New EU General Data Protection Regulation Conference 2016 Managing a Data Breach Prevention-Detection-Mitigation By Gerard Joyce Dun Laoghaire Feb 24 th 2016
New EU General Data Protection Regulation Conference Overview 1.What is a “Data Breach” 2.Prevention Exercise 1 3.Detection Exercise 2 4.Mitigation Exercise 3 5.Summary
New EU General Data Protection Regulation Conference What is a “Data Breach? Data that you are “controlling” is accessed / viewed by unauthorised persons. Data could be: Personal Identifiable Information (PII) Trade Secrets Intellectual Property Cause of Breach Could be intentional, criminal Could be accidental
New EU General Data Protection Regulation Conference Risk Assessment Documented Policy Incident Response Data Breach Unauthorised Access Prevention Detection Mitigation
New EU General Data Protection Regulation Conference Exercise 1 What are the threats and what can you do to prevent them? Think Who How What
New EU General Data Protection Regulation Conference Risk Controls – Data Breach Employee - Intentional Unauthorised Access Employee - Unintentional Data Breach IT Glitch Policy Procedures Training & Education Checks Intrusion Prevention Strong Access Control Encryption Anti-Virus Software Data Classification
New EU General Data Protection Regulation Conference Why Detection is Important Fines imposed will be proportional to the “Dwell Time” The longer the theft is going on the more data gets stolen The quicker the breach is detected the quicker action can be taken to mitigate the impact.
New EU General Data Protection Regulation Conference Exercise 2 How would you know you have a breach? Think Who would recognise it first? (You, your customer…) What the signs might be Service delivery, how might that be affected
New EU General Data Protection Regulation Conference Risk Controls – Data Breach Employee - Intentional Unauthorised Access Employee - Unintentional Data Breach IT Glitch Policy Procedures Training & Education Checks Intrusion Prevention Strong Access Control Encryption Anti-Virus Software Data Classification Customer Feedback Service Impacted Unusual Traffic CC Company Contact Corrupted Data IP Published / Copied
New EU General Data Protection Regulation Conference Mitigation – Be Ready to Respond Incident Response Plan More about this in a moment Things you can do beforehand Restrict “lateral movement” in the Network (IT) Identify an individual to take charge Identify partners (3 rd party) that you might need Legal counsel IT Forensics After the Incident – Review your policies and procedures
New EU General Data Protection Regulation Conference Exercise 3 What should be in an Incident Response Plan? Think Who do you call? What do you do, in what order? Who does what?
New EU General Data Protection Regulation Conference Response Plan Incident Lead Incident Team Individual Roles and Responsibilities Protocols During a Breach How to assess scope of breach How to stop the Data Loss Forms to Record Details Contact List of People that might need to be involved Communications (Internal, Customers, DPC, Press) Review – Learn from the Incident
New EU General Data Protection Regulation Conference Risk Controls – Data Breach Employee - Intentional Unauthorised Access Employee - Unintentional Data Breach IT Glitch Policy Procedures Training & Education Checks Intrusion Prevention Strong Access Control Encryption Anti-Virus Software Data Classification Customer Feedback Service Impacted Unusual Traffic CC Company Contact Corrupted Data IP Published / Copied Response Plan Privacy Impact Notification Plan Communications Plan Restrict Lateral Mvmnt Review Controls
New EU General Data Protection Regulation Conference Summary Identify the Information that is precious to you Prevent Make sure it is encrypted at rest and in transit Make sure access to it is restricted on a needs must basis Detect Know asap if it has been compromised Mitigate Have a Plan Plan now for a Breach
New EU General Data Protection Regulation Conference Thank You