In this episode, we're going to talk about sensitive information that you need to keep at the forefront
of your mind as a security analyst.
These include concepts like PII or personally identifiable information, protected health Information,
or Phi.
Both of these really have to do with understanding the different information that you, as an analyst,
need to secure or help keep secure as you're going through in your career.
We're also going to discuss cardholder data, and what specifically you need to is secure in that aspect
of it.
And finally, data loss protection and how that data loss protection holds with both PII, our cardholder
data and our PII as we're moving through as a major factor as you as a security analyst, need to go
through.
The first one I want to discuss is PII.
Now you should have a basic concept of PII from Security+.
But just in case you don't, we'll kind of go into this right.
So PII is your full name and Social Security number.
Most often people forget the full name aspect of it.
And I'm not just talking about your first and last name.
We're talking about your middle name as well, because you have to understand that if I have your full
name, as in your first, your middle, and your last name, depending on how it's spelled, that means
that it can be very limited in scope and I can quickly grab a lot of information about it.
For instance, my full name, Chester with a K is somewhat easy to find on LinkedIn and Facebook and
you name it.
And it probably wouldn't be that difficult to find my associate information.
I believe there's like three, maybe four people in the entire world with the spelling of my first name.
But if you were to throw my middle name into the context, I'm pretty sure there's only one of me.
There's also date of birth.
This is an important aspect of PII as well, because if you identify the date of birth, how many times
have you called a credit card agency or some type of sensitive, uh, framework?
And they're like, oh, can you give me the last four digits of your Social Security number?
What's your date of birth?
Those are important aspects when identifying yourself over a telephone, call your address, both phone
numbers and then the biometric data is valuable for any attacker.
If I can get your fingerprint or your iris print or facial recognition, all of those play in the role
of biometric data.
And with two factor authentication and multi-factor authentication becoming more and more of a thing
within security, that data is a part of your biometric information is going to become more compelling
for an attacker to assume or to gather.
And then finally, your financial information.
If I know your full name, your Social Security number, or even just the last four digits of your Social
Security number, your date of birth, your address and your phone number, how difficult would it be
to call the telephone bank and then gain access to that person's bank account information?
It's incredibly easy, with a spoofing number, to call a bank account or a banking institution, and
then go through the process of identifying yourself with just a date of birth over the last four digits
of your Social Security number.
It may not seem like much, but this is information that we take for granted that needs to be protected.
And you, as a security analyst really need to shine in on the fact that we don't want to store that
data specifically within our banks if it's not properly secured.
Our Protected Health Information, or Phi, include some identifiers that you need to be aware of for
modeling HIPAA, but also from an aspect of just common sense.
Medical record numbers are a big one.
This could be the medical information that a patient or even a psychology patient or psychiatric patient
may have.
And having that medical record number pinpoints to a specific case or a specific person associated with
that case.
By keeping that data safe and secure, we are able to then protect our patients or protect the information
of those that are under our care.
And now I sound like a doctor when I say that.
But you have to remember as a security analyst, those people that information truly is under your care,
the diagnosis information.
Under HIPAA, we are required to keep that information safe and secure, both through encryption methodologies
and within our technology, but not just the diagnosis.
Information, but the treatment as well.
We need to go through and make.
Sure that any associated health information is secured and only available to.
The doctors and nurses associated specifically with that patient and the patient themselves.
That means that not only is a nurse not always able to gather that information, but have access to
the information, you have to remember, it's just like our classifications.
And even though you have the capability and you have the permissions to access secret or top secret
information, there's also that need to know basis associated with it.
If a nurse is a nurse, that doesn't necessarily mean they have access to it.
The nurse has to be working on that patient as well in order to gain access to that specific health
information and then payment information.
We don't likely or often associate payment information with protected health information, but just
by having that patient and health information and payment information associated with that specific
patient, it needs to be secured as well.
When you look at cardholder data specifically associated with a credit card number or the specific information
associated with that card number.
You'd be surprised how often or how secure or unsecure rather, those cards actually are.
If you think about it and I get access to your credit card, I only need to take a photograph of both
the front and the back, and I have full access to the data associated with that specific card.
So keeping this card verification code, the service code, the expiration date, all of that information
is secured.
Our databases is a major undertaking, and we need to go through and make sure that data specifically
with that credit card numbers are all kept secure, regardless if it's a loan or within a specific account
via a retirement account or the credit card itself.
We need to make sure that that information is highly secured and not processed appropriately.
We process credit cards, but we shouldn't be typing down or writing down the information because when
we're done, it needs to be destroyed, or it needs to only have the specific data that we need to process.
