Page 1
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 1/96
Security Professionals Conference 2014
SEM02P:PREVENTING A LAWSUIT
BY PREPARING FOR ABREACH
!"#$ &'"&()"*+,-"( ./01*$'2 340/* 5 6($7/*8$'2 ") 9,:,$ ‘ $
;"#$<=,:,$$>/#1 5 ?@A@B CDEFGHAA
!,8"( IJ$2,+,&()"*+,-"( ./01*$'2 .K/0$,L$8' 5 M,K$ ‘ "L,($ N"++1($'2 N"LL/O/,J$2,+,;<=,:,$$>/#1 5 ?@A@B PQHFC@RG
Page 2
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 2/96
Security Professionals Conference 2014
General Copyright Statement
S=$8 K*/8/(',-"( L/,7/8 '=/ 0"K2*$O=' ")'=/ 0"('/(' '" '=/ K*/8/('/*8> 6(L/88
"'=/*:$8/ ("'/# $( '=/ +,'/*$,L8T1KL",#/# 0"('/(' 0,**$/8 '=/ N*/,-7/N"++"(8 IU*$V1-"(FW"(N"++/*0$,LF.=,*/IL$J/ L$0/(8/T :=$0= O*,('8 18,O/
'" '=/ O/(/*,L K1VL$0 :$'= 8-K1L,'/#0*$'/*$,>
Page 3
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 3/96
Security Professionals Conference 2014
Session Outline
• X,0JO*"1(# – 6($7/*8$'2 ") 9,:,$ ‘ $ .28'/+
– 9,:,$ ‘ $ X*/,0= W"-Y0,-"( Z,: ?#/Y($-"(8B
• X*/,0=/8
• NL,88 I0-"( Z,:81$'
• &(8-'1-"(,L [/8K"(8/ ?.28'/+\N,+K18B – ./01*$'2 ]"8'1*/ I88/88+/(' – &()"*+,-"( ./01*$'2 ]*"O*,+
– I N,+K18^8 [/+/#$,-"(_ M,K$ ‘ "L,($ NN
Page 4
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 4/96
Security Professionals Conference 2014
Agenda - continued
• ]L,( )"* , X*/,0= ` Z,:81$' – &#/(-)2 M/2 ]L,2/*8 ` a/0$8$"( b,J/*8
– 6(#/*8',(#$(O '=/ c]L,$(-de
– &()"*+,-"( ./01*$'2 ]*"O*,+
– &(0$#/(' [/8K"(8/ ]L,(
– X*/,0= [/8K"(8/ ` W"-Y0,-"( ]L,(
– N"++1($0,-"(8 ]L,(
Page 5
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 5/96
Security Professionals Conference 2014
University of Hawaii System
• RA 0,+K18/8
• 3(/ [/8/,*0= 6($7/*8$'2 – bf(", ?g,O8=$K 0,+K18B
– GATAAA 8'1#/('8• S:" X,00,L,1*/,'/
6($7/*8$-/8 – 69 h/8' 3,=1_ GQAA
– 69 9$L"_ HAAA
• ./7/( N"++1($'2N"LL/O/8 – 9,:,$ ‘ $ NN_ QHAA
– 9"("L1L1 NN_ HQAA – M,K$‘ "L,($ NN_ @QAA
– M,1,$ NN_ RDAA – Z//:,*# NN_ PCAA
– b,1$ N"LL/O/_ HAAA
– h$(#:,*# NN_ GPAA
Page 6
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 6/96
Security Professionals Conference 2014
Information Technology Services
• .28'/+ 340/
• [/K"*' '" '=/ i$0/ ]*/8$#/(' ") &()"*+,-"(S/0=("L"O2 ` N=$/) &()"*+,-"( 340/*
•
REQ )1LL -+/ 8',d• RR@ 8'1#/(' /+KL"2//8
• H O*"1K8_ – S/0=("L"O2 &()*,8'*10'1*/
–
I0,#/+$0 S/0=("L"O$/8 – b,(,O/+/(' &()"*+,-"( .28'/+8
– I#+$($8'*,-7/ j*"1K
• &.3 #$*/0' */K"*' '" i] &S ` N&3
Page 7
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 7/96
Security Professionals Conference 2014
ITS Responsibilities
• .28'/+F:$#/ $()"*+,-"( 828'/+8 `8/*7$0/8 – .'1#/(' $()"*+,-"( 828'/+ – ]/*8"((/L 828'/+ – k$(,(0$,L 828'/+ – a,', :,*/="18/ \ "K/*,-"(,L #,', 8'"*/ – Z/,*($(O +,(,O/+/(' 828'/+ – l+,$LT :/VT $#/(-'2 +,(,O/+/('\#$*/0'"*2 8/*7$0/8T
0"('*,0' 8/*7$0/8T =/LK #/8JT #/8J'"K 81KK"*'T K="(/T8$'/ L$0/(8$(O
• W/':"*J &()*,8'*10'1*/• &()"*+,-"( ./01*$'2
Page 8
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 8/96
Security Professionals Conference 2014
Characteristics & Complexities
• l,0= 0,+K18\#/K,*'+/('\1($' $8 c1($m1/e
• 9$O=L2 #/0/('*,L$n/# – N,+K18/8\#/K,*'+/('8 8/' 1K '=/$* ":( 8/*7/*8 ,(#
8/*7$0/8
– N,( */m1/8' 18/ ") $(8-'1-"(,L #,',
• W" c,1'="*$'2e "7/* 0,+K18/8
• X1' #" +,(,O/ ` +,$(',$( '=/ 828'/+F:$#/ 8/*7$0/8 ,(# (/':"*J $()*,8'*10'1*/
Page 9
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 9/96
Security Professionals Conference 2014
HAWAI !I STATE LAWS
Page 10
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 10/96
Security Professionals Conference 2014
Hawai !i Revised Statutes 487-N
• a/Y($-"( ") ]/*8"(,L &()"*+,-"(_
&(#$7$#1,L^8 Y*8' (,+/ "* Y*8' $($-,L ,(# L,8'(,+/ $( 0"+V$(,-"( :$'= ,(2 "(/ "* +"*/") '=/ )"LL":$(O #,', /L/+/('8T :=/( /$'=/*'=/ (,+/ "* '=/ #,', /L/+/('8 ,*/ ("'/(0*2K'/#_ – ."0$,L ./01*$'2 W1+V/*o
– a*$7/*^8 L$0/(8/ (1+V/* "* 9,:,$ ‘ $ &#/(-Y0,-"( W1+V/*o – I00"1(' (1+V/*T 0*/#$' "* #/V$' 0,*# (1+V/*T ,00/88
0"#/T "* K,88:"*# '=,' :"1L# K/*+$' ,00/88 '" ,($(#$7$#1,L^8 Y(,(0$,L ,00"1('o
Page 11
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 11/96
Security Professionals Conference 2014
