4.6 – Privacy and Policies - Privacy, Licensing, and Policies

• Study notes for IT Professionals

Incident Response and Evidence Handling

• A chain of custody documents everyone who handles evidence to prevent tampering
• Hashing can verify digital evidence integrity, ensuring it remains unchanged from its original state
• All collected evidence should be carefully labeled and cataloged for traceability
• Physical evidence should be placed in a sealed container
• Digital evidence can be signed with a digital signature to confirm its source and integrity

First Responder Responsibilities

• First responders discover and mitigate incidents aiming to limit the scope of the event
• Events can be discovered through logs, monitoring data, or visual observation
• Immediate reporting to internal management or law enforcement is crucial
• Preserving evidence by preventing its destruction is a primary duty of a first responder
• Creating a bit-for-bit or byte-for-byte copy of storage drives captures all data, not just files, as evidence

Data Collection and Documentation

• Drive copies may involve physically removing the drive and using a hardware write blocker to prevent data alteration
• Copies can be made using hardware copying devices or software imaging tools
• Creating a hash for all collected digital data enables verification of its integrity later
• Documentation is critical for internal purposes and potential legal proceedings
• Documentation should include a summary of the event, detailed data acquisition steps, data analysis, and conclusions

Software Licensing

• Software licenses dictate the terms and conditions of software use, including usage rights, copy restrictions, and backup options
• Per seat licenses restrict software use to a specific number of designated users
• Concurrent licenses allow a limited number of users to use the software simultaneously
• Perpetual licenses offer indefinite use after a one-time purchase
• Subscription licenses grant usage rights for a specific period, requiring renewal upon expiration

License Types and Considerations

• Personal licenses are typically perpetual, designed for home users, and often tied to a single device or a user's devices
• Corporate licenses offer more flexibility, and can be per seat or site licenses, often with annual or periodic renewals
• Free and Open Source Software (FOSS) provides free usage and access to the source code
• Closed source or commercial software does not offer source code access, and users receive an executable from the manufacturer
• End User Licensing Agreements (EULAs) contain the terms and conditions of software usage
• EULAs dictate acceptable software use and are often negotiated between the user and the manufacturer

Data Security Standards

• The Payment Card Industry Data Security Standard (PCI DSS) protects credit card information during storage and transmission
• Compliance with PCI DSS is mandatory for entities handling credit card data
• PCI DSS mandates building and maintaining secure networks and systems
• PCI DSS also mandates protecting cardholder data, maintaining a vulnerability management program, implementing access control measures, monitoring and testing networks, and maintaining an information security policy

Personally Identifiable Information (PII)

• Personal information, such as Social Security numbers and driver's licenses, contain PII
• Laws and regulations may restrict how third parties can collect and store PII
• The 2015 US Office of Personnel Management (OPM) data breach compromised the PII of approximately 21.5 million people
• It's critical to implement security controls to prevent unauthorized access to PII, which can be a gateway to sensitive accounts

Data Protection Regulations

• The General Data Protection Regulation (GDPR) in the European Union regulates the use of personal data, including names, addresses, photos, and email addresses
• GDPR aims to give individuals control over their data, including how it's used and stored
• The "right of erasure" allows individuals to request the deletion of their personal data by organizations
• Websites are required to have privacy policies detailing how private information is stored and controlled

Protected Health Information (PHI)

• Protected Health Information (PHI) includes health status, doctor's appointments, and healthcare details
• Regulations, such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA), ensure secure storage and transmission of health information

Data Retention

• Data retention requirements maintain data over a specific time frame for version control, recovery from incidents, and legal compliance
• Data retention enables recovery of previous document versions and restoration after virus or ransomware infections
• Legal requirements may mandate storing email, corporate tax information, customer PII, and maintaining tape backups or offsite storage