The Payment on our machines, usually the last four digits of the credit card and then the name associated
with it.
Data Loss Prevention, or DLP, is not just a specific machine or a specific technology.
It's a wide range of technologies, policies and procedures that we utilize to protect data.
This can be the identification and classification of specific data.
Some data is obviously more important than others, whether it's PII, Phi, or protected cardholder
data.
All of that information needs protected.
If it's sensitive information associated specifically with a company or an organization, then we again
need to keep that data protected.
So we need to identify and then classify it.
And what do I mean by that is we need to recognize that some data is more important than others.
So if we go through and we identify specific data, say a credit card information or sensitive data
such as, hey, our internal processes to handling secure information then we've identified it and then
we need to classify it.
Is it secret?
Is it top secret?
Is it just classified?
All of this is covered in Security Plus.
But as a refresher, just realize for data loss prevention, we need to identify and then classify that
data.
We need to enforce our policies.
You'd be surprised how many people go through.
And we write these policies and nobody follows it.
It's important to enforce those policies.
When we see a mistake made.
We need to provide training when it comes to these policies, and we need to enforce the policies after
the training is completed.
It does no good to write out a big document and make everybody sign it and then say, oh, you read
the policy, so of course you're going to follow it.
We need to go through and enforce that policy and then provide remedial training after a policy is broken.
And then just little tidbits as we go through to ensure that the policy is being followed.
Policy enforcement is probably the biggest barrier to any data loss prevention.
To enforce the policies that are already written, we need to provide real time monitoring.
You'd be surprised with the different technologies that come into play when it comes to data loss prevention.
I know that when I was working a long time ago with a company, I was trying to mail myself my W-2 for
taxes of the year because the W-2 was provided to my email address for my specific company, and I needed
that me mailed over to my private email address.
But when I emailed it through the through the company, the company flagged it instantly because it
had my social security number attached to the W-2, so they blocked it by monitoring.
That's a real time monitoring process that stops sensitive data from leaving the network.
That's a technology based data loss prevention methodology that we can utilize.
We also need to ensure that our data encryption standards are up to date.
If we're using AAS and that's a symmetric encryption algorithm, then we need to make sure that we're
providing the proper permissions associated with it.
Are we using 256.
Are we only using 128.
Are we going to use a specific measure or a asymmetric encryption algorithm first, before we use symmetric
encryption to send that data across the internet?
Whether we're using, we need to follow the policies, and we need to ensure that data encryption is
done not only in transit but in storage as well.
How are we encrypting that data on our laptops or our hard drives, or even on our servers?
We need to make sure that data encryption is at the forefront of our minds when it comes to that technology
that we're utilizing.
There is no way that you're going to be able to remember all that training that you use when you onboarded
into the company from the start, that three day marathon of trainings and awareness that you had to
go through from HR to security to operations, all that training just stacks on top of you on day one,
and you just aren't going to remember it by providing user awareness training.
As we go through the process, whether it's quarterly or monthly or even annually, both in in a formal
and informal manner, we increase our ability to follow policies and procedures as it becomes the forefront
of your employees mind.
In this episode, we covered how to protect user data, whether it's PII, Phi, or cardholder data,
we've identified different topics and subtopics that you should be familiar with.
We've identified different techniques and strategies that you can utilize to keep data private, and
you really need to realize that it's your job to know what types of data must be secure, but also how
to secure it.
Using the different processes associated with data loss prevention.
You need to really think about Cisa is from a top level medium point of view within your career, meaning
we're not really concerned about how the encryption methodologies work or the specific influxes of PII
and Phi, but more how you're going to protect that data.
So you may not get questions specifically asking about what Phi is, but you may get questions associated
with this type of data is associated with Phi, and what kind of encryption you might utilize to protect
those data.
You're not going to see data like that or questions specific like that.
What you are going to see is questions like, uh, this form of phi and it will give you a list of them,
is associated with what type of policy or procedure you should utilize, meaning that you need to understand
the specific policies and procedures associated with Phi and how they can be utilized in the overall
process.
You will also be expected to know specific frameworks or governances associated with it from a regulatory
point of view.
For instance, you may be asked a question about Phi and be able to associate that specifically with
HIPAA or cardholder data and specifically tie cardholder data back to PCI, DSS.
Now we're going to go through those different frameworks as we progress, but just realize that you're
not going to get basic questions associated with PII and Phi, but more middle of the road questions
from an analytical point of view associated with mid-career.
So you need to specifically understand the policies and procedures associated with Phi and PII that
you may see in your own organization.
Those policies and procedures aren't going to be specifically laid out, but expect scenario based questions
that associate specifically with those types of terms that we learned today.