>> Governance and compliance Part 2.
The learning objectives for this lesson
are to explore industry standards,
to define privacy data,
and to define certification and
accreditation. Let's get started.
Regulations and standards are
tightly integrated together.
The regulations are the legal requirements,
and standards define the details of compliance.
It's critical to understand what jurisdiction you're
operating under as it pertains to regulations.
It might be you have one set of
laws at the national level,
but state and local regulations could differ from that.
It gets more complicated when you start involving
international law because you
may be operating in multiple countries.
You need to identify what
regulations apply to you so that you can
make sure that you are putting
the proper protections in place
for the data that you're responsible for.
But, sometimes we need a little help with this,
because coming up with
all the possible ways to protect
data can be very complicated.
That's where industry standard publishers come at.
The National Institute of Standards or
NIST is a really good example of this.
They're a non-regulatory agency
of the United States government,
and they create best practices and standards
across all technology and science fields.
Included in this is
the special publication 800 series for cybersecurity,
but also the risk management
framework and the Cybersecurity Framework.
The International Organization for Standards, or ISO,
also publishes the Cybersecurity Framework, ISO 27000.
It includes over a dozen standards
for various parts of cybersecurity.
You can use these to apply to your own organization,
to make sure that you're matching what is considered
best practices to ensure that
the data is being protected within your organization.
NIST 800 series is very good.
It's got a lot of areas to look at,
all the way from how to set
proper password policies and
all the way up to encryption.
You can find the ones that apply to
your organization in that 800 series and use those.
Again, they're all free of charge.
They are freely published.
You can get all that information and then build
your own policies to help match
that using this as a base.
The General Data Protection Regulation, or GDPR.
This was created by the European Union to enforce
rules on organizations that
offer service to entities within the EU,
or that collect and analyze data on subjects in the EU.
The key point to remember here is it doesn't matter where
the requesting organization is
or where the data is stored.
You could be an organization that's
only in the United States.
Your server and all the data
is located in the United States,
but you're selling services to individuals in the EU.
You fall under the GDPR and
must protect the EU customers that you
have to higher levels of purity
than what is common in the United States at this time.
The GDPR has seven principles.
These are lawfulness, fairness, and transparency.
Purpose limitation means that you
cannot use that information
for anything other than
the very specific purposes that you're collecting it.
Data minimization means that you're
only collecting the least minimal amount of
data necessary to conduct
business with this person or entity.
Accuracy is to ensure that
the information is kept accurate.
You have storage limitations,
and then you also have to ensure
the integrity and confidentiality of the data.
Then the whole process must have accountability.
GDPR is one of
the most strict regulations in place now to ensure
that the privacy of entities or
individuals is maintained by
an organization that's collecting the data.
We also have the Capability
Maturity Model Integration or CMMI.
This was created for Department
of Defense contractors primarily,
and it has five levels.
The purpose of this was to ensure
that the organization had
a spelled out specified level
of maturity in their
operational or software capabilities.
Level 1 is the initial process,
and this means that there are no processes in
place within the organization and all work is reactive.
Level 2 step it up now,
where many work activities are defined in processes,
but the work is still reactive in nature.
Level 3 moves up to the defined level.
This is where the majority of the work is well-defined in
processes and proactive measures are now in place.
Level 4 is the quantitatively managed level.
This is where well-defined processes are now in place,
proactive measures are in
place and the war output is being analyzed.
Finally, we have Level five or optimizing,
where well-defined processes are in place,
work is proactive, it's also measured,
analyzed, and continuously improved.
This is a very complex process,
and if you go look at it to
see all the items that are covered,
it is very thorough and
it's very difficult to get up to level 5.
But, the good guide to help ensure that
an organization can prove their level of maturity.
Let's talk about some other regulations and standards.
The Children's Online Privacy Protection Act, or COPPA.
This is a US federal law
and it's designed to protect the privacy of
children under the age of 13
in and outside of the United States.
It requires notice of when consent is needed,
and you must protect
the child's data from marketing purposes.
