Understanding Information Assurance

0:06Today we're going to talk about the CIA triad. And no, this isn't the Central Intelligence Agency. Although, that would be fun. But it's a little bit different. So we're going to talk about Confidentiality, Integrity, and Availability. That is the CIA triad. And we're going to talk about something called nonrepudiation, and the role it plays within information security. So with no further ado, let's jump in and get started. So the CIA triad, what is it? Why is it important?

0:37Well, the CIA triad-- tri, meaning three-- has three sides, as we can see in this drawing-- confidentiality, integrity, and availability. Those are the three pieces of the CIA triad. Now, why is this important? Because within cybersecurity and information security, we are working to ensure-- that is key here-- that is kind of our job is to ensure the CIA triad. So what does this really mean?

1:09Well, it means we want to work to provide confidentiality and work to provide integrity to our data and the availability of our data. So let's go a little further now and talk about each of these individually and kind of the role that they play in this triad. So we're going to start off with confidentiality. We see Mr. Hush Hush down here. Now, when it comes to confidentiality, what we're trying to do is make sure that only those who are authorized to access our data can access it.

1:44That means those who are unauthorized, well, we don't want those folks to be able to access our data. We want to keep it confidentiality. We want to restrict access to it. We want to use something called the premise of least privilege. And we're going to dive into what this means more later on. But we're going to practice something called least privilege, meaning we provide the least amount of privilege necessary for someone to do their job. So if we have hundreds and hundreds of thousands of files and folders and directories and all of the wonderful resources that we have, we don't want to give everybody out there access to all of these things-- absolutely not.

2:28We want to remove that. We want to say, this person needs access to only this. Maybe this person needs access to these things over here, and this one to a couple of these over here. But that's all that they need access to. That is least privileged. Now, why is that important when it comes to confidentiality? Because if everybody has access to everything, well, there's no confidentiality at that point, necessarily, because we need to control who can have access to everything. We want to make sure that those unauthorized individuals don't have access to any of the things that they shouldn't have access to.

3:03So really, when we're talking about confidentiality, what we've been talking about here, is something called access control. And there are several different types of access control. And we're going to dive into those later on. But this all on this right side of the screen here, well, that's access control in a nutshell. What else can we use to provide confidentiality to our data? Well, just think about this. If you send an email to someone, it's going to go out across the internet. And what is out there on the internet?

3:34Well, there's lots of things on the internet. It goes through different service providers as it jumps through various networks to get from point A to point B to point C, and maybe finally down here to your destination, where that user can open up the email and read the contents. Well, as your emails and other data traverse the wide world of the internet, which is the Wild, Wild West out there, who's to say someone can't go out there and take a look at your email?

4:05Well, because it's absolutely possible. These emails are sent in plain text. So what can we do to combat this? Well, let me make a little room here. We can use something called encryption. So we have our email over here. What we're going to do is we're going to use a key of some sort. And we're going to encrypt this email so that anybody that doesn't have that key, they cannot read the email. So as it traverses the internet and all the different paths it may take before it gets to its final destination, anybody out here who doesn't have the key, they're not going to be able to read that email, meaning we are going to maintain the confidentiality of the contents of that email.

4:47Hey, super cool! So then when it gets down here to its final destination, the user can take their key, and they can open that email, and read it. And voila, there we go. We've achieved confidentiality. So there's a couple of different pieces. We can use encryption to help with confidentiality. We can use access control to help maintain confidentiality. And why are we maintaining confidentiality in the first place? Because our data can be sensitive. It can have trade secrets in it.

5:18Maybe it has sensitive privacy information in it. We need to maintain control of our data. And part of that is maintaining the confidentiality of the data. So that's the C part of the CIA triad. What about the I? Good old integrity-- there we go. So integrity, this is ensuring that our data is accurate. So why is our data not accurate? Did we mess something up? Did we miscalculate something? No, no, no, no, no-- something totally different.

5:49This is dealing with making sure our data hasn't been tampered with. Because just the same example we used before when we were sending an email-- if I go over here, and I take an email, and I send it out, it goes out across the internet and through all the different routers and devices out there to get to where it's finally going through different service providers and such. And the user gets their email. And originally, I was placing an order. So I want to order part number 1234.

