WEBVTT

1
00:00:00.120 --> 00:00:01.410
In this lesson,

2
00:00:01.410 --> 00:00:05.760
we will learn about confidentiality risk considerations.

3
00:00:05.760 --> 00:00:08.580
Confidentiality risk considerations are used

4
00:00:08.580 --> 00:00:11.070
to identify and mitigate threats

5
00:00:11.070 --> 00:00:14.100
that could lead to a compromise of confidentiality,

6
00:00:14.100 --> 00:00:16.290
such as unauthorized access

7
00:00:16.290 --> 00:00:18.840
or disclosure of sensitive information.

8
00:00:18.840 --> 00:00:21.570
Confidentiality risk considerations include

9
00:00:21.570 --> 00:00:24.480
regularly testing incident response capabilities.

10
00:00:24.480 --> 00:00:25.620
In this definition,

11
00:00:25.620 --> 00:00:28.260
an incident refers to any unplanned event

12
00:00:28.260 --> 00:00:32.160
that negatively impacts the confidentiality, integrity,

13
00:00:32.160 --> 00:00:36.060
or availability of an organization's data or systems

14
00:00:36.060 --> 00:00:38.040
that requires a response.

15
00:00:38.040 --> 00:00:39.720
Both sensitive data breaches

16
00:00:39.720 --> 00:00:42.540
and privileged data breaches are examples

17
00:00:42.540 --> 00:00:44.730
of confidentiality compromised.

18
00:00:44.730 --> 00:00:48.660
Both of these breaches prompt formal incident response.

19
00:00:48.660 --> 00:00:49.890
Implementing encryption,

20
00:00:49.890 --> 00:00:52.620
either proactively or in response to a breach,

21
00:00:52.620 --> 00:00:54.360
can be used to secure data

22
00:00:54.360 --> 00:00:56.790
that is both in transit and at rest,

23
00:00:56.790 --> 00:01:00.090
protecting information from unauthorized access.

24
00:01:00.090 --> 00:01:03.630
Additionally, having a comprehensive data leak response plan

25
00:01:03.630 --> 00:01:06.690
and an efficient reporting process can further minimize

26
00:01:06.690 --> 00:01:09.360
organizational damage and legal risks

27
00:01:09.360 --> 00:01:12.210
in the event of a confidentiality breach.

28
00:01:12.210 --> 00:01:14.250
To better understand the relationships

29
00:01:14.250 --> 00:01:17.550
between the confidentiality risk considerations,

30
00:01:17.550 --> 00:01:20.460
let's consider a fictitious healthcare provider,

31
00:01:20.460 --> 00:01:21.810
Riverbend Health.

32
00:01:21.810 --> 00:01:23.100
Throughout the discussion,

33
00:01:23.100 --> 00:01:26.040
keep the following confidentiality risk considerations

34
00:01:26.040 --> 00:01:26.873
in mind.

35
00:01:26.873 --> 00:01:29.460
Incident response testing, encryption,

36
00:01:29.460 --> 00:01:32.520
sensitive data breach, privilege data breach,

37
00:01:32.520 --> 00:01:35.340
data leak response, and reporting.

38
00:01:35.340 --> 00:01:38.340
Riverbend Health is a healthcare provider.

39
00:01:38.340 --> 00:01:41.220
It manages sensitive patient information,

40
00:01:41.220 --> 00:01:44.700
including medical records and billing data.

41
00:01:44.700 --> 00:01:48.390
One day, their security team detected suspicious activity

42
00:01:48.390 --> 00:01:51.480
in the network, indicating a potential breach.

43
00:01:51.480 --> 00:01:53.850
Thanks to regular incident response testing,

44
00:01:53.850 --> 00:01:56.760
the team swiftly implemented its prepared plan

45
00:01:56.760 --> 00:01:59.940
to contain the breach and investigate the source.

46
00:01:59.940 --> 00:02:01.470
During the investigation,

47
00:02:01.470 --> 00:02:02.460
the team discovered

48
00:02:02.460 --> 00:02:05.250
the attacker's exploited a privileged account.