HRS Definition of “Breach”
c./01*$'2 V*/,0=e +/,(8 ,( $(0$#/(' ") 1(,1'="*$n/#,00/88 '" ,(# ,0m1$8$-"( ") 1(/(0*2K'/# "*1(*/#,0'/# */0"*#8 "* #,', 0"(',$($(O K/*8"(,L
$()"*+,-"( :=/*/ $LL/O,L 18/ ") '=/ K/*8"(,L$()"*+,-"( =,8 "001**/#T "* $8 */,8"(,VL2 L$J/L2 '""001* ,(# '=,' 0*/,'/8 , *$8J ") =,*+ '" , K/*8"(>I(2 $(0$#/(' ") 1(,1'="*$n/# ,00/88 '" ,(#
,0m1$8$-"( ") /(0*2K'/# */0"*#8 "* #,', 0"(',$($(OK/*8"(,L $()"*+,-"( ,L"(O :$'= '=/ 0"(Y#/(-,LK*"0/88 "* J/2 0"(8-'1'/8 , 8/01*$'2 V*/,0=>
Page 12
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 12/96
Security Professionals Conference 2014
HRS Reporting Requirements
• ]*"7$#/ ("-0/ '" ,d/0'/# $(#$7$#1,L8 – a/80*$K-"( ") $(0$#/('
– S2K/ ") K/*8"(,L $()"*+,-"( $(7"L7/#
– [/+/#$,-"( ,(# K*/7/(-7/ ,0-"(8 ',J/( – N"(',0' K="(/ (1+V/* )"* ,##$-"(,L $()"*+,-"(
– I#7$0/ '" ,d/0'/# $(#$7$#1,L
• h*$U/( */K"*' '" 8','/ L/O$8L,'1*/ :$'=$(':/('2 #,28 ,p/* #$80"7/*2 ") 8/01*$'2V*/,0=
Page 13
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 13/96
Security Professionals Conference 2014
Other Hawai !i State Reporting
Requirements• b,(#,'"*2 [/K"*-(O ") ILL &()"*+,-"(
.28'/+8 :$'= ./(8$-7/ &()"*+,-"(
• [/K"*' ,LL 828'/+8 0"(',$($(O 8/(8$-7/$()"*+,-"( ,(# 1K#,'/ '=/ $()"*+,-"( ,'L/,8' ,((1,LL2
Page 14
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 14/96
Security Professionals Conference 2014
UH Information Security Policy
• .28'/+F:$#/ /q/01-7/ K"L$02• lG>GRH_ ./01*$'2 ` ]*"'/0-"( ") ./(8$-7/
&()"*+,-"(
• ]*"+1LO,'/# $( GAAP
• a/Y($-"( ` /q,+KL/8 ") 8/(8$-7/ $()"*+,-"(
• a,', 0,'/O"*$n,-"(_ K1VL$0 ` 8/(8$-7/
• ["L/8 ` [/8K"(8$V$L$-/8• k*,+/:"*J )"* 18/ ` K*"'/0-"( ") 8/(8$-7/
$()"*+,-"(
Page 15
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 15/96
Security Professionals Conference 2014
Also in UH Policy…
• N=,(0/LL"*8 ,(# i$0/ ]*/8$#/('8 ,*/*/8K"(8$VL/ )"* /L$+$(,-(O ,LL1((/0/88,*2 8'"*,O/ ") K/*8"(,L$()"*+,-"(
• IL8" */8K"(8$VL/ )"* $+KL/+/(-(O,KK*"K*$,'/ 8/01*$'2 +/,81*/8 )"*
828'/+8 1(#/* '=/$* K1*7$/: '=,' +18'*/',$( 8/(8$-7/ $()"*+,-"( )"* /88/(-,L6($7/*8$'2 "K/*,-"(8
Page 16
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 16/96
Security Professionals Conference 2014
THE BREACHES
Page 17
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 17/96
Security Professionals Conference 2014
Breach #1: April 2009Kapi !olani CC – 15,000 affected
• &S 8',d :,8 ("-Y/# '=,' , 0"+K1'/* :,8V/=,7$(O 8'*,(O/L2
• N"+K1'/* 18/# '" K*"0/88 Y(,(0$,L ,$#
,KKL$0,('8 $(K1r(O 8'1#/('^8 K/*8"(,L$()"*+,-"( $('" '=/ 6. a/K'> ") l#10,-"(^8Y(,(0$,L ,$# :/V8$'/
• N"+K1'/* ,L8" ,00/88/# , #/K,*'+/(',L
YL/8/*7/* '=,' 8'"*/# K/*8"(,L $()"*+,-"(• k"1(# +,L:,*/ :$'= , 8$O(,'1*/ '" c8'/,L 18/*s88/(8$-7/ #,', ,(# 0"++1($0,'/ :$'= 8K/0$Y/#$('/*(/' :/V8$'/8e
Page 18
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 18/96
Security Professionals Conference 2014
Breach #2: March 2010
Honolulu CC – 35 affected• N"+K*"+$8/# 0"+K1'/* 0"(',$(/# 0*/#$'
0,*# (1+V/* )"* 8'1#/('8 /(*"LL/# $(g$O=' '*,$($(O 0"1*8/
• .'"*,O/ ") 0*/#$' 0,*#8 :,8 1(,1'="*$n/#,(# $( 7$"L,-"( ") 69 K"L$02
Page 19
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 19/96
Security Professionals Conference 2014
Breach #3: July 2010
M"
noa – 53,000 affected• ./*7/* :$'= 8/(8$-7/ $()"*+,-"( :,80"+K*"+$8/#
• a,',V,8/ 0"(',$(/# K/*8"(,L$()"*+,-"(T ..W8 "* 0*/#$' 0,*#$()"*+,-"( )"* ,(2"(/ :=" #$# V18$(/88:$'= '=/ ],*J$(O 340/ V/'://( RCC@
,(# !1(/ GAAC
Page 20
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 20/96
Security Professionals Conference 2014
July 2010: Executive Directive
• 69 ]*/8$#/(' $881/# ,( lq/01-7/ a$*/0-7/'" 69 ./($"* Z/,#/*8=$K ?i]8 ` N=,(0/LL"*8B
• Q*# J(":( V*/,0= 8$(0/ /(,0'+/(' ")
$#/(-'2 '=/p L,:• a$*/0'/# /7/*2 /q/01-7/ '" +,J/ $' , K*$"*$'2
'" K*"'/0' 8/(8$-7/ $()"*+,-"( V/0,18/ ")'=/ =$O=L2 #/0/('*,L$n/# "*O,($n,-"(
• b18' #/8$O(,'/ , 8$(OL/ $(#$7$#1,L '" "7/*8//1($'^8 $()"*+,-"( K*"'/0-"( ,(#0"+KL$,(0/ K*"O*,+
Page 21
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 21/96
Security Professionals Conference 2014
Executive Directive – cont.