6:20And I want to order a quantity of five. That's what was in my email. Well, if someone tampers with that email and they change that order to part number 6321 and a quantity of 500, well, that completely changes my order. And that is why we need to protect integrity. Not to protect our orders, necessarily-- but sure, of course, that's one example-- but because we need to ensure that our data is accurate.

6:57We don't want it to be tampered with. We need to ensure the integrity of our data. And some different ways that we can do this, we can perform error checking. So for example, in this instance, if I use some type of mathematical equation to give me an output of what my original message equals-- maybe it actually equals x3269 in some mathematical equation-- actually, we call this hashing. And this value now represents the email.

7:28So I could actually attach this to the email, and then when it gets to the other side, we could run that mathematical algorithm again. And here it would equal y3112. So that's what that equals. So if I take my out of this message x3269, does this value equal that value? Well, the answer is no. So that means that our message was tampered with. And this is part of something like error checking.

7:59We're looking to see if our data was tampered with and the integrity has been compromised of our data. And if you think about this is one example. But what about when it comes to medical information? Well, that could be very dangerous, as you could imagine. If someone's medical records were tampered with and we didn't have the integrity of the data, well, maybe something they were allergic to gets changed in their medical records, and then they get a treatment, and they have an allergic reaction. You see where this could go. This could be very dangerous.

8:32So again, we're looking to protect the integrity of our data. And really, one of the best ways we can do that is through error checking or something we call hashing, which uses a mathematical algorithm to calculate a value, just like we looked at in this example. So that's the I leg of our CIA triad. We've got one more to go. And that is the A or Availability. So here we're looking to make sure our data is-- well, it's available, meaning we can use it.

9:04If our data is not available to us to use, well, what good is it? We can't actually access it and use it. We've got to have it available to us. So how can we protect our data and make sure it's available? Well, one of the things we can do is practice access control. Just like we talked about in our confidentiality, access control, if we allow unauthorized users to access our data-- well, guess what-- those unauthorized users-- wahahaha-- well, they could go out there and delete our data.

9:39Well, then it's not available to us. Or they could change the data and compromise its integrity. So then it's inaccurate. And if it's inaccurate, it's of no use to us. So again, it's affecting the availability. Another thing we could do is put some type of security controls in place to help protect our data-- make sure it's available-- because we've got all those bad guys out there on the internet, who might do something like cause an attack against our environment. And if they're trying to attack, maybe we can put something like a firewall out here.

10:14And that firewall is going to help protect us. So this is a security control, something we put in place to control the situation. And it's related to security. So we could do a firewall, or maybe an intrusion detection system that we could put in place to analyze the traffic as it's coming through into our environment. So we can help keep the bad guys out, making sure that our data is available. We can also build redundancy into our systems.

10:46So instead of running our data on one server, we actually spread the data across multiple servers in maybe a cluster so that if we lose one of those servers, we still have our data available to us. So redundancy, we could have redundant power. That's pretty important, because if the lights go out-- well, guess what-- our servers go down. Our infrastructure goes down. We lose access or availability of our data. The same for our HVAC or air conditioning and ventilation, because when we're dealing with lots of network equipment and servers and such, it generates lots of heat.

11:21And if it overheats, it's no longer able to function. Well, it affects the availability of the data on those devices. So it's very important that we have redundancy as part of protection for our availability. So those are the three things that make up the CIA triad. That's our Confidentiality, our Integrity, and, of course, our Availability. That's the CIA triad. And that's really what we look to protect within information security.

11:54So we're looking to protect all of these things, because when we do that together, when we have all three legs of the CIA triad, well, then we are going to be winning at security and making sure our data is accurate, and available, and kept confidential. We've got one more thing to talk about, and that is something called nonrepudiation. So it is a strange sounding word, so let's go ahead and break this down. We're going to start with repudiation.

12:25Now, repudiation is the ability to say that you didn't do something. That's what repudiation means. Basically, I didn't send an email, or I didn't open a file. So that is repudiation. But if we put non in front of that, so we have nonrepudiation, it means that you don't have the ability to say this. So let's talk about some of the examples of nonrepudiation.

12:57So when it comes to emails, if you have nonrepudiation, you can't say that I didn't send this email. So as it goes out to its recipient over here and the recipient reads it and says, hey, did you send this email? You cannot say, I didn't do that. See, that's not an option with nonrepudiation. So we have proof that the person sent the email. What about accessing a file, maybe making changes to the file?

