Preparing for a Data Compromise: what to do when a security breach exposes sensitive data

1. Preparing for a Data Compromise: what to do when a security breach exposes sensitive data Charles R. Morrow-Jones Director, Cyber-Security Cathy Bindewald Director, Communications, Marketing and Planning Office of the Chief Information Officer The Ohio State University

2. Acknowledgements • This presentation has benefited greatly from conversations with: • Mary Ann Blair, Director of Information Security, Computing Services, Carnegie Mellon University • Tim Keller, Director, Fraud and Identity Management Solutions, TransUnion LLC • Steve Schuster, Director of IT Security, Cornell University • Educause has supplied valuable material on this topic

3. Agenda • Introduction • What is sensitive data? • Why do we need a disclosure response plan? • Legal requirements – FERPA, HIPAA, Ohio HB 104,…. • Ethical considerations • Developing an enterprise disclosure response plan • creation of an intra-institutional response team • insuring that the response team is appropriately prepared • creation of advisory chains within the institution • processes for the notification of affected individuals • dealing with the news media • appropriate remediation

4. What is Sensitive Data? Data that are legally or customarily protected from disclosure. Examples of legal protections include: • FERPA - Requires the safeguarding and protection of privacy for educational records • HIPAA – Protects the privacy of medical records • Ohio House Bill 104 – requires notification if “Personal Information” is exposed

5. Name Address SSN Telephone Number Driver’s License Number Account Number PIN Email Address Password Other personal Information Examples of Sensitive Data

6. Ohio House Bill 104Personal Information • Personal Information - a person’s name linked with any one of the following (when data elements are not encrypted, redacted or altered): SSN, driver’s license number, debit card or account number linked with a security code or password

7. House Bill 104Requirements • Effective February 17, 2006 • Requires state agencies, persons and businesses to contact individuals if unencrypted personal information maintained on computers is obtained by unauthorized persons (breach of security) and access causes or is believed to cause risk of identity theft or other fraud • Notice of breach must occur within 45 days of the discovery

8. House Bill 104Definition of a Security Breach • Breach of Security - unauthorized access to and acquisition of computerized data that compromises the security or confidentiality of personal information owned or licensed by a state agency or an agency of a political subdivision and that causes or is believed to cause risk of identity theft or other fraud

9. House Bill 104Exclusions • Exclusions - personal information publicly available information that is lawfully made available to the general public from federal, state or local government records; any published news, editorial or advertising statement

10. House Bill 104Notification Requirements • Notice/disclosure of breach may be given in the following ways • Written • Electronic • Telephone • Substitute notice - email, posting on agency website, media outlets - may be given if the agency does not have sufficient information on the residents or the cost of providing notice exceeds $250,000 or the number of those to be notified exceeds 500,000

11. House Bill 104Inform National Credit Bureaus • Credit Reporting - If more than 1,000 residents are involved in a single occurrence of a breach of security, the state agency or agency of a political subdivision shall notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis of the timing, distribution, and content of the disclosure

12. House Bill 104Failure to Comply • Requires court to determine if there was bad faith in the failure to comply and if the failure to comply was intentional or reckless • Civil penalties • $1,000 per day for the first 60 days • Up to $5,000 per day for days 61-90 • Up to $10,000 per day beginning the 91st day

13. The Disclosure Response Plan

14. Creating an Intra-institutional Compromise Response Team • Purpose: • For each situation involving a possible data compromise, determine whether notification is required • To be successful: • Team structure must match the decision making culture of the organization • Authorization to make the notification decision must be delegated to the team • All incidents must be referred to the team

15. Core Team: CIO Director, IT Policy Director, IT Security University Audit University Council University Police University Communication Risk Management Incident Specific Additions: Data Steward Unit Head Local IT Support Security Liaison ITMC member Response Team Membership(Cornell DIRT Example)

16. Core Team: CIO Director, IT Policy Director, IT Security University Audit University Council University Police University Communication Risk Management Leader, Help Desk Incident Specific Additions: Data Steward Division Head (e.g. Dean) Unit Head (e.g. Chair) Local IT Support Security Liaison ITMC member Office of Human Resources IT Security Technicians Response Team Membership(Possible Additional Membership)

17. Preparing the Response Team • Convene the Response Team • Introduce members, promote interaction • Conduct Table Top Exercises • Exercises can readily be developed using the Educause material listed on the Resources slide

18. Create Advisory Chains • Who needs to know? • Define advisory chains before an incident happens • Utilize your response team as initiators CIO Provost President Local Newspaper Media Relations Local TV

19. Create a Generic Identity Theft Website • Create a generic identity theft website as a public service announcement to your institution’s community. Possible content: • What is identity theft? • How to protect yourself from identity theft • Steps to take if your data becomes compromised or stolen • Information about how to contact credit reporting agencies; Social Security administration; ID theft clearinghouse; local law enforcement • Other resources

20. In the Event of an Event… • Alert the team – if possible, give a preliminary assessment • Initiate communication with advisory chains. • Assemble and assess evidence of disclosure • Convene team, reach notification decision • Transmit decision via advisory chains • If decision is to notify, begin notification processes appropriate to scale of incident.

21. Reaching the Decision to Notify“Reasonable Belief” Confirmation that sensitive data were acquired Reasonable belief that data were acquired No meta-data available for analysis Increasing need to notify Reasonable belief that data were not acquired Confirmation that sensitive data were not acquired

22. Features Benefits Typical Components of a Notification Plan Written notification Maintain University reputation Dedicated telephone assistance Increase ‘customer’ confidence Dedicated Web site Reduce potential damage Press release(s) Reduce potential for litigation? (Credit file monitoring)

23. Construct a Press Release A good press release includes: • Who is affected/not affected? • What specific types of personal information were exposed? • What are the (brief) details of the incident? • “No evidence that the data have been misused” or what misuse the evidence points to • Expression of regret and concrete steps the institution is taking to prevent a reoccurrence • Contact point for more information

24. Notifying the Affected Individuals • Who needs to be notified? How? When? • Legal requirements about who, how and when • It may be appropriate to delay notification if law enforcement is involved and approves delay • Sending letters vs. sending e-mail • Studies have shown that personal is better than impersonal • Going beyond basic requirements • Offering to pay for credit report monitoring

25. Contents of the Notification Letter • Press Release plus: • The next steps individuals should take • Next steps by the University (in addition to those in the press release) • Contact information, including telephone number, dedicated e-mail address and dedicated website • Signature

26. Contents of the Incident Specific Website • Most Recent Update section at the top of the page • < Replicate the notification letter components, suitably modified for a larger, more general audience> • Reiterate actions taken to ensure improved security in future • Links to identity theft & credit agency websites • FAQ