• a$*/0'/# '=/ #/8$O(,'/# 0,+K18/q/01-7/ '" /(81*/ )1LL 0"+KL$,(0/ '"_
– [/K"*' ]& 828'/+8 ?K/* 8','/ L,:B– ]1*O/ 1((/0/88,*2 ..W8o /(81*/ 0*/#$' 0,*#
K*"0/88$(O $( 0"+KL$,(0/ :$'= 69 K"L$02– [/7$/: ,(# 8'*/(O'=/( $('/*(,L 0"('*"L8 ,*"1(#
=,(#L$(O ") 8/(8$-7/ $()"*+,-"(
Page 22
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 22/96
Security Professionals Conference 2014
Breach #4: October 2010
UH West Oahu – 40,000 affected• 6($7/*8$'2 ("-Y/# V2 I,*"( S$'18T ]*$7,02
a$*/0'"* ") '=/ Z$V/*'2 N",L$-"(T , ("(FK*"Y' O*"1K V,8/# $( h,8=$(O'"( a>N>
• k$L/8 :/*/ #$80"7/*/# 18$(O , j""OL/ 8$'/8/,*0=
• k$L/8 :/*/ 1KL",#/# '" , 69h3 ),01L'2
:/V 8/*7/* $( a/0/+V/* GAAC V2 , ),01L'2+/+V/* :=" V/L$/7/# '=/ 8/*7/* :,88/01*/#
Page 23
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 23/96
Security Professionals Conference 2014
Google Search Results
Page 24
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 24/96
Security Professionals Conference 2014
http://www.staradvertiser.com/news/breaking/108760734.html
Page 25
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 25/96
Security Professionals Conference 2014
http://www.staradvertiser.com/news/20101118_Data_breaches_earn_UH_an_F.html
Page 26
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 26/96
Security Professionals Conference 2014
Page 27
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 27/96
Security Professionals Conference 2014
“The purpose of this Act is to strengthen the safeguards forsecurity breaches of personal information held by governmentagencies.”
Page 28
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 28/96
Security Professionals Conference 2014
Page 29
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 29/96
Security Professionals Conference 2014
Class Action Lawsuit
Complaint“Seeks an injunction: (a) forbidding UH from violatingthe constitutional rights of its students, faculty andguests, as protected by the right to privacy of the
United States and Hawaii Constitutions by theunauthorized released of private information,including but not limited to SSN and (b) mandatingthat the University of Hawaii take appropriatemeasures to ensure the protection of privateinformation within its possession.”
Page 30
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 30/96
Security Professionals Conference 2014
Class Action Lawsuit – cont.
“Seeks monetary damages to compensate classmembers for expenses including but not limited toenrollment in credit reporting monitoring
program(s), time spent in monitoring credit reports,credit card and bank statements, and identity theftinsurance.”
Page 31
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 31/96
Security Professionals Conference 2014
Lawsuit Progression &
Timeline• !1(/ GARR_ l()"*0/ L$-O,-"( ="L# "( ,LL$(7"L7/# /+,$L8 ?$( K*"0/88_ +$O*,-"( '"j""OL/B
• !1(/ GARR_ 69 YL/# +"-"( '" #$8+$88• !1L2 GARR_ 3(/ +"*/ V*/,0= t '=/p ")
K,K/* #"01+/('8 0"(',$($(O 0*/#$' 0,*#(1+V/*8 t GDAA ,d/0'/#
• !1L2\I1O GARR_ N"+K$L$(O L$8' ") IZZ,d/0'/# $(#$7$#1,L8 ?/8'> "7/* @AA +,(="1*8 t Q ://J8T @u K/"KL/B
Page 32
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 32/96
Security Professionals Conference 2014
Compiling List of AffectedIndividuals
• .',*'/# :$'= CPTAAAu $(#$7$#1,L */0"*#8
• i/*2 K*"VL/+,-0 t #$# ("' =,7/ /("1O=$()"*+,-"( '" 1($m1/L2 $#/(-)2 $(#$7$#1,L8
• l,*L2 V*/,0=/8 F K1*O/# 8/(8$-7/ #,', /L/+/('8• 9,# '" ,U/+K' '" */0*/,'/ #,', )*"+ +1L-KL/ #,',
8"1*0/8
• [/m1$*/# +,(1,L 7$81,L $(8K/0-"( ") v/,0=v
*/0"*# '" 0"**/0' $()"*+,-"( ,(# */+"7/#1KL$0,'/8
• l(#/# 1K :$'= CATAAAu /L$O$VL/ )"* 0*/#$'+"($'"*$(O
Page 33
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 33/96
Security Professionals Conference 2014
Timeline – cont.
• !,(> GARG_ h"*J$(O "( '/(',-7/ 8/UL/+/('
• !,(> GARG_ b"-"( )"* ]*/L$+$(,*2 IKK*"7,L") ./UL/+/('
• k/V> RT GARG_ N"1*' =/,*$(O "( b"-"( )"*]*/L$+$(,*2 IKK*"7,L
• k/V> RDT GARG_ N*/#$' +"($'"*$(O 8/*7$0/V/O$(8 +,$L$(O "1' ("-0/8 '" 8$O( 1K )"*8/*7$0/8o 8/*7$0/8 :"1L# V/O$( IkSl[ Y(,L0"1*' ,KK*"7,L
Page 34
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 34/96
Security Professionals Conference 2014
FINALLY SETTLED!
• b,*0= RT GARG_ ]1VL$0 ("-Y0,-"(_ ;"$('K*/88 */L/,8/T /+,$L VL,8' '" ,LL 69),01L'2\8',d\8'1#/('8T IL1+($I88"0$,-"(T K"8'8 "( 0,+K18 :/V 8$'/8T(/:8K,K/*8
• !"# %&' %(&%) *+,"- .//012"- 30",456
7,1 "//5"-8 0595+256:• G 2/,*8 ") 0"(-(1"18 0*/#$' +"($'"*$(O
` &a S=/p N"(81L',-"( ,(# [/8'"*,-"(
Page 35
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 35/96
Security Professionals Conference 2014
Lawsuit Lessons Learned
• I881+/ '=,' 0*/#$' +"($'"*$(O :$LL V/*/m1$*/#
• l(81*/ */0"*#8 0,( V/ 0*"88F:,LJ/# V,0J'" , 1($m1/ $(#$7$#1,L
• k"* 0*/#$' +"($'"*$(O */O$8'*,-"(K*"0/88T =,7/ ,( c/q0/K-"(e K*"0/#1*/
$( KL,0/ ?*/8"L1-"( )"* '="8/ '=,' '=$(J'=/2 ,*/ /L$O$VL/ ` #/+,(# '" V/*/O$8'/*/#B
Page 36
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 36/96
Security Professionals Conference 2014
Plaintiff’s Motivation?
