Data Protection and GDPR Quiz

Cyber Security Essentials - Module 7b - Application & Data Security

• Application Security: Computer programs designed for specific tasks (e.g., word processors, spreadsheets)
• Applications can run on desktops, local servers, remote servers, or in the cloud
• Insecure applications pose risks to organizations from external attackers
• Application security is directly related to running the computer (Operating System)

Software Development Lifecycle (SDLC)

• Guides the phases of software development or acquisition
• Aims to create high-quality software within a set budget and timeframe
• May include controlled decommissioning (depending on the methodology)
• SDLC specifies various requirements such as business, functional and technical requirements.

System/Software Development Lifecycle (SDLC)

• A formal process outlining requirements: business, functional, and technical needs.
• Includes risk mitigation and control to safeguard system integrity, confidentiality of data, and proper authentication and authorization.
• Cybersecurity is often overlooked until later phases of the development process

DevSecOps

• An approach to software development that integrates security at every stage.
• Emphasizes close collaboration between development, security and operations teams
• Uses automation for security testing and controls within CI/CD pipelines
• Incorporates continuous feedback for security improvement

DevSecOps Phases - Dev

• Threat Modeling: Identifying and analyzing potential threats early in the development process.
• Secure Coding: Adhering to secure coding guidelines and performing code reviews.
• Security as Code (SaC): Integrating security measures directly into the codebase.
• Static Application Security Testing (SAST): Analyzing source code to find vulnerabilities without running the application.

DevSecOps Phases - Ops

• Secure Transfer: Secure communication for data transfer between test and operations environments.
• Security Configuration: Consistent security settings and configurations compliant with security policy.
• Security Scan: Utilizing various methods (DAST, container scanning, infrastructural as code scanning, etc).
• Security Patching: Applying security patches in accordance with the policy
• Security Audit: Comprehensive system review (in production).
• Security Monitoring: Utilizing SIEM (Security Information and Event Management) for centralized control monitoring.
• Security Analysis: Utilizing insights from security monitoring to improve processes.

OWASP

• A non-profit foundation prioritizing worldwide software security improvement.
• Publishes the Top 10 list of critical Web application security risks.
• Provides tools, documentation (e.g., OWASP ZAP) and resources for security assessment, training, and education

Application Security and OWASP Top 10 (2021)

• OWASP Top 10 is a dynamic, updated list of critical web application security risks.
• Regularly updated every four years reflecting current threats

Reducing Security Risks From Applications

• Define security requirements
• Implement sound security architecture practices in application design
• Integrate security into the development life cycle
• Stay informed about application vulnerabilities

OWASP Top 10 Proactive Controls

• Implement access controls (authorization) with Least Privilege
• Utilize cryptography for data protection
• Secure input validation to prevent injection attacks (e.g., SQL injection)
• Address security concerns from the initial stage of development
• Secure by using standard configurations

OWASP Top 10 Proactive Controls (continued)

• Safeguard components using trusted, security-focused libraries
• Implement Multifactor Authentication (MFA), for secure digital identities
• Implement Security Logging and Monitoring
• Utilize Web browser security features, instruct if needed

Data Security

• Data is a crucial asset for operations.
• Data classification categorizes data based on its sensitivity and value.
• Classifications (public, confidential, internal, restricted) are defined in data classification policy.

Data Classification - Security Requirements

• Access and Authentication: Establishing access procedures, user profiles, approvals and validation.
• Confidentiality: Ensuring that sensitive data storage and transmission are secure
• Privacy: Implementing controls to alert on inappropriate personal data use
• Availability: Defining uptime and downtime tolerances for different data types
• Ownership and Distribution: Policies for protecting data from unauthorized distribution and copying
• Integrity: Protecting data during changes with secure management processes

Data in Databases - Typical Issues

• SQL Injection: Attackers inject malicious SQL code to access or manipulate data.
• Unpatched Software: Outdated, vulnerable databases are prone to attacks
• Insufficient Access Control: Lax access controls allow unauthorized access to sensitive data.
• Weak Authentication: Low security passwords/lack of multi-factor authentication increase risks
• Unencrypted Data: Unencrypted data is vulnerable to interception, theft.
• Misconfiguration: Incorrect configurations can lead to security breaches

Data in Databases – Controls

• Encryption: Encrypt data during storage and transmission
• Access Control: Implementing role-based access control (RBAC).
• Authentication: Using strong authentication methods (e.g., MFA)
• Auditing and Logging: Maintaining logs to detect and respond to security issues
• Patch Management: Keeping database software up-to-date and compliant
• Backups: Establishing regular backups and recovery procedures

Data in Databases – Best Practices

• Least Privilege: Granting users only essential access rights.
• Segregation of Duties: Separating roles/responsibilities to prevent internal threats.
• Database Firewalls: Utilizing firewalls to block SQL injections.
• Regular Audits: Performing regular audits and penetration tests in databases to identify weaknesses
• Intrusion Detection Systems (IDS): Implementing IDS to detect unauthorized access attempts
• Data Masking: Implementing data masking in non-production environments.

Data in Databases – Controls at the Database Level

• Referential Integrity: Validating relations between data tables, preventing errors
• Entity Integrity: Ensures that each record has a unique key for identification
• Input Validation: Checking input reliability and prevent injection attacks
• Defined Data Fields (Schema): Define specific data structures and types, deterring errors

The "Data Owner" and other profiles

• Data ownership belongs to individuals/organizations, not IT.
• Data Owners are responsible for setting data classification and security standards.
• Data Custodian manages safe data storage, transport, security, implements tech measures and database structure.
• Data Steward focuses on the appropriate use of the data.

GDPR in a nutshell

• GDPR: EU General Data Protection Regulation (effective since May 25, 2018)
• Aims to protect personal data.
• In Belgium, AVG means "Algemene Verordening Gegevensbescherming".
• Organizations must report data breaches to the relevant authorities (Gegevensbeschermingsautoriteit).
• Personal data: data that can identify an individual.

GDPR Principles

• Lawfulness, fairness and transparency: Data processing must be legal.
• Purpose Limitation: Data collection for a specific, legitimate reason
• Data Minimization: Limiting data collected to what is needed
• Accuracy: Ensuring data is accurate and up-to-date.
• Storage Limitation: Data should not be kept longer than necessary.
• Integrity and Confidentiality: Data protected from destruction or compromise
• Accountability: Organizations responsible for compliance

Personal Data Breach

• Personal data breach: security violation leading to accidental, unlawful data destruction.
• Legal obligation to report breaches to the authorities (e.g., Gegevensbeschermingsautoriteit in Belgium) within 72 hours.

Exercises

• Students are required to complete exercises in LEHO (learning environment) in a specified location (room).