13:29So we changed a little bit in the file. And the question comes about, hey, who made the change to this file? Did you do that? With nonrepudiation, the person can't say, I didn't do it, because we have proof that they did. So really, with nonrepudiation, we're looking to prove that someone did something. That's what it comes down to. But this isn't necessarily a bad thing. We're not looking to catch someone in a crime or something, necessarily. It could be that you want to prove that you sent it.

14:01See, I sent this file. I changed that file. I sent the email. Whatever it is, you can prove that you did. But how can this be done? Well, when it comes to proving that you sent an email, let's say, you could use something called PKI. And that is our Public Key Infrastructure. And this is dealing with encryption keys. So earlier we had talked about using encryption to encrypt an email to maintain its confidentiality.

14:31So if I take my key right here, and I go ahead and I use that key to digitally sign my email, which basically means you take the key, and it runs that hashing algorithm that we talked about earlier, and it puts that data into the email. So since you are the only one who has access to this key-- it's your private key. You hold it safe, and you don't let anybody else have access to it-- that way, when this email goes out, and you've digitally signed it, you can say, I sent it.

15:04And you have proof because you signed it with-- that's right-- your key right there. So that is an example of nonrepudiation. You want to prove that you sent it. And since you're the only person on Earth who has access to that private key, you can prove it. You've digitally signed it. And we can sign files as well. You can sign various objects. But again, oftentimes we use PKI, or Public Key Infrastructure, with our private key to sign a piece of data to prove that you did something with it.

15:39And that is all about nonrepudiation. You want to make sure that you can prove that you did something with some digital assets, like files. And again, also, it could be the other way. So if you're looking to see if someone did something, you can find out, again, by nonrepudiation. So that is the CIA triad. Of course, as we talked about earlier, that's our CIA-- Confidentiality, Integrity, and Availability-- and nonrepudiation.

16:10I hope this has been informative for you. And I'd like to thank you for viewing.

0:00I've got a question for you. Have you authenticated today? What kind of question is that? Well, think about it. Have you stopped to get gas on the way to work? You put your credit card up against the proximity reader or you stuck it in the gas pump machine credit card reader and you got to put in your zip code. Okay, that's a type of authentication. When you got to work, did you log into your computer? Well, that's definitely a type of authentication. So you'll see we authenticate all the time. We just really don't think about it necessarily.

0:34So that being said, there's many types of methods for authentication. So what do you say we jump in and talk about some of these types of authentication? All right, we're going to be talking about types or methods of authentication because we authenticate all the time. Right, we log into our computer at work and we provide a username and a password. That's a form of authentication. We go to the ATM. That's right. We go out there to the ATM because we need a little cash.

1:06And what are we going to do? We're going to put our card in there and then we 're going to type in a pen number. Well, that's another type of authentication. Maybe. Maybe you're going on a trip. And this trip, you got to go to the airport to go on this trip because you're going to take an airplane, right? All right, cool. When you go in there and you go through security, what do you provide them with? Well, you got to provide your ticket. That's right. They want to see your ticket. They're going to want to see your ID or your passport, whatever it might be.

1:37But again, we're authenticating here. Maybe. Hey, you sign into your smartphone . You got your smartphone here. And what are you going to do to sign into your smartphone? Well, you're going to provide a pen or maybe you use a pattern. So instead of a pen, you decide to use some type of pattern on your phone that you use with your finger. Well, that's another form of authentication. These are all methods for authentication. So let's talk about the different methods. There are actually classifications that go along with this.

2:11So we're going to start with something you know. Aha. So what is something you know that you might authenticate with? Well, how about a password? That's the most common something you know. Or it could be a pass phrase. So instead of a single password, you have a pass phrase. So your pass phrase could be, you know, I like to eat pizza. And that is your pass phrase. Or we talked about earlier using a PIN number with your credit card or debit card.

2:41Well, there you go. PIN number. What's something else you might know that's often used as a security question. Well, how about mother's maiden name? Yep, that's used quite often. So these are all something that you know. That's key. There's something that you know. Okay. So that is something that you know, as I just said. What's the next one? How about something that you have? Ooh, this is a little different here. So what's something that you carry with you every day that you have?