49
00:02:05.250 --> 00:02:08.940
But Riverbend used encryption to protect patient data

50
00:02:08.940 --> 00:02:11.430
and make captured information unreadable

51
00:02:11.430 --> 00:02:14.310
to anyone who didn't have the decryption keys.

52
00:02:14.310 --> 00:02:16.290
Unfortunately, the compromise

53
00:02:16.290 --> 00:02:18.810
of the privileged account allowed the attackers

54
00:02:18.810 --> 00:02:21.780
to gain access to the decryption keys.

55
00:02:21.780 --> 00:02:23.970
As a result, the breach escalated

56
00:02:23.970 --> 00:02:26.190
to both a sensitive data breach,

57
00:02:26.190 --> 00:02:28.650
involving patient contact information,

58
00:02:28.650 --> 00:02:30.450
and a privileged data breach

59
00:02:30.450 --> 00:02:34.380
with compromised medical histories and insurance details.

60
00:02:34.380 --> 00:02:37.380
The breach discovery triggered immediate involvement

61
00:02:37.380 --> 00:02:40.320
from senior leadership and legal counsel.

62
00:02:40.320 --> 00:02:42.120
And as part of their response,

63
00:02:42.120 --> 00:02:45.330
Riverbend Health activated its data leak response plan,

64
00:02:45.330 --> 00:02:49.230
notifying affected patients, applying security patches,

65
00:02:49.230 --> 00:02:51.600
and assessing how the breach occurred.

66
00:02:51.600 --> 00:02:52.920
Throughout the process,

67
00:02:52.920 --> 00:02:54.720
comprehensive reporting insured

68
00:02:54.720 --> 00:02:57.120
executives, regulatory bodies,

69
00:02:57.120 --> 00:03:00.420
and affected patients were informed of the situations,

70
00:03:00.420 --> 00:03:03.870
the actions taken, and future preventative measures.

71
00:03:03.870 --> 00:03:07.980
Now, let's discuss each of the risk consideration concepts

72
00:03:07.980 --> 00:03:09.600
shown in the example.

73
00:03:09.600 --> 00:03:12.660
First, we have incident response testing.

74
00:03:12.660 --> 00:03:14.700
Incident response testing ensures

75
00:03:14.700 --> 00:03:17.640
an organization is prepared to handle incidents,

76
00:03:17.640 --> 00:03:20.340
such as sensitive information breaches.

77
00:03:20.340 --> 00:03:22.860
Regular testing identifies weaknesses

78
00:03:22.860 --> 00:03:24.570
in response procedures

79
00:03:24.570 --> 00:03:27.030
and improves the team's ability to contain

80
00:03:27.030 --> 00:03:29.520
and mitigate information breaches quickly.

81
00:03:29.520 --> 00:03:31.890
By practicing their incident response plan,

82
00:03:31.890 --> 00:03:35.520
the organization may discover and correct security gaps

83
00:03:35.520 --> 00:03:38.460
to reduce the probability of unauthorized access

84
00:03:38.460 --> 00:03:39.840
to confidential data

85
00:03:39.840 --> 00:03:43.290
and ensure a swift response to any security incidents.

86
00:03:43.290 --> 00:03:45.660
For example, Riverbend was able

87
00:03:45.660 --> 00:03:48.120
to quickly implement its prepared plan,

88
00:03:48.120 --> 00:03:50.490
saving valuable time and effort.

89
00:03:50.490 --> 00:03:52.710
Second, we have encryption.

90
00:03:52.710 --> 00:03:54.060
Encryption is essential

91
00:03:54.060 --> 00:03:57.690
for maintaining the confidentiality of sensitive data

92
00:03:57.690 --> 00:04:01.110
by making it unreadable without a decryption key.

93
00:04:01.110 --> 00:04:03.240
Encryption can be used to safeguard data

94
00:04:03.240 --> 00:04:05.310
both in transit and at rest.

95
00:04:05.310 --> 00:04:09.150
However, confidentiality risk can be realized

96
00:04:09.150 --> 00:04:12.090
if an attacker compromises privileged accounts

97
00:04:12.090 --> 00:04:14.790
or gains access to decryption keys.

