9.05 Explain the importance of prohibited content, activity, privacy, licensing, and policy concepts
Introduction
Think of regulated data and information security as the locks and alarms that keep a secure building safe; just as we wouldn’t leave doors unlocked, we must also protect sensitive data and ensure that only authorized people can access it.
In this lesson, you’ll learn about the importance of handling regulated data responsibly, staying compliant with licensing, and protecting against prohibited content. By mastering these skills, you’re not only helping secure the organization’s data but also building a safer digital environment for everyone involved. Each step you learn equips you to solve real-world security challenges, protect privacy, and ensure that you’re a trusted resource for others in maintaining compliance and security.
Understanding Regulated Data
Regulated data refers to information that must be handled in line with federal or state laws. If a company collects and processes regulated data from customers across multiple countries, it must comply with each country’s specific regulations.
Data Breaches
A data breach occurs when confidential or regulated data is accessed, copied, modified, or deleted without authorization. Breaches can be either accidental or intentional:
Malicious Breach (Data Exfiltration): When data is deliberately taken or stolen.
In most cases, breaches involving regulated data must be reported to both the regulatory authorities and any individuals impacted.
Types of Regulated Data
Personally Identifiable Information (PII)
Personally Identifiable Information (PII) is data that can identify, contact, or locate someone. If leaked, it may lead to identity theft.
Common examples of PII include:
Name
Date of Birth
Cell Phone Number
Email Address
Street Address
Biometric Data (fingerprints, facial recognition)
PII can also include responses to challenge questions (like "What is your favorite color?") which are often used in password recovery and identity verification.
Context Matters: Some data may only be considered PII under specific conditions.
For instance:
A static IP address might be considered PII if it can identify someone browsing the web, but a dynamically assigned IP address may not be classified as PII.
Personal Government-Issued Information
This includes PII issued by federal or state governments, such as:
Social Security Number (SSN)
Passport Number
Driver’s License Number
Birth and Marriage Certificates
Such data is regulated by specific privacy laws, like the US Privacy Act, which applies to data managed by the federal government.
Healthcare Data
Healthcare data includes medical and insurance records, hospital records, and lab test results. Healthcare data is particularly sensitive because:
It can be linked to a specific individual or anonymized for research.
Anonymized Data: Personal details are completely removed.
De-identified Data: Identifiers are removed but can be restored by authorized parties.
Healthcare breaches can cause severe reputational damage.
Credit Card Transactions
Payment Card Industry Data Security Standard (PCI DSS) regulates how credit card data is managed, including:
Cardholder data: Name, address, account number, card number, and expiry date.
Sensitive authentication data: CV2 confirmation code or PIN.
PCI DSS outlines specific cybersecurity measures, while other regulations may require general best practice compliance, as guided by frameworks like those from the National Institute of Standards and Technology (NIST).
Data Handling Best Practices
Employee Training: Employees should recognize and handle sensitive data (like PII) responsibly, ensuring:
No unauthorized copies are made
Data isn’t visible or accessible to unauthorized individuals
Examples of Careless Data Handling:
Leaving customer credit card details visible on a desk
Storing credit card numbers in unencrypted database fields
Forwarding personal information in emails, especially in "Copy All" (Cc) fields
Data Retention Requirements
Regulated data also has strict retention guidelines, which may include:
Maximum Retention Periods: Some regulations limit how long data can be stored.
For example, if a company has a customer's credit card data and the customer stops ordering, the company may need to destroy that data securely.
Minimum Retention Periods: Other regulations may require that data and records of its destruction be retained for inspection for a set time. In cases like credit card data, companies may need to log when and how data was destroyed and keep this log accessible for review.
Ensuring Secure Handling and Monitoring of Prohibited Content and Software
In addition to protecting sensitive data, companies must prevent prohibited content and unlicensed software from being used on their workstations. This includes implementing policies and monitoring systems.
Prohibited Content
Employee computers should only be used for work activities. Prohibited content includes:
Non-work-related files and applications
Obscene or pirated materials
Unauthorized personal communications using work accounts
Most employee contracts include acceptable use policies (AUP), which restrict employees from using company resources for downloading games, obscene content, or pirated media files.
End-User License Agreements (EULA)
An End-User License Agreement (EULA) is a contract that outlines usage terms for software.
Key points include:
Usage Restrictions: Software is often licensed for use on one device or by one user at a time.
Personal vs. Corporate Use: Some software (e.g., freeware) may only be available for personal use and cannot be legally installed on company-owned devices.
If an employee installs personal-use-only software on a company device, it may violate the EULA.
License Compliance Monitoring
Software licenses, especially for companies, often require product keys or product IDs for activation and support.
To stay compliant:
Corporate Licenses: Large companies typically buy corporate licenses allowing software installation on multiple devices for simultaneous use.
License Monitoring: Companies must ensure that:
Valid Licenses are used (e.g., not using a personal license as a corporate license).