3:13Well, probably some form of ID. So it could be your driver's license. It could be that you're carrying a passport or maybe a work ID that you have that you carry on a line, or a rent or a net, right? Or maybe you have a device, something like a USB device that we see here. Oftentimes these are known as UB keys or sometimes they can be called smart cards of a form of smart card. But it's something that you have. Well, what about something else that you might have?

3:47Do you have a smartphone with you? Well, yeah, probably so. Most of us do. And on those phones we can install apps. And several of those apps. And an example of an app that you might use for authentication would be some type of authenticator app. Or something else on your computer. Is there anything on your computer that might be able to authenticate you? Not something you type in, but something that's already there that you have. Let's think about this. Think about round, maybe chocolate chips, maybe some coconut in there, maybe some nuts.

4:26That's right, cookies. So cookies can be maintained on our computer when we visit certain sites and they can help authenticate us. So cookies is something else that you might have. So so far we've talked about something that you know. And now something that you have. And next is something that you are. Aha, a little bit different. So something you are. Well, you are an eyeball. Well, you have an eyeball. Most likely. And this can be used to authenticate you.

4:58And really when we're talking about something that you are, we're talking about biometrics. So it could be a retina or iris scan. It could be a scanning of your fingerprints. So you've got fingerprints. Everybody has unique fingerprints. So we could be scanning those. It could be a facial pattern. So it takes a look at your face and all the cre ases and crevices and features. And it comes up with a digital pattern for your face. So it could be a face or a pattern scan.

5:30Or it could be a palm scan. So you can actually scan your palm and everybody has unique patterns within their palm. But again, this is something that you are. So it's these features of the human body. Okay, so we talked about something that you let's hear it. No, something that you have. And now something that you are. What's next? How about something you do? Oh, okay, that's a little different.

6:01So something that you do. We talked about one of these before. When we talked about a pattern unlock on your phone. So that was a pattern. Something that you do. Something you draw. It could be a signature. It could be a signature validation. That's something that you do. It could also be a keyboard typing characteristics. Because believe it or not people type differently. And we can actually analyze the typing patterns that people do.

6:32It's how quickly they press the keys, how intensely they press the keys, those types of things. And you can actually come up with an identification pattern. So again, this is something that we do. So we had something that we know. Something that we have. Something that we are . And now something that we do. All right. And believe it or not, we got one more to do. That's right. Somewhere. Not something but somewhere you are. Because you could be anywhere in the world. And we have systems out there providing security based on rules that are going to be based on where you are.

7:11That's right. So you could be at headquarters. You're at the main office. So when you're at the office and you're sitting there at your computer working and you send data out. Well, it's going to come from the office. And the office devices. Basically the edge devices we call it on the network that connects to the Internet is going to have an IP address associated with it. And this IP address is an address that we use in network communication. And when we have an IP address that's on the Internet, it's known as a public IP address.

7:44Those are globally unique. Okay. So there's only one of them in the world with that IP address. So when you go out and your data goes out to the Internet, it has this IP address here attached to it. Okay. So then when it goes down to a system over here, the system can say what IP address did this come from. And if it came from the IP address associated with headquarters, well, then guess what? You're allowed to access the system or access specific data, whatever it might be.

8:18But again, somewhere you are. And this is generally going to be an IP based rule that is in effect. So you're looking at the IP addresses associated with the actions. So it could be from a specific geographic location because believe it or not, certain IPs are associated with different regions. So maybe the US or Canada or South America or Australia, all these different regions around the world have different IP addresses associated with them.

8:52So if you're coming from a specific country, you can access it. Or maybe if you're coming from a specific country, you cannot access it. You know, there's lots of different examples here. But again, somewhere you are . So let's do a quick review again. We talked about some some things. So something you, what was the list? Well, something you know, very important. Of course, our passwords and pins and such pass phrases, something you have. It could be a USB key cookies on your computer or a smartphone, something you are.

9:25This is your biometrics. Remember our fingerprints, Palm Scan, facial recogn itions, something you do like your signature or a pattern unlock. And then also somewhere you are. So again, that was generally we're looking at your location within the world, the globe. And that location was associated with an IP address. Okay. And those are different methods of authentication.