98
00:04:14.790 --> 00:04:17.880
In such cases, encryption is rendered ineffective,

99
00:04:17.880 --> 00:04:21.090
highlighting the need for strong access controls

100
00:04:21.090 --> 00:04:23.070
and proper encryption key management

101
00:04:23.070 --> 00:04:25.020
to prevent data breaches.

102
00:04:25.020 --> 00:04:27.810
For example, Riverbend used encryption,

103
00:04:27.810 --> 00:04:29.760
which could have protected their data

104
00:04:29.760 --> 00:04:33.600
if the attacker hadn't gained access to decryption keys.

105
00:04:33.600 --> 00:04:36.480
Third, we have a sensitive data breach.

106
00:04:36.480 --> 00:04:39.750
A sensitive data breach involves unauthorized access

107
00:04:39.750 --> 00:04:43.710
to Personally Identifiable Information, or PII,

108
00:04:43.710 --> 00:04:47.730
and other important data such as driver's license details.

109
00:04:47.730 --> 00:04:50.100
From a confidentiality perspective,

110
00:04:50.100 --> 00:04:53.250
sensitive data breach poses a significant risk

111
00:04:53.250 --> 00:04:56.460
because exposed information could be misused

112
00:04:56.460 --> 00:04:58.860
for identity theft and fraud.

113
00:04:58.860 --> 00:05:00.450
To minimize this risk,

114
00:05:00.450 --> 00:05:03.900
organizations should implement strong access controls

115
00:05:03.900 --> 00:05:07.290
and encryption to proactively protect their data,

116
00:05:07.290 --> 00:05:09.930
as well as prompt incident response measures

117
00:05:09.930 --> 00:05:13.290
to contain a breach and prevent further exposure,

118
00:05:13.290 --> 00:05:14.610
should it occur.

119
00:05:14.610 --> 00:05:17.970
For example, Riverbend's patient contact information

120
00:05:17.970 --> 00:05:21.330
was breached, resulting in a sensitive data breach.

121
00:05:21.330 --> 00:05:25.050
Fourth, we have a privileged data breach.

122
00:05:25.050 --> 00:05:28.650
A privileged data breach occurs when highly sensitive data,

123
00:05:28.650 --> 00:05:32.010
such as financial records or health information,

124
00:05:32.010 --> 00:05:35.430
are accessed by unauthorized individuals.

125
00:05:35.430 --> 00:05:36.990
The confidentiality risk

126
00:05:36.990 --> 00:05:39.390
in this type of breach is much higher

127
00:05:39.390 --> 00:05:41.880
due to the critical nature of the data.

128
00:05:41.880 --> 00:05:44.730
As a result, organizations should employ

129
00:05:44.730 --> 00:05:46.500
strict access controls,

130
00:05:46.500 --> 00:05:49.170
such as Multi-factor authentication,

131
00:05:49.170 --> 00:05:51.090
data loss prevention tools,

132
00:05:51.090 --> 00:05:52.560
and privileged account audits,

133
00:05:52.560 --> 00:05:56.370
to minimize the probability of a privileged data breach.

134
00:05:56.370 --> 00:05:59.010
For example, in the Riverbend attack,

135
00:05:59.010 --> 00:06:02.850
the sensitive data breach might not have been as significant

136
00:06:02.850 --> 00:06:05.370
because sensitive data was encrypted,

137
00:06:05.370 --> 00:06:09.090
but the attackers were able to get access to decryption keys

138
00:06:09.090 --> 00:06:12.030
resulting in a privileged data breach.

139
00:06:12.030 --> 00:06:14.910
Fifth, we have data leak response.

140
00:06:14.910 --> 00:06:16.710
A data leak response plan seeks

141
00:06:16.710 --> 00:06:20.580
to reduce the impact of a confidentiality breach.

