

   • Data Security - application of principles = confidentiality of data.
   • Digital Forensics - knowledge and undesrtanding of digital investigation. To reconstruct events related to a security incident.
     • Prepare, acquire, analyze and report.
   • Enterprise Continuity - ensures an org can perform basic business after potential catastrophic events.
   • Incident Management - How to prepare/prevent and how to learn from an inccident.
   • IT Security Training and awareness - raise employee awareness about basic info security and train individuals with security roles to increase knowledge
   • IT Systems Ops and Maintenance - ongonig app of pricniplas to protect infrastructure and the info on it.
   • Network Telecommunications Security - application of principles, polices to ensure security of basic network and telecommunciation services and data in maintaining the hardware layer
   • Personnel Security - to prevent employee caused breaches i.e. background checks
   • Physical and Environmental Security - i.e. Alarm, Video surveilance. For natural or man made threats
   • Procurement - evaluate purchases of IT products or services. Risked based solicitation.
   • Regulatory Standards and Compliance - Refers to the application of principles to meet applicable info sec laws and regulations including industry best practices
   • Security Risk Management - a balanced approach to assessing risks to info
   • Strategic Security Management - determine long term performance of an org. Practice of external business analyses, such as customer analyses . Goal to ensure that an orgs IT principles and practices are in line with its mission statement.
   • System and Application Security - Refers to integrating infosec into an IT system during the system development lifecycle prior to operations and maintenance.

5. Privacy by Design

   • Seven Foundational Principles
     • Proactive, not Reactive; Preventative, not Remedial
     • Privacy as the Default Setting.
     • Privacy Embedded into Design (at every state)
     • Full Functionality - Positive Sum, not Zero-Sum - Seeks to accomodate all legitimate interests.
     • End to End Security - Full Life Cycle Protection.
     • Visibility and Tranparency - to both users and providers alike = accountability and Trust.
     • Respect for User Privacy
   • Foundational Principles of PbD Paradigm
     • Being Proactive
     • Respect for Users

6. Analysis and Assesments

   • Privacy Threshold Analysis can be completed before a Privacy Impact Analysis.
   • PIAs, risk assessments and security assessments further assist in facilitating the Protect phase.
   • PIAs
     • assess existing controls and suggests or provides remedial actions or mitigations necessary to avoid or reduce risks.
     • Systematic process that identifies and evaluates from the perspective of all stakeholders the potential effects on privacy of a project. Includes a search for ways to avoid or mitigate negative privacy impacts.
       • Identify potential effects that a project or may have upon personal data privacy.
       • Examine how any detrimental effects on privacy might be mitigated
   • DPIAs
     • Data Protection Impact Assesments (EU)