Data Protection

This chapter is about data protection. Did you know if an attacker is able to break into your company’s network and steal critical data and the data stolen is encrypted, then it is not a breach? Yes – that is correct even under GDPR; if the data is encrypted, then it’s not considered a breach. Of course, if an attacker hacked their way into your network, they now have knowledge of it and will come back to try to find more data to steal. This is why you want layers of security built into your security program, known as defense in depth (DiD). Encrypting data alone is not enough, but it is an important step.

Understanding where your critical data is located and encrypting data at rest and in transit is critical to protect your organization.

In this chapter, we’re going to cover the following main topics:

• Encrypt your data!
• What is PII? It depends…
• Third-party risk management

Encrypt your data!

I was first trained in cryptography in the United States Air Force where I held a Top- Secret Clearance. My career continued in the cryptography space when I joined Entrust Technologies, which is now Entrust Datacard. Entrust is a public key infrastructure (PKI) development company. I was trained in PKI and encryption. With all of the advances in cryptography, we’re still using algorithms that were developed 30 years ago. Granted, the key sizes are larger, and NIST has begun a quantum-resistant algorithm search. We’ll talk more about quantum computing and encryption later in the chapter.

Introduction to encryption

Even in the cybersecurity space, encryption knowledge is limited. Throughout my career, I’ve been the person on the team that has been the go-to person when it comes to encryption algorithms that should be used. I’ve also realized that the cybersecurity community in general lacks the knowledge and know-how of encryption...

What is PII? It depends…

PII is personally identifiable information. In a nutshell, it is information that identifies a person. This can be information alone that maps back to you, such as your Social Security Number (SSN). This is called direct PII because only one person can have a specific SSN. To make it more confusing, the privacy community now refers to this data as personal information (PI). NIST and the cybersecurity community still use PII to refer to personal information. You need to work very closely with the Legal and Compliance departments. They should be the ones formally defining PII. Before we go on, I need to add a legal disclaimer that when classifying your data, a consultation with a privacy professional is recommended. Depending on the type of data, the location of a company’s headquarters, and where

the data is stored (that is, in which country), the definition of PII may change. For example, if the data is stored in Germany, then the definition...

Third-party risk management

Third-party risk management is critical. If a critical vendor you rely on is compromised, then the breach may also affect your company. We have talked in Chapter 8 about using Snyk’s renovate package to ensure your open source code is up to date and patched. Also, use GitHub’s static application security testing (SAST) code scanning tool to ensure your code doesn’t have vulnerabilities. What if the tool you use has been compromised? This is exactly what happened with the SolarWinds attack. This is why third-party risk management, also known as supply chain management, is so critical.

SolarWinds attack

SolarWinds has a network Monitoring product called Orion. It was used throughout the commercial and federal government. SolarWinds suffered a major cyber-attack in 2020. What makes the SolarWinds attack so devastating is that the attackers were able to gain access to their source code and introduce malware that would allow them to...

Summary

In summary, encrypting your data in transit and while stored is critical in building your security program. In order to ensure that data is encrypted, it should be part of your security baseline. For example, all laptops and servers should be configured to ensure the hard drives are encrypted. Also, disable protocols such as Telnet. Understanding where PII is stored and processed within your network is important to protecting it. Finally, vetting your critical third-party vendors is important to lowering your company’s risk.

In the next chapter, we will be covering security resilience: taking your security program to the next level. We will discuss more advanced security measures that you can take to level up your security program.