;<=>?==<@A)
"#$ %& '(&')( '*+,*( - )-.,*/01
Page 37
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 37/96
Security Professionals Conference 2014
Evaluation of Cause of
Breaches• l,0= V*/,0= "001**/# +, 2+1-"B1, 1C ?D
/1-+9#• N"+K1'/*\8/*7/* 3. "* ,KKL$0,-"(8 ("'
+,$(',$(/#• ./(8$-7/ #,', ("' =,(#L/# $(
,00"*#,(0/ :$'= 69 K"L$02
• W" #,', */'/(-"( 80=/#1L/• c.0"K/F0*//Ke )"* 18,O/ ") #,',o #,',
J/K' )"* cK"88$VL/e */F18/ L,'/*
Page 38
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 38/96
Security Professionals Conference 2014
Information Security
Landscape in 2010• ]*/L$+$(,*2 ,(,L28/8 ") $(0$#/('8_
– h/,J #/8J'"K 0"+K1'/* 8/01*$'2 K*,0-0/8 – &(8/01*/ "K/*,-"(,L K*,0-0/8
–
&()"*+,-"( */',$(/# L"(O/* '=,( (//#/# – N,(("' $#/(-)2 :=" =,8 ,00/88 "* K"88/88$"( ") 69 8/(8$-7/
$()"*+,-"( ?$(0L1#$(O '*,0J$(O &[X */m1/8'8B
– ./*7/*8_ b$818/# "* ("' +,(,O/# ,KK*"K*$,'/L2
– 69 K"L$02 ("' )"LL":/# "* /q$8'/(0/ 1(J(":(
• l(# ") GARA_ */',$(/# /q'/*(,L 0"(81L',(' '"K/*)"*+ ,( $()"*+,-"( 8/01*$'2 K"8'1*/,88/88+/('
Page 39
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 39/96
Security Professionals Conference 2014
Need to Address
• 3L#T 1(18/#T 1((//#/# */K"8$'"*$/8 ")8/(8$-7/ $()"*+,-"(
• 6(+,(,O/#T 1(+,$(',$(/# 8/*7/*8
• ]/*+$88$"( '" 18/ $(8-'1-"(,L 8/(8$-7/$()"*+,-"( ?":(/*8=$K ,(# ,1'="*$'2B
• Z,0J ") ,:,*/(/88 ") K"L$0$/8
Page 40
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 40/96
Security Professionals Conference 2014
Already In Place:
• ]=,8/# "1' 18/ ") ..W8 ,8 K*$+,*2 $#/(-Y/*8
• &#/(-Y/# 0,+K18 L/,#/*8=$K )"* K*"'/0-"( ")8/(8$-7/ $()"*+,-"(
• &#/(-Y/# '/0=($0,L L/,#8 )"* K*"'/0-"( ")8/(8$-7/ $()"*+,-"(
• &(8-'1'/# +,(#,'"*2 */K"*-(O ") */K"8$'"*$/8") 8/(8$-7/ $()"*+,-"(
Page 41
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 41/96
Security Professionals Conference 2014
Ongoing Efforts
• I0m1$8$-"( ") &#/(-'2 k$(#/* )"*80,(($(O )"* 8/(8$-7/ $()"*+,-"(
• .',*'/# a,', j"7/*(,(0/ $($-,-7/• &( 0"(',0' :$'= c)1(0-"(,Le O*"1K8 ?]3T
k3T I3T +,(,O/*$,L\/q/01-7/ '/,+8T0,+K18 O*"1K8T /'0>B
Page 42
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 42/96
Security Professionals Conference 2014
Consultant: Scope of WorkcS=/ 6($7/*8$'2 ") 9,:,$$ ?69B $8 0"++$U/# '"$+KL/+/(-(O , 828'/+:$#/ $()"*+,-"( 8/01*$'2K*"O*,+ '" */KL,0/ '=/ 01**/(' #/0/('*,L$n/#,KK*",0=> S=$8 K*"O*,+ +18' L/7/*,O/ V/8' K*,0-0/8'" +,q$+$n/ $()"*+,-"( 8/01*$'2 :=$L/ 0"(-(1$(O '"81KK"*' '=/ K*$(0$KL/8 ") ,0,#/+$0 )*//#"+ ,(#"K/((/88 0/('*,L '" , 1($7/*8$'2s8 01L'1*/ ,(# +$88$"(>69 V/L$/7/8 $' /88/(-,L '" V/O$( :$'= ,( $+K,*-,L/qK/*' ,88/88+/(' '" #/7/L"K , KL,( )"* , ="L$8-0828'/+:$#/ ,KK*",0=> S=$8 ,88/88+/(' :$LL ,88/8801**/(' K"L$0$/8T 01**/(' K*,0-0/8 ,(# 01**/(' 0,+K18,:,*/(/88 ,8 '=/ V,8$8 ") */0"++/(#,-"(8 )"*$+K*"7/+/('8 $( 8/01*$'2 K"L$0$/8T K*,0-0/8 ,(#/#10,-"(>e
Page 43
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 43/96
Security Professionals Conference 2014
Services Provided:• [/7$/: /q$8-(O $('/*(,L ,(# /q'/*(,L
#"01+/(',-"( $(0L1#$(O */K"*'8T K"L$0$/8 ,(#L/O$8L,-"(
• &('/*7$/: J/2 8',J/="L#/*8
• &#/(-)2 '=/ +,;"* &S 8/01*$'2 $881/8 ),0/# V269 ,(# V/8' K*,0-0/8 )"* 8"L1-"(8
• ]*$"*$-n/ 8"L1-"(8 )"* $++/#$,'/ ,0-"(
• ]*"7$#/ */0"++/(#,-"(8 )"* =": 69 8="1L#$+KL/+/(' , 0"+K*/=/(8$7/ 828'/+:$#/,KK*",0= '" $()"*+,-"( 8/01*$'2
Page 44
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 44/96
Security Professionals Conference 2014
Summary of Findings:
• I 8$O($Y0,(' 1(#/*F$(7/8'+/(' $($()"*+,-"( 8/01*$'2 */8"1*0/8
• S*2$(O '" "K/*,-"(,LL2 +,(,O/$()"*+,-"( 8/01*$'2 ,8 , )1LL2 #/F0/('*,L$n/# ,0-7$'2
Page 45
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 45/96
Security Professionals Conference 2014
Overarching Recommendation
ca/7/L"K , K*"K/*L2 )1(#/#T8'*,'/O$0,LL2 "*$/('/#T 1($7/*8$'2F
:$#/ $()"*+,-"( 8/01*$'2 K*"O*,+'=,' $8 0/('*,LL2 +,(,O/# ,(#"K/*,'/8 $( 0"LL,V"*,-"( :$'= '=/+,(2 #/F0/('*,L$n/# 1($'8'=*"1O="1' '=/ 1($7/*8$'2>e
Page 46
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 46/96
Security Professionals Conference 2014
UH Information SecurityProgram
• S""J :=,' :/ ,*/ ,L*/,#2 #"$(O
• I##/# 0"(81L',('^8 8K/0$Y0 */0"++/(#,-"(8
