Security Risks

Agenda

• Introduction
• What is a data breach?
• Upcoming legislation
• Options for Protection

What is sensitive data?

• Personal Identifying information 
• Credit cards/Bank Accounts
• Credit reporting information
• Credit eligibility information
• SSN/Tax File No

What is a data breach?

• Access by unauthorised users
• Unauthorised disclosure
• Accidental disclosure

Where are the risks?

• Admin staff with elevated access rights
• Unknown sensitive data
• Ex-staff with active accounts
• Unencrypted data
• Unencrypted documents, exports, reports
• Unpatched OS/database
• Default passwords
• Non-supported product versions

Kinds of attack

Source: IBM

Who are they?

Time to discovery

Intrusion time is short

Detection time is long (weeks/months)

Mandatory Disclosure

• Disclosure is required if you have "reasonable grounds" to believe that a "serious data breach" has occurred.
• Serious = capable of harm (physical/financial/psychological)
• Up to 30 days to investigate
• Affects Federal Agencies, companies >$3M

Pending Legislation

• Existing 2008 Voluntary Privacy guidelines
• Proposed legislation - comments closed (Mar 2016)
• later 2016 before Parliament, will include:
• Mandatory disclosure
  • Policy statement
  • Response Plan
    • Notify AIC (Australian Information Commissioner)
    • Notify individual(s)

Protection options

1. Do nothing (we're fine)
2. Prepare for the worst (Policy & Response Plan)
3. Investigate
4. Identify critical risks
5. Take action to protect
6. Repeat regularly

Investigate

• Vulnerability Assessment
  • Database identification
  • Database access 
  • Discover sensitive data
  • Access rights
• Assessment scorecard
• Vulnerability Reporting
• Recommendations
• Exception management (workflow)

Identify critical risks

• Review report
• Review recommendations
• Identify critical risks
• Create hardening action plan

Harden

• Implement action plan
• Re-run Vulnerability Assessment
• Compare Score card

Monitor

• Database access monitoring
• Configuration Access Monitoring
• File Access Monitoring
• Data Masking
• Alerts
• Workflow (integrate with ticketing system)
• Fully automated
• Reduced compliance costs

References - Upcoming legislation

https://www.oaic.gov.au/agencies-and-organisations/guides/data-breach-notification-a-guide-to-handling-personal-information-security-breaches

http://globalcompliancenews.com/consultation-opens-on-serious-data-breach-notification-bill-20151228/

http://www.claytonutz.com/publications/news/201512/04/serious_data_breach_notification_bill-exposure_draft_released_for_consultation.page