142
00:06:20.580 --> 00:06:22.680
A data leak response plan involves

143
00:06:22.680 --> 00:06:25.200
quickly identifying the source of the leak,

144
00:06:25.200 --> 00:06:26.880
containing the exposure,

145
00:06:26.880 --> 00:06:30.750
and taking corrective measures to prevent further data loss.

146
00:06:30.750 --> 00:06:32.940
By having a robust response plan,

147
00:06:32.940 --> 00:06:35.460
an organization can minimize the risk

148
00:06:35.460 --> 00:06:38.370
of confidential information being exploited

149
00:06:38.370 --> 00:06:41.280
and maintain trust with their stakeholders.

150
00:06:41.280 --> 00:06:45.870
For example, Riverbend had a robust data leak response plan,

151
00:06:45.870 --> 00:06:49.170
and they did not waste any time in implementing it.

152
00:06:49.170 --> 00:06:52.440
Sixth, and finally, we have reporting.

153
00:06:52.440 --> 00:06:55.290
Reporting ensures all relevant parties,

154
00:06:55.290 --> 00:06:58.530
including internal stakeholders like management

155
00:06:58.530 --> 00:07:01.770
and external stakeholders like regulatory bodies,

156
00:07:01.770 --> 00:07:04.470
are informed of the breach when required.

157
00:07:04.470 --> 00:07:07.050
Timely and accurate incident reporting enables

158
00:07:07.050 --> 00:07:11.130
quick decision making and compliance with legal obligations.

159
00:07:11.130 --> 00:07:14.130
It also facilitates coordinated response efforts

160
00:07:14.130 --> 00:07:15.420
across teams,

161
00:07:15.420 --> 00:07:18.450
ensures transparent communication with stakeholders,

162
00:07:18.450 --> 00:07:22.320
and enables root cause analysis to prevent future breaches.

163
00:07:22.320 --> 00:07:24.750
Inadequate reporting, on the other hand,

164
00:07:24.750 --> 00:07:28.050
can lead to prolonged exposure of sensitive data

165
00:07:28.050 --> 00:07:31.020
and greater reputational and legal consequences

166
00:07:31.020 --> 00:07:32.790
for the organization.

167
00:07:32.790 --> 00:07:36.720
For example, Riverbend was quick to report the breach.

168
00:07:36.720 --> 00:07:39.240
This allowed their customers to take actions

169
00:07:39.240 --> 00:07:40.680
to protect themselves

170
00:07:40.680 --> 00:07:44.790
and helped Riverbend comply with regulatory requirements.

171
00:07:44.790 --> 00:07:49.290
So, remember, confidentiality risk considerations help

172
00:07:49.290 --> 00:07:51.540
identify and reduce the chances

173
00:07:51.540 --> 00:07:54.150
of sensitive information being exposed

174
00:07:54.150 --> 00:07:57.120
through unauthorized access or data leaks.

175
00:07:57.120 --> 00:07:59.880
Regular incident response testing ensures

176
00:07:59.880 --> 00:08:02.910
that teams are prepared to manage breaches quickly.

177
00:08:02.910 --> 00:08:05.520
Implementing encryption helps protect data

178
00:08:05.520 --> 00:08:07.590
both in transit and at rest,

179
00:08:07.590 --> 00:08:10.050
but the decryption keys and access

180
00:08:10.050 --> 00:08:12.690
to privileged accounts must be protected,

181
00:08:12.690 --> 00:08:14.820
or a breach can still occur.

182
00:08:14.820 --> 00:08:16.890
Sensitive data breaches involve

183
00:08:16.890 --> 00:08:19.980
exposure of personal data like PII,

184
00:08:19.980 --> 00:08:22.890
and privileged data breaches involve critical data

185
00:08:22.890 --> 00:08:25.200
like financial and health records.

186
00:08:25.200 --> 00:08:28.260
Finally, a strong data leak response plan,

187
00:08:28.260 --> 00:08:30.480
combined with thorough reporting,

188
00:08:30.480 --> 00:08:33.120
allows organizations to respond quickly,

189
00:08:33.120 --> 00:08:35.520
minimize organizational impact,

190
00:08:35.520 --> 00:08:38.073
and prevent future incidents.