• a/7/L"K 8'*,'/O$0 ,*/,8_ – a,', j"7/*(,(0/ ,(# 37/*8$O='
– &()"*+,-"( ./01*$'2 I1#$'8 ` [$8J I88/88+/('8
– &()"*+,-"( ./01*$'2 ]"L$0$/8 ` ]*"0/#1*/8
– &#/(-'2 b,(,O/+/(' ̀ I00/88 N"('*"L8
–
&()"*+,-"( ./01*$'2 S*,$($(O ,(# I:,*/(/88• =UK_\\:::>=,:,$$>/#1\$()"8/0\
$()"8/0K*"O*,+>='+L
Page 47
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 47/96
Security Professionals Conference 2014
Resulting Projects
• a,', j"7/*(,(0/ 8'*10'1*/ ` a,', .=,*$(O*/m1/8' K*"0/#1*/8 – =UK_\\:::>=,:,$$>/#1\,K$8\/K\/G\/GGRD>K#)
• ./*7/* */O$8'*,-"( ` 80,(($(O ?*,(#"+,1#$'8B – =UK_\\:::>=,:,$$>/#1\$'8\8/*7/*\*/O$8'*,-"(\
• W/':"*J 80,(8 )"* 8/*7/*8 ?+,K ,O,$(8'
*/O$8'/*/# 8/*7/*8B• [/7$/: ") K"L$0$/8
– =UK_\\:::>=,:,$$>/#1\$()"8/0\K"L$0$/8>='+L
Page 48
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 48/96
Security Professionals Conference 2014
Projects - continued
• I1'"+,'/# #/K*"7$8$"($(O 7$, $#/(-'2+,(,O/+/('
• l7,L1,-"( ` $+KL/+/(',-"( "),##$-"(,L (/':"*J 8/01*$'2'/0=("L"O$/8
• N"+KL$,(0/ ` [$8J I88/88+/('8 )"*
c=$O= *$8Je ,*/,
Page 49
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 49/96
Security Professionals Conference 2014
Awareness & Training
• b,(#,'"*2 $()"*+,-"( 8/01*$'2,:,*/(/88 '*,$($(O )"* 69 /+KL"2//8 :$'=,00/88 '" 8/(8$-7/ $()"*+,-"( ?V2
)1(0-"(B• N"(7/(/ c"1'*/,0= O*"1K8e_ ,KKL$0,-"(T
:/VT #,',V,8/ #/7/L"K/*8 '" $()"*+ '=/+") (/: K"L$0$/8\K*"0/#1*/8 ,(# 8"L$0$'
)//#V,0J "( 1K0"+$(O K*";/0'8• ]*"7$#/ 8K/0$Y0 '*,$($(O )"* ',*O/'/#
O*"1K8
Page 50
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 50/96
Security Professionals Conference 2014
Develop Project Plan &Priorities
• k1(#$(O_ i] &S ` N&3 :"*J/# :$'= lq/01-7/Z/,#/*8=$K ?]*/8\i]\N=,(0/LL"*8B '" ,88/88 /,0=0,+K18 t V1$L#$(O $( '" )1(#$(O +"#/L )"* "'=/*828'/+ $()"*+,-"( 828'/+8
• .',4(O_ ,##/# G ,##$-"(,L K"8$-"(8
• W//# &S. L/,#/*8=$K 81KK"*' )"* c8/01*$'2eK*";/0'8_ N*/,'/# &S. ./01*$'2 ]*"O*,+ Z/,#8
• I(2 K*";/0' (//#8 O*"1K ,KK*"7,L V/)"*/K*"0//#$(O
• ]*";/0'8 (//# '" V/ $(0L1#/# $( "7/*,LL &S.K*$"*$-/8 L$8'
Page 51
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 51/96
Security Professionals Conference 2014
Security @ the Campuses• .',*-(O '" +,J/ 8/01*$'2 , K*$"*$'2
• iN\a$*/0'"*\N&3 L/,#/*8=$K K"8$-"(8
• l,0= 0,+K18 =,8 , c8/01*$'2e L/,#
• kL,O8=$K 0,+K18_ N"LL/O/\a/K,*'+/('./01*$'2 Z/,#
• 9"("L1L1 NN $8 :"*J$(O "( 0,+K18 K"L$0$/8
•
!IX.3b ?.0=""L ") b/#$0$(/B• M,K$‘ "L,($ NN /8',VL$8=/# '=/$* ":( 0,+K18
$()"*+,-"( 8/01*$'2 L/,#
Page 52
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 52/96
Security Professionals Conference 2014
KAPI !OLANI COMMUNITYCOLLEGE
Page 53
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 53/96
Security Professionals Conference 2014
KCC Overview
• I7/*,O/ @DAA .'1#/(' K"K1L,-"(
• DAA k,01L'2 ,(# .',d
• 37/* RRAA 0"+K1'/*8 "( 0,+K18
Page 54
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 54/96
Security Professionals Conference 2014
Breaches
• IK*$L GAAC_ RDTAAA [/0"*#8
• !1L2 GARR_ GTDAA [/0"*#8
Page 55
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 55/96
Security Professionals Conference 2014
Our First Breach… Yeah3( IK*$L RDT , 0"+K1'/* '=,' =,# ,00/88 '" K/*8"(,L$()"*+,-"( ") Y(,(0$,L ,$# ,KKL$0,('8 :,8 )"1(# '" V/$()/0'/# :$'= , 8K/0$Y0 K$/0/ ") +,L:,*/ '=,' $8V/L$/7/# '" =,7/ '=/ 0,K,V$L$'2 '" 8'/,L 18/*w8 8/(8$-7/#,', ,(# 0"++1($0,'/ :$'= 8K/0$Y/# &('/*(/':/V8$'/8> h=$L/ '=/ $()/0'/# 0"+K1'/* #$# ("' $'8/L)8'"*/ ,(2 8/(8$-7/ $()"*+,-"(T $' :,8 "( , L"0,L(/':"*J :=/*/ 8/(8$-7/ $()"*+,-"( :,8 8'"*/# )"*Y(,(0$,L ,$# K*"0/88$(O> S=/ 0"+K1'/* :,8 */+"7/#)*"+ '=/ (/':"*J $++/#$,'/L2 ,(# , )"*/(8$0$(7/8-O,-"( $($-,'/#> S=/ $(7/8-O,-"( K*"7$#/# ("/7$#/(0/ '=,' ,(2 8/(8$-7/ $()"*+,-"( :,8 ,0'1,LL2,00/88/# V2 '=/ $()/0'/# 0"+K1'/*T 2/' $' ,L8" #$# ("'*1L/ "1' '=,' K"88$V$L$'2>
Page 56
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 56/96
Security Professionals Conference 2014
Aren’t Issues a Blast?
• N,+K18 W/':"*J
• N"+K1'/* +,(,O/+/(' $8 ("'
0/('*,L$n/#• k,01L'2 ,(# 8',d =,7/ I#+$( *$O='8
• W" Y*/:,LL 2/'
• 68/*8
Page 57
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 57/96
Security Professionals Conference 2014
Who Do You Call:IDENTITY FINDER!