Expired Licenses are removed from devices, and renewal dates are tracked.
Monitoring tools, like inventory and desktop management software, can help companies manage compliance by tracking user limits and renewal dates.
Open-Source Licenses
Open-source software is often free and can be modified, shared, and examined by programmers. However, open-source licenses can vary:
Some require any redistributed versions to also be open-source.
Commercial open-source software may have additional subscription requirements for enterprise use.
It’s essential to check the specific terms of open-source licenses, as they can have unique conditions.
Digital Rights Management (DRM) and Media Content applies to digital media, restricting how purchased files can be used:
DRM may limit music or video files to a set number of devices.
Unauthorized removal of DRM is common but results in prohibited content.
Enterprise Monitoring: Companies should monitor devices to ensure they don’t host unlicensed or pirated media, as this content is typically prohibited under corporate policies.
Security Incidents in Technical Support
While providing technical support, you may encounter or need to report various security incidents.
Security incidents can include:
Malware Infections: Viruses, worms, or Trojans infecting a computer or network.
Data Breaches or Exfiltration: Unauthorized access or copying of data to another network.
Unauthorized Access Attempts: Attempts to break into systems, often through phishing or a fake (evil twin) Wi-Fi access point.
Denial of Service (DoS) Attacks: Attempts to disrupt network functionality.
Unlicensed Software: Unauthorized software installations on company computers.
Prohibited Content: Illegal media, obscene content, or unauthorized confidential files on a PC.
Incident Response Plan (IRP)
An Incident Response Plan (IRP) provides guidelines and procedures for handling security incidents. Larger organizations usually establish a Computer Security Incident Response Team (CSIRT) for managing these situations.
The CSIRT:
Acts as a single point of contact for reporting incidents.
Is staffed with managers, technical personnel, and senior decision-makers (up to director level) who handle both minor and major incidents.
CSIRT’s Role: Members assess the situation, make decisions, and take appropriate action based on the severity of the incident.
Initial Response to an Incident
The actions taken immediately after detecting an incident are critical:
Notify CSIRT: The appropriate person within CSIRT should be informed immediately to act as the first responder.
First Responder’s Role: This person assesses the situation, takes charge, and initiates the necessary response steps.
Involving Law Enforcement
If a CSIRT is not available, contacting law enforcement directly may be appropriate. However, this will transfer control of the investigation outside the organization. This decision is typically made by the business owner.
Whistleblowing Exception: If you have credible evidence that senior staff are posing an insider threat or disregarding regulations, you may need to report this independently.
Digital Forensics Overview
Digital forensics is the science of collecting computer-based evidence that meets legal standards for court use. Like DNA or fingerprints, digital evidence is often latent, meaning it isn’t visible to the naked eye and must be analyzed through specific tools or processes.
Most organizations don’t retain in-house forensic experts, so forensic investigations are typically handled by law enforcement agencies. When a forensic investigation is likely, technicians and managers must understand the investigative processes, support the investigator, and avoid actions that could compromise evidence integrity. Any errors in handling evidence could be challenged in court.
Documenting Incidents and Collecting Evidence
The following steps are essential for collecting and preserving evidence during a security incident:
Identify Scope of Incident: Determine the affected host systems and storage devices. If needed, isolate these systems from the network.
Document the Scene: Use photos, videos, and audio recordings to capture the scene. Investigators should log every action taken while handling evidence.
Gather Live Evidence: If a device is still powered on, use live forensic tools to capture data from cache, memory, and the file system. If tools aren’t available, consider recording evidence displayed on the screen.
Power Off Devices: If feasible, disable encryption and screen locks before powering down each device.
Forensic Imaging: Create image copies of hard disks and removable drives using a forensic imaging tool, which uses a write blocker to prevent any changes to the original data during imaging.
Hash Verification: Make a cryptographic hash of each disk and its forensic image to ensure that the evidence hasn’t been altered since collection.
Secure Storage and Chain of Custody: Store physical devices in tamper-evident bags with a chain-of-custody form for secure transportation and storage.
Chain of Custody
The chain of custody ensures evidence is handled securely and consistently:
Documentation of Handling: The chain of custody form logs who collected the evidence, who handled it, when it was accessed, and where it was stored. Each handler must sign the form, noting their actions.
Evidence should only be accessed under controlled conditions, as the chain of custody must account for all handling from the crime scene to the courtroom, proving the evidence remains unaltered.
Summary
When handling prohibited content, licensing, and privacy concerns, you’re not just protecting data—you’re safeguarding trust and building a responsible workplace. This lesson has equipped you with the essentials to identify and manage regulated data, maintain license compliance, and ensure the secure handling of sensitive information.
By applying these practices, you help prevent unauthorized access, ensure legal compliance, and support a secure work environment. Whether it’s removing unlicensed software or securely erasing sensitive data before recycling, every step reinforces data integrity and protects the people and organizations you serve.