9:57And we use lots of them. Most commonly we use a username and passwords. A lot of folks today are using smartphone apps or authenticator apps. But is this enough? That's a good question. This fellow down here definitely thinking about it. Is this really enough? Because we know passwords can be hacked, right? It happens all the time. We see password dumps being put on the dark web. Breaches that occur all the time. Where data is stolen from various vendors and such. So we know attackers are out there trying to fool our authentication message.

10:29So bad guys out there looking to get in. So what can we do to ensure this isn't happening? Or at least try to minimize the chances of this happening. Well, guess what? That's what we're going to talk about in the next nugget. There we go. So I will see you there shortly. I hope this has been informative for you, and I'd like to thank you for viewing . [BLANK_AUDIO]

0:06So the question is, is one type or method of authentication enough? Well, today, probably not. And actually, I would recommend you use more than one. What do you mean more than one? More than one method of authentication. And we talked about something you know, something you are, something you have, all those things. Well, what if we use more than one of those to authenticate? Hmm, interesting, that's an interesting thought you got there, Bob. [LAUGHS] Well, we do this, and it's called MFA, or Multi-Factor Authentication.

0:39So let's jump in and talk about this. So the question we're trying to answer is here. What can we do? Well, what do you mean, what can we do? What can we do to ensure our authentication is more accurate than a single username and password? Because if we can build more accuracy into it, more depth, then we can try to prevent the bad guys from getting into our systems, because we know that they go out there and they crack passwords.

1:09So they can figure out what a password is. So if they know what your password is, and they configure your username, well, then they're able to get into your system. Well, that's not cool. Well, no, you're right. It's not. And that's why we want to use MFA, Multi-Factor Authentication. So again, we talked about the things that you have, you know, you are, you do-- all those things. Well, instead just one of those things, what if we used multiple of those things?

1:43And that multiple becomes multi-factor authentication. We're using multiple factors. Oh, OK, I see where we're going with this. So something you-- let's fill this out real quick-- something you know, your password, your PINs. Something you have could be a USB key, your smartphone with an authenticator app. Something you could be your fingerprint, like we see over here, or retinal scan, or palm scan. Then there's somewhere you are.

2:17So this is your location based on your IP addresses. And something you do could be a pattern, or a signature of your keyboard typing characteristics. We talked about those things. So again, the idea here is we want to combine these so we have multiple ways to authenticate. So it's not just one hurdle to get through for the attackers. So you have to enter your username and password. OK, got that. But we talked about just using your username and passwords, and how passwords are cracked. They're found out through data breaches.

2:49So we know this really today isn't enough. So what could we do? Well, we could include a fingerprint scan as well. Oh, OK. Because that's going to be a lot more difficult for an attacker to find your fingerprint somewhere and use it against you-- or something that you have, your smartphone with your authenticator app on it. So this authenticator app. What they do is they use a rotating PIN. So this PIN number might be 348621, but every 60 seconds it rotates to a new PIN.

3:27So next, it might be 213861. Who knows? But the idea is it rotates every 60 seconds. So your PIN at that point changes every 60 seconds. So that means, in this instance, if an attacker wanted to get in, they'd need to know your username and password and have your phone. But not just have your phone. Remember, oftentimes we have to log in with a PIN into our phone, or use a pattern. So that's another one even on top of that. So this is pretty cool. Now, I do want to say these rotating PINs are sometimes known as a One-Time Password, or OTP.

4:04Just it's sometimes used interchangeably, that or a PIN in this instance. But you see it would be much more difficult for an attacker to gain access into the system if they not only had to know your username and password, but also had to be able to provide this PIN. Or you could do somewhere you are. So you can only log in from the headquarters office. Oh, OK. So that, again, makes it more difficult for the attackers. And this is all what we're trying to do. We're trying to lock down our systems. And authentication is the front door to our systems.

4:36So when we have our system, you've got to get through that door to get in. And if this door, the more hurdles we can put in, the more things that the attacker needs to provide, or anybody needs to provide to get through the door, the more secure it's going to be. But we kind of have to balance that out, because if we combine all of these to be able to get through the door, well, that's going to be a real pain for your users every time they want to go through that door. Absolutely. Every time they want to log into a computer system, they've got to have something you know, have, are, somewhere you are, something you do.

5:07That's too much. So there is too much. We can say that. So it's ideal to have, generally, like a username and password and some type of rotating PIN. Now, it's not only in an authenticator app. They also come in little fobs or keychain devices. And oftentimes they look kind of like this here. And they attach to your keychain. It's got a little LCD screen on there. And it'll have that PIN on that screen.