• Q b"('=8 ") k,LL GARR
• .0,((/# G@A +,0=$(/8 ?$(0L1#$(O
8/*7/*8B• S,*O/'/# ,#+$($8'*,'"*8 ,(# 18/*8
'=,' +,2 V/ '"10=$(O ]/*8"(,LL2
&#/(-Y,VL/ &()"*+,-"( ?]&&B
Page 58
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 58/96
Security Professionals Conference 2014
Wait For It
• 37/* Q b$LL$"( ..W
• 37/* RTGAA N*/#$' N,*# W1+V/*8
• 37/* PAA a*$7/* Z$0/(8/
Page 59
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 59/96
Security Professionals Conference 2014
Help Desk Changes
• i$*18 ]*"0/#1*/8
• ]*/$(8',LL/# K*"O*,+8 V/)"*/ #/KL"2+/(' ")(/: +,0=$(/8
R> l*,8/*G> &#/(-'2 k$(#/*Q> S*1/N*2K'
H> b0I)//D> b,L:,*/X2'/8
Page 60
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 60/96
Security Professionals Conference 2014
IF USERS DON’TCHANGE…
I WILL CRY!
Page 61
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 61/96
Security Professionals Conference 2014
What to Drill into UsersHeads
• 9[. ,(# 69 ]"L$0$/8
• h=,' $8 ]&&
• a" 2"1 (//# '" J//K ]&&
• 9": '" J//K ]&& 1(#/* K"L$0$/8
• 9": '" K*/7/(' ,("'=/* 0,+K18 V*/,0=
• X/8' K*,0-0/8
• N"(7/($/(0/ i. [$8J• .0,*/ S,0-08
Page 62
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 62/96
Security Professionals Conference 2014
DON’T SHAKE THE TREE!
Page 63
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 63/96
Security Professionals Conference 2014
Page 64
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 64/96
Security Professionals Conference 2014
Page 65
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 65/96
Security Professionals Conference 2014
It’s Time for Training
• HF@ h"*J8="K8 K/* ./+/8'/*• &(#$7$#1,L S*,$($(O• a/K,*'+/(' S*,$($(O• h"*J8="K )"* W/: k,01L'2 3*$/(',-"(• Z/0'1*$(O 18/*8 '=,' =,# '=/$* +,0=$(/8
$()/0'/#
•
S1'"*$,L_=UK_\\0/LU>J,K$"L,($>=,:,$$>/#1\8/01*$'2F$()"*+,-"(\
Page 66
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 66/96
Security Professionals Conference 2014
Wait! Did you say secondbreach? *aghhhhhhh!!*
I :"*J/* ("-0/# '=,' V"q/8 ") 8/(8$-7/ Y(,(0$,L*/0"*#8 :/*/ "1' ") KL,0/> ."+/ V"q/8 :/*/#$80"7/*/# '" V/ +$88$(O ,(# "40$,L8 V/O,( 8/,*0=$(O)"* '=/+ "( !1L2 R> S=/ V*/,0= :,8 */K"*'/# '"
8'1#/('8 #1*$(O '=/ Y*8' ://J ") I1O18'> &' $8 1(0L/,*:=/( '=/ V"q/8 :/*/ ',J/( ,(# '=/*/ :,8 (" 8$O( "))"*0/# /('*2 $('" '=/ ,*/, :=/*/ '=/2 :/*/ 8'"*/#> S=/YL/8 0"(',$(/# (,+/8T ,##*/88/8T 8"0$,L 8/01*$'2(1+V/*8 ,(# 0*/#$' 0,*#8> ]/"KL/ :=" +,#/'*,(8,0-"(8 :$'= 0*/#$' 0,*#8 V/'://( k/V*1,*2 ,(#W"7/+V/* ") GARA )"* ("(F0*/#$' 0L,88/8T '*,(80*$K'*/m1/8'8 "* K,2+/(' ") ("(F*/8$#/(' )//8 :/*/,d/0'/#>
Page 67
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 67/96
Security Professionals Conference 2014
I Forgot about Hard Copy
• .'*/(O'=/( +2 :"*J8="K8 '" $(0L1#/9,*# N"K2
• X/O$(($(O k,LL GARQ 8',*'/# ,(&('/*(,L I1#$'
Page 68
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 68/96
Security Professionals Conference 2014
It’s Already 2014
• h/ ,*/ ,' L/,8' PDx V/U/* '=/(GAAC
• IL:,28 +"*/ '" #" "( '=/ &S ,(#68/*8 /(#
• a$# '=/ 68/*8 0=,(O/y
Page 69
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 69/96
Page 70
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 70/96
Security Professionals Conference 2014
Information SecurityGovernance
• a,', ./01*$'2 Z/,#/*8=$K N"1(0$L – IKK"$('/# V2 N,+K18 N=,(0/LL"*
– ./($"* N,+K18 Z/,#/*8=$Ko i$0/ N=,(0/LL"*
– [/8K"(8$VL/ )"* 8/01*$'2 ") 8/(8$-7/ #,', "( '=/$*0,+K18
– b18' 7/' '=/ */'/(-"( ") 8/(8$-7/ $()"*+,-"(*/K"8$'"*$/8 ̀ 8/*7/*8
– b//'8 GFQ -+/8 , 2/,*
Page 71
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 71/96
Security Professionals Conference 2014
Technical Security Oversight
• 69 &S ./01*$'2 Z/,#8 – a/8$O(,'/# V2 '=/ 0,+K18 a,', ./01*$'2 Z/,#/*
– Z/,# '/0=($0,L 8',d "( , 0,+K18
– lq0/K-"(_ bf(", N,+K18 F X&j `#/0/('*,L$n/#
– bf(", a/,(8 ` a$*/0'"*8 #/8$O(,'/# "(/ "*+"*/ '/0=($0,L 8',d )*"+ /,0= ") '=/$* 1($'8
– [/8K"(8$VL/ )"* $+KL/+/(-(O '/0=($0,L 8/01*$'2K*"0/#1*/8 ` ,#7$8$(O '=/$* a,', ./01*$'2Z/,#/*8
– b//' GFQ -+/8 , 2/,*o 8"+/-+/8 :$'= a.ZN
Page 72
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 72/96
Security Professionals Conference 2014
Sample Agenda• ./*7/* */O$8'*,-"( 1K#,'/ ?$(0L1#$(O *,(#"+
,1#$'8Bo!"# !%&' #()
• .1++,*2 ") &()"*+,-"( ./01*$'2 N"+KL$,(0/I88/88+/('8o !%*(+%,- ./01*
• a,', j"7/*(,(0/ ` a,', .=,*$(O [/m1/8' ]*"0/886K#,'/o 21+3 2,*, 4'5(+%,%)(
• kl[]I ]"L$02 6K#,'/o 67 8(91:*+,+
• a/7/L"K/*8 ` &#/(-'2 ` I00/88 b,(,O/+/('?&IbB 1K#,'/o !"# !.; ;,%,9(+
• ["LL"1' ") &#/(-'2 k$(#/* )"* #/8J'"K8o !"# !%&'#()
Page 73
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 73/96
Security Professionals Conference 2014
Server Registration
• [/O$8'*,-"(\7,L$#,-"( */m1$*/#,((1,LL2 – ]*$+,*$L2 #,',V,8/T :/VT YL/ 8/*7/*8
– a"/8 8/*7/* 0"(',$( 8/(8$-7/ $()"*+,-"(y
– .0,( )"* ..W8 ` 0*/#$' 0,*# (1+V/*8 :$'= &#/(-'2k$(#/*
– .0,( )"* 71L(/*,V$L$-/8 :$'= 3K/(iI.