The Payment Card Industry Data Security Standard
or PCIDSS,
the global data protection standard,
was created by the credit card industry.
They didn't want government regulation coming
in into their parts.
They wanted to handle this themselves.
They didn't want regulation on them.
They created this set of regulations to help
identify controls that are
necessary to prevent credit card fraud,
but also to protect the data
of the credit card and debit cards being used.
Again, they didn't want any government stepping in,
so they created this global standard.
It's pretty thorough.
Mirrors a lot of the NIST special publication documents.
You'll see a lot of things in there that
are very detailed,
and it's a good system even to
be using it for other things in your organization.
But any organization that process is
payment card information of any kind falls under PCI.
Then again, it's not a government regulation
and you're not going to go to jail for this,
you're not going to have fines from the government,
but PCI does fine.
They do have the capability to
find you if you're not compliant with this,
and sometimes these fines can be very expensive.
We also have the Cloud
Security Alliance Star certification.
This measure is the security capabilities
and privacy controls of
a Cloud service provider against these
CSA Cloud controls matrix.
Let's talk about privacy data.
This is the type of data that can
uniquely identify an individual.
It can be personally identifiable information,
financial information, and protected health information.
The Health Insurance Portability
and Accountability Act in the United States,
is called HIPAA,
is a US federal law that is designed to protect PHI.
One of the things to mind is H-I-P-A-A, not H-I-P-P-A.
You see this all the time on Twitter
where people are claiming
that certain information is
protected under HIPAA but they always misspell it.
And when they misspell it,
that immediately lets me know that
they really don't have any idea
of what they're talking about,
what is covered or not covered by HIPAA.
But when you have privacy data,
additional controls have to be in place to ensure that
that data remains private and secure.
Certification and accreditation.
Certification is the formal process
that a system owner can be
assured that a complicated technology solution
is configured in a secure manner.
It's a process that will go through to
make sure that first it's going
to do what you want it to do,
and that it will do what the vendor
or what mostly the vendor says it's going to do.
The vendor goes through and
creates the certification for this.
Accreditation, however, is when
the system owner agrees,
and then they accept
the claim that the system has certified.
The key to remember is certification is
the process that goes through by
the vendor to show that their system
is certified and setup in a secured manner,
whereas accreditation is you accepting
that and taking over that system,
and accepting that the system is going to perform the way
the vendor says it is and it is
configured in the specified way.
However, within the US government,
this process has a different meaning because of
the extremely strict and complex measures
that are in place to ensure that systems are compliant.
The certification and accreditation process
has four phases.
The first is the initiation and planning.
This is where the system owner and
the Information Security System Security Officer
identify and acknowledge that
a certification and accreditation
are needed for a specific system.
Then we move to the certification process.
An independent audit will
review the system to
identify the controls that are needed,
and this is based on NIST 800-53.
Then after that, we go to the accreditation.
The certifying authority will verify that
the system meets all the standards
that were found in the audit,
and an authority to operate on ATO will then be issued.
After that, we close it out with continuous monitoring.
This ensures that the system
continues to operate in a compliant manner.
Let's summarize. We went over regulations and standards.
We discussed the National
Institute of Standards and Technology,
NIST and the International
Organization for Standardization.
We also went over standards such as the GDPR,
COPPA, PCIDSS, CMI, and STAR.
We also went over privacy data
and certification and accreditation.
Let's do some example questions.
Question 1, the formal process
of accepting a certified system
from a system builder is accreditation.
Question 2, this standard was created by
the global payment card industry to prevent
fraud and to predict
credit card and debit card information.
Payment Card Industry Data Security Standard, PCIDSS.
Question 3, this US government regulation
is for protecting PHI.
Health Information Portability
and Accountability Act, HIPAA.
The non-regulatory agency of the US government that
creates standards and best practices
across science and technology.
The National Institute of Standards
and Technology, or NIST.
I hope this lesson was
helpful for you. I'll see you the next one.