5:37And again, this PIN will change every 60 seconds or so. So those are another option out there for this. So when we're combining multiple methods of authentication, we increase the accuracy of our authentication. So it's more accurate. It's not just a username and password. It's an additional factor of authentication, meaning it makes it harder for those bad guys out there to get into your system, because we want to keep them out. So we can see here when we use multiple factors of authentication, it makes it harder for the bad guys to get in, and it makes it more secure.

6:18And that's why we should be using multi-factor authentication on our systems. I hope this has been informative for you. And I'd like to thank you for viewing.

0:06Something that you are. That's what we talked about earlier. And we said it was basically about biometrics, something that you are-- your fingerprints, your retina scan, your palm scan, all of these things. And biometrics are pretty cool-- stuff right out of the movies from way back, right? We started imagining how we could use this for authentication, and sure enough, it came about, and we're using it today quite often. However, there's something we need to talk about when it comes to biometrics. And that's what we're going to talk about right now. So guess what. This should be no surprise to you, but-- that's right-- errors happen.

0:42And when it comes to biometrics, these are pretty darn complex systems. Let's be honest. And the more complex a system, the more likely an error is going to happen. So when we talk about this, it may be a new type of biometrics that we're working with. So if it's a new type, well, yeah, we're going to have errors with it. Ah, so this could cause us some problems with authentication, as you can imagine. So it may be that a system is having issues when it compares biometrics data.

1:16So let's say it's comparing one fingerprint with another fingerprint. Well, if it's maybe a new algorithm or something that's being used, there could be some problems here. So let's talk about these errors and actually something called error rates. And this is something you should be familiar with. So biometrics-based error rates-- there's four of them we're going to talk about here. So the first one is called the false rejection rate. And this is rejecting a legitimate user.

1:46So if I am authorized to access a system and I've been set up in the system, and I scan my fingerprint, and it tells me, [MIMICS BUZZER] wrong answer, you can't have access, well, that is a false rejection. Now, the false rejection rate is a rate-- how often is this happening? And of course, the lower, the better, because we don't want to be rejecting legitimate users because they need access to the system. And next step, we're going to actually jump down. We're going to skip the crossover error rate.

2:17And we're going go down here to false acceptance rate. And again, this is a rate. So how frequently is this happening? Now, false acceptance, as you can imagine, we're falsely accepting something. So that means we shouldn't accept it. This is permitting unauthorized users. So if someone's unauthorized to access it, and we scan their fingerprint, and we falsely accept their fingerprint and allow them in, that is a false acceptance.

2:49And the false acceptance rate, again, the lower, the better. Absolutely, we don't want to falsely accept someone's biometrics data. Now we're going to go back up. We're going to talk about here our crossover error rate. Now, this is the point at which our false rejection rate and false acceptance rate are equal. So in this instance, again, the lower, the better, because we don't want to reject legitimate users.

3:21We don't want to allow unauthorized users. We've got one more down here, and this is failure to enroll rate, or FER. And this is, basically, failure during the initial account setup. And this is because the system is unable to read or properly assess the biometrics data from the user. So that means it's having a hard time analyzing the biometrics data, which then could lead to false acceptance and false rejection, which would then make our crossover error rate rise, which is exactly not what we want to happen.

4:03So these are some things you should understand about the biometrics systems. And yes, most of them work great, absolutely. However, really why you need to understand this is because if you are working in information security, and you are in charge of deploying a new biometric system-- aha-- you need to consider these factors. That's right. Because these things are going to be published as data with the systems. And you'll have to put it through its testing paces so that you can verify that these rates are acceptable to your organization.

4:39So that is our biometrics factors and things you really need to consider with the systems because they are very complex systems and specialized. I hope this has been informative for you. And I'd like to thank you for viewing.

0:00[AUDIO LOGO] When it comes to data, not all data is equal. And what I mean is we have different types of data. One of those is privacy data. This is data that is considered private and should be kept private. And that's what we're going to talk about right now. All right, we're talking about data privacy because we want to protect my data. And without a doubt, customers want you to protect their data-- absolutely.

