More Related Content
More from trevor501353 (20)
Recently uploaded (20)
![Traktor Pro Crack + License Key Free Download [2025]](https://cdn.slidesharecdn.com/ss_thumbnails/generalsciencenotes-250303184328-484ccf79-thumbnail.jpg?width=560&fit=bounds)
![GetData Graph Digitizer With Crack Free Download [Latest]](https://cdn.slidesharecdn.com/ss_thumbnails/mcqsbestgkwithfaisal-250228143540-407a79de-thumbnail.jpg?width=560&fit=bounds)
IH - Privacy Incidents - Module 4 Powerpoint Presentation.pptx
- 1. American Security and Privacy, LLC Incident Handler Certification Dr. Kevin F. Streff Founder and Managing Partner 1 Incident Handler Certification
- 2. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Dr. Kevin Streff American Security and Privacy, LLC Founder & Managing Partner www.americansecurityandprivacy.com Kevin.Streff@americansecurityandprivacy.com 605.270.4427 2
- 3. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Agenda 3 Module 1 Incident Response Overview Module 2 Incident Response Laws and Regulations Module 3 The Fit of Incident Response in Information Security and Privacy Programs Module 4 Privacy Incidents Module 5 Security Incidents Module 6 Incident Response Program Overview Module 7 Step 1 - Preparation Module 8 Step 2 - Detection and Analysis Module 9 Step 3 - Contain, Eradicate, and Recover Module 10 Step 4 - Post Incident Activity Module 11 Incident Response Testing Module 12 Third Party Incident Response Requirements Module 13 Incident Response Auditing Module 14 Incident Response Metrics
- 4. American Security and Privacy, LLC Incident Handler Certification Module 4 PRIVACY INCIDENTS 4
- 5. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incidents Alteration of personal data when personal data has been unlawfully changed. This could be, for example, data that is incorrectly updated on a system accidentally or deliberately. 5
- 6. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incidents Brute force attack when an attacker tries a large number of possible keyword or password combinations to gain unauthorized access to a system or file. 6
- 7. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incidents Cryptographic flaw a weakness in the security of a system that would allow a hacker to access sensitive information. 7
- 8. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incidents Data emailed to incorrect recipient where an email containing personal data is sent to the wrong email address. This could be data about one person or multiple individuals. 8
- 9. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incidents Data of wrong data subject shown in client portal where personal information about one or more individuals is shown within the Online service area belonging to another person. 9
- 10. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incidents Data posted or faxed to incorrect recipient where a fax or piece of post containing personal data is sent to the wrong fax number or postal address. This could be data about one person or multiple individuals. Denial of service when a network or server, such as a website, is maliciously flooded with manufactured traffic (typically using botnets) to either cause it to fail or flood it with so much traffic that legitimate users can't access it. Failure to redact when personal data was disclosed without the appropriate redaction, or if the redactions made were inadequate. Failure to use bcc when personal data was disclosed due to an organization not using blind carbon copy (bcc) recipients in an email. Usually bcc is used to ensure personal email addresses are not shared inappropriately with other customers, clients or organizations. 10
- 11. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incidents Hardware/software misconfiguration any hardware or software misconfiguration leading to a disclosure of information. For example, permissions on a folder set incorrectly, or failing to use a robot.txt file. 11
- 12. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incidents Incorrect disposal of hardware computers, laptops or other devices are not fully cleared of personal data or had any personal data it contains otherwise anonymized or encrypted. 12
- 13. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incidents Incorrect disposal of paperwork paperwork containing personal data has been disposed of without it being shredded or otherwise destroyed. Personal information should not be identifiable once paper files have been disposed of. 13
- 14. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incidents Loss/theft of device containing personal data an electronic device (for example laptop, phone or tablet) containing personal information of others has been misplaced or stolen. This may be of particular concern if the data is not sufficiently secure, for example the device has not been encrypted. 14
- 15. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incidents Loss/theft of paperwork or data left in insecure location papers containing personal data are not secured, for example locking the paperwork in a cabinet or similar; or papers are misplaced or stolen. 15
- 16. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incidents Verbal disclosure of personal data when personal data is shared or disclosed verbally to an inappropriate party. 16
- 17. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Malware足 a general term used to refer to a variety of forms of hostile or intrusive software including computer viruses, worms, Trojan horses, spyware, adware, scareware, and other malicious programs. Malware is short for malicious software. Phishing an attempt to obtain information by posing as a trustworthy entity, deceiving recipients into sharing sensitive information (such as usernames, passwords, or credit card details) or by encouraging them to visit a fake website. Ransomware a type of malware that unlawfully encrypts a users files and demands a ransom to unencrypt files, usually in the form of cryptocurrency. Unauthorized access an unauthorized individual has gained access to personal data. This can include unauthorized disclosures. This incident type is used both in instances where an individual has unlawfully accessed or disclosed information and where a third party has forcibly accessed a system. Privacy/Security Incidents 17
- 18. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incident s VIOLATING PRIMARY USE 18
- 19. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Privacy Incident s UNAUTHORIZED DATA AGGREGATION 19
- 20. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Critical: A very high impact incident, such as a customer-facing service being down for all customers Major: A significant impact incident, such as a customer-facing service being unavailable for some customers Minor: A low impact incident, such as a minor inconvenience to customers Incident Response Levels 20
- 21. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Level 1 A critical incident that affects a large number of users in production. Level 2 A significant problem affecting a limited number of users in production. Level 3 Causes errors, minor problems for users, or a heavy system load. Level 4 A minor problem that affects the service but no serious impact on users. Level 5 A low-level deficiency that causes minor problems Levels 21
- 22. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification The financial institution determines how many levels, their definitions, and the steps that will be taken based upon these levels. Specific incidents can have more specific steps Risk-based program Levels 22
- 23. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Summary Both security and privacy incidents need to be reflected in your incident response and business continuity plans Risk-based approach Identify the potential issues prior to them occurring 23
- 24. American Security and Privacy, LLC Incident Handler Certification American Security and Privacy, LLC Incident Handler Certification Dr. Kevin Streff American Security and Privacy, LLC Founder & Managing Partner www.americansecurityandprivacy.com Kevin.Streff@americansecurityandprivacy.com 605.270.4427 24 American Security and Privacy, LLC