– [/+/#$,-"( 8','18 */m1$*/# – ]*"7$#/ #/K,*'+/(' ̀ '/0=($0,L 0"(',0'
$()"*+,-"(
– N,+K18 L/,#/*8=$K +18' c,KK*"7/e
Page 74
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 74/96
Security Professionals Conference 2014
Server Registration Followup
• [,(#"+ I1#$' – ./L/0'/# D 8/*7/*8 )*"+ */O$8'/*/# 8/*7/*8
• ]*"7$#/ 3K/(iI. 80,( */81L'8 ,(#&#/(-'2 k$(#/* 80,( */81L'8 – k/: 8/*7/*8 :$'= ]&&
– k/: 8/*7/*8 :$'="1' ]&&
– k/: 8/*7/*8 )*"+ 0,+K18/8 '=,' */K"*'/# (" ]&&"( ,(2 8/*7/*8
• j33a Wlh.z ILL :/*/ $( 0"+KL$,(0/z
Page 75
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 75/96
Security Professionals Conference 2014
Information SecurityCompliance Assessments
• &('/*(,L I1#$' ',J$(O L/,#• j/(/*,L ]*"0/88_
– N"(',0' '=/ */8K/0-7/ 6($' '" #$80188 80"K/,(# -+$(O>
– N"+KL/-"( ") ;,1%*(%,%)( '& #(%:1<5(!%&'+=,<'% #/+5(> >
– N"(#10' +//-(O ,(# 8$'/ 7$8$' :$'= 6($'> – &()"*+ '=/ 6($' ") "V8/*7,-"(8 \
*/0"++/(#,-"(8
Page 76
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 76/96
Security Professionals Conference 2014
Assessments Status
• h"*J ]/*)"*+/# #1*$(O !,(1,*2 t b,*0= GARQ
• ./L/0'/# a/K,*'+/('8\.0=""L8 – k$(,(0$,L I$# ./*7$0/8 ?ILL N,+K18/8B
– N"++1($'2 N"LL/O/8 t W"(FN*/#$' ]*"O*,+8
– !"=( I> X1*(8 .0=""L ") b/#$0$(/
• .1*7/28 0"+KL/'/# ,(# 8$'/ 7$8$'8 )"* 3w,=11($'8 0"+KL/'/#>
• b/+" 0"(',$($(O "V8/*7,-"(8 :,8 0$*01L,'/#'" ,LL 1($'8
• [/K"*' 81V+$U/# '" '=/ X",*# ") [/O/('8
Page 77
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 77/96
Security Professionals Conference 2014
Assessment Observations
• W" O1$#,(0/ "( :=/(\=": '" #"V,0JO*"1(# 0=/0J8
• [/0"*# */'/(-"( ") 8/(8$-7/ $()"*+,-"(
$(0"(8$8'/(' ,+"(O */8K"(#/('8• 6($'8 8-LL 18$(O 8'*$KF01' 8=*/##/*8 "* ("'8=*/##$(O ,' ,LL
• W"' ,L:,28 8/01*$(O K=28$0,L K,K/* YL/80"(',$($(O 8/(8$-7/ $()"*+,-"(
• W"' ,L:,28 /(0*2K-(O /L/0'*"($0'*,(8+$88$"( ") 8/(8$-7/ $()"*+,-"(
Page 78
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 78/96
Security Professionals Conference 2014
IA Next Assessment
• 9&]II a/'/*+$(,-"( .1*7/2 – k1*($8=T V$LL "* */0/$7/ K,2+/(' )"* c=/,L'= 0,*/ey
– S*,(8+$' ,(2 0"7/*/# '*,(8,0-"(8 /L/0'*"($0,LL2y
– 9,7/ ,( ,O*//+/(' :\ , 0"7/*/# /(-'2 "* V18$(/88
,88"0$,'/y – ]/*)"*+/# , *$8J ` 71L(/*,V$L$'2 ,88/88+/(' ") /L/0'*"($0
0"7/*/# '*,(8,0-"(8y
• 3) PD 1($'8 81*7/2/#T RH ,*/ K"'/(-,LL281V;/0' '" 9&]II
• k"LL":F1K ,88/88+/(' :$LL V/ 0"(#10'/#
• [/K"*' 81V+$U/# '" X",*# ") [/O/('8
Page 79
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 79/96
Security Professionals Conference 2014
* Exercise
• IL"=, 6($7/*8$'2 b/#$0,L N/('/*
• N"+K*"+$8/# 0"+K1'/* – b,$( 0"+K1'/* 18/# '" /('/* K,-/(' $()"*+,-"(
$(0L1#$(O K,-/(' +/#$0,L */0"*#8 ` $(81*,(0/ V$LL$(O$()"*+,-"(
– k"1(# *""'J$'T 7$*18 J(":( '" V/ 18/# V2 02V/*0*$+$(,L8T L"O8 $(#$0,-(O /qYL'*,-"( ") YL/8
– 3. ` :/V V*":8/*8 ("' K,'0=/#o 0"+K1'/* 18/# )"*("(F:"*J 18/8
• h=,' #" 2"1 #"y
Page 80
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 80/96
Security Professionals Conference 2014
* Exercise Responses?
• k"LL": $(0$#/(' */8K"(8/ K*"0/#1*/• &#/(-Y0,-"(o W"-)2 J/2 8',J/="L#/*8
• a,+,O/ 0"(',$(+/(' ` #,', /qK"81*/
,88/88+/('o a/7/L"K */8K"(8/ `0"++1($0,-"(8 KL,(
• l*,#$0,-"( ` */0"7/*2
• W"-Y0,-"(o a/7/L"K kI{ t 0"(8$8'/('+/88,O/o ][\b/#$,o N,LL N/('/*
• &(0$#/(' ,(,L28$8 ` (/q' 8'/K8
Page 81
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 81/96
Security Professionals Conference 2014
WHAT DOES THIS MEANFOR MY INSTITUTION?
(SO NOW WHAT?)