0:31And if your company, right down here, if you can't protect your customers' data and it does get breached or compromised and let out into the world, well, guess what? They may look elsewhere for services. And we don't want to lose our customers. We want to keep them happy. So we need to protect their data. And this is where data privacy comes into play. So let's talk about this. So there are privacy laws and regulations out there, and they vary based on where the data is and where the data comes from.

1:04So let's talk about a couple of these. Now, within the European Union, they have something called the GDPR. And this is the General Data Protection Regulation, and this regulates the collection of privacy data from EU citizens. So that's key here-- this is for EU citizens and is about protecting their privacy data. And it doesn't matter if your company operates in Antarctica, let's say.

1:37If the customers are in the EU and they're EU citizens, then that company has to abide by the GDPR. And, believe it or not, if they don't, they can face fines as high as 20 million euros or 4% of the company's prior year's income. Holy moly, that's a lot! That's right. EU takes data privacy very seriously, without a doubt. Now, what about in the US?

2:08Well, within the US, we have various laws and regulations. One of which is HIPAA, H-I-P-A-A, and that stands for the Health Insurance Portability and Accountability Act. And this requires strong protection of health care information. So here we're looking at health care data. So we're talking about patient records, patient information, and such. So here we're protecting health care data.

2:39And many individual states within the US have put into law their own privacy regulations and laws, so you've got to be aware of the location of your customers so that you're going to abide by these laws to avoid penalties. So again, we also have state laws. Now, not all states have a privacy law, but some do, so you kind of got to be aware of this. And the thing is data privacy rules are constantly changing. So as a security practitioner within the information security field, you've got to keep up with these changes.

3:13Now, these are just a couple of them. There's lots of various data privacy laws and regulations because countries all around the world have their own laws and regulations dealing with data privacy. So got to be aware of that. Just you don't have to go memorize them all, but you need to understand that data privacy is a real thing. And we need to protect our privacy data. Now, what is privacy data? That's a good question. We've talked about privacy data, but what really is it?

3:43Well, this is data associated with persons. This is your private information. So what is classified as private information? Well, there's actually a classification called PII, and that is Personally Identifiable Information. So PII is data that, when put together, you can figure out who it belongs to. So it could be if you have a full name along with some other information-- it could be an address, maybe a phone number or a Social Security number or a driver's license number.

4:23All these things can be put together to figure out who certain data belongs to. So this is the whole idea of private information or privacy. You want your personal information to be kept private. It needs to be secured. Because, in the past, companies have collected all kinds of private information from people, and it wasn't successfully secured because they didn't believe it had the merit to be secured. It wasn't some type of secret sauce recipe or trade secrets.

4:53It was just Joe Bob's information and Fred's information and Sally's information. Who cares, right? Well, absolutely we care. This is our private information. It needs to be secured properly. And that's why these regulations have come about. So let's talk about some key concepts of data privacy. Now, number one is informed consent. And this is usually a signed form of sorts or click-through where you accept or consent to something within a website, and it indicates that the individual has consent to your organization for collecting specified data.

5:30So here you're saying, yes, you can collect my personal data. I'm going to provide it to you. OK, so you are consenting to this. And the informed part here is that they're going to tell you how they are going to use your data. So together, those are informed consent. We also have a privacy impact assessment, and this is an assessment of an organization in how it uses private data. How is this data processed?

6:02How is it shared? How is it maintained in accordance with privacy laws and regulations? Next up is minimization, and this is the idea that organizations should only collect as much data as they need to perform the task at hand. So, oftentimes, less is more. The idea is when you are collecting private data, you don't want a bunch of excess data because, as an organization, you have to protect that data. The more you have, the more risk is associated with managing all of that data.

6:34So you only want to collect what you need. And then lastly is destruction. We need to ensure that that privacy data is secured from creation to destruction-- its entire life cycle. And we need to make sure that it is properly destroyed when it's no longer needed. So those are some key concepts-- our informed consent, our privacy impact assessment, minimization, and destruction.

7:04All right, so one more thing I want to bring up is biometrics data. We've talked about it. We've talked about the different error rates within biometric systems. But biometric data is private data. It's someone's fingerprint or retina scan or palm scan. Whatever it might be, it needs to be kept private, especially when it's used as part of a biometric system because that is part of their authentication as well. So I just wanted to bring that up as one last point when it comes to data privacy.

7:36I hope this has been informative for you, and I'd like to thank you for viewing.