Page 82
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 82/96
Security Professionals Conference 2014
Visible Due Diligence
• 9,7/ , KL,( ,(# K"L$02 ?"* K"L$0$/8B '"K*"'/0' 8/(8$-7/ $()"*+,-"(
• 9,7/ , KL,( '" */#10/ 8/(8$-7/$()"*+,-"( ?,(# /q/01'/ $'zB
• 9,7/ , +/'*$0 "* +/0=,($8+ '" ,88/88*$8J '" 8/(8$-7/ $()"*+,-"(
• 9,7/ , :,2 '" */K"*' "( '=/ c.','/ ")&()"*+,-"( ./01*$'2e
Page 83
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 83/96
Security Professionals Conference 2014
Response Elements
• [/8K"(8/ -+/ $8 N[&S&NIZ• M(": 2"1* Ml| #/0$8$"( +,J/*8 ` KL,2/*8
• X/ K*/K,*/#_ W"' $) , V*/,0= :$LL "001* t
h=,' :$LL 2"1 #" h9lW $' "001*8y – 9l&.N &()"*+,-"( ./01*$'2 j1$#/_
=UK8_\\:$J$>$('/*(/'G>/#1\0"(g1/(0/\#$8KL,2\$'8OG\9"+/
– a,', &(0$#/(' W"-Y0,-"( S""LJ$'_=UK8_\\:$J$>$('/*(/'G>/#1\0"(g1/(0/\#$8KL,2\$'8OG\9"+/
– ./(8$-7/ a,', lqK"81*/ &(0$#/(' N=/0JL$8'_=UK8_\\:$J$>$('/*(/'G>/#1\0"(g1/(0/\#$8KL,2\$'8OG\&(0$#/('uN=/0JL$8'
Page 84
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 84/96
Security Professionals Conference 2014
EDUCAUSE HEISC Resources
• 9l&.N_ 9$O=/* l#10,-"( &()"*+,-"(./01*$'2 N"1(0$L
• &()"*+,-"( ./01*$'2 j1$#/ – =UK8_\\:$J$>$('/*(/'G>/#1\0"(g1/(0/\#$8KL,2\$'8OG\
9"+/ – a/7/L"K/# ` +,$(',$(/# V2 la6NI6.l ./01*$'2
h"*J$(O j*"1K ` N"++1($'2 b/+V/*8
– b,KK/# '" $(#18'*2 8',(#,*#8_ &.3T W&.ST N3X&ST ]N&Fa..
– ]*"7$#/8 , L$V*,*2 ") 7,L1,VL/ c'""LJ$'8e "( , :$#/7,*$/'2 ") '"K$08
– c9"' S"K$08e K*"7$#/ -+/L2 $()"*+,-"( "( 01**/('81V;/0'8
Page 85
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 85/96
Security Professionals Conference 2014
Plan, Plan, Plan!
• 9,7/ ,( &(0$#/(' [/8K"(8/ ]L,(• 9,7/ , X*/,0= [/8K"(8/ ]L,( '=,' $(0L1#/8
, c][e KL,(_ – [/K1',-"( b,(,O/+/(' ?O/' ,=/,# ") '=/ (/O,-7/
+/#$, 020L/B – N"++1($0,-"(8 KL,(
• ]*,0-0/ '=/ KL,(8z ?S,VL/'"K /q/*0$8/8o=,(#8F"( 02V/* 8/01*$'2 #*$LL8B
• I(,L2n/ IW| $(0$#/('o #/7/L"K +$-O,-"(8'*,'/O2o $(0"*K"*,'/ $('" 2"1* &()"*+,-"(./01*$'2 ]*"O*,+
Page 86
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 86/96
Security Professionals Conference 2014
Address “Plaintiff” Perceptions& Motivations
• .:$p K1VL$0 */8K"(8/o V/ ,K"L"O/-0 ,(#/+K,'=/-0o =D@E FD.F G@? >.HIJ
• N*/#$' +"($'"*$(O $8 /qK/0'/#o =,7/]"$('8 ") N"(',0'8 "* */',$(/*8 )"* 0*/#$'+"($'"*$(O 8/*7$0/8
• a" ("' 18/ , */8K"(8/ '/+KL,'/o $)
+1L-KL/ V*/,0=/8T +/88,O/ ,KK/,*8c*/K/--7/e :$'= (" $+K*"7/+/('8 – c6()1LYLL/# ]*"+$8/8e ?Z$V/*'2 N",L$-"( [/K"*'B
Page 87
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 87/96
Security Professionals Conference 2014
Doing it “Right”
http://www.washingtonpost.com/local/college-park-shady-grove-campuses-affected-by-university-of-maryland-security-breach/2014/02/19/ce438108-99bd-11e3-80ac-63a8ba7f7942_story.html
Page 88
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 88/96
Security Professionals Conference 2014http://www.commerce.senate.gov/public/?a=Files.Serve&File_id=b92bba0e-787f-426d-b1ce-14f2c73f9f13
Page 89
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 89/96
Security Professionals Conference 2014
LAWSUITS APLENTY…
Page 90
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 90/96
Security Professionals Conference 2014
Target Class Action Lawsuit
http://bit.ly/QWhOvm
Page 91
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 91/96
Security Professionals Conference 2014
And…
• =UK_\\:::>80+,O,n$(/>0"+\0L,88F,0-"(F81$'F,$+/#F,'F+000#F)"*F#/L,2/#F("-Y0,-"(F$(FV*/,0=\,*-0L/\QHQDEC
Page 92
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 92/96
Page 93
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 93/96
Security Professionals Conference 2014
Your Plans?
• a" 2"1 =,7/ ,( $(0$#/(' */8K"(8/ KL,(y
• h=,' ,V"1' , V*/,0= */8K"(8/ `("-Y0,-"( KL,(y
• a" 2"1 J(": :=" '" 0"(',0'y vIWav:=,' '" '/LL '=/+y
• 9": :$LL 2"1 0"++1($0,'/ '" '=/
,d/0'/# $(#$7$#1,L8 ,(# '" '=/ K1VL$0y?b/#$, 0"++1($0,-"( KL,(B
Page 94
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 94/96
Security Professionals Conference 2014
Don’t Forget…
• .K//# $8 ") '=/ /88/(0/o $+K/*,-7/ '"=,7/ 8:$pT #/0$8$7/ ,0-"(8
• X/ 8$(0/*/L2 ,K"L"O/-0T 0"(0/*(/#T
0,*$(O• X/8' $) '=/ =$O=/8' *,(J$(O ,#+$($8'*,'"*
$881/8 '=/ ("-0/
• l(81*/ '=,' ,LL */+/#$,-"( ,0-"(8 ,*/0"+KL/'/# ,(# #"01+/('/#
Page 95
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 95/96
Security Professionals Conference 2014
Page 96
8/11/2019 SEM02P-Preventing a Lawsuit by Preparing for a Breach (separate registration required) (236905937)
http://slidepdf.com/reader/full/sem02p-preventing-a-lawsuit-by-preparing-for-a-breach-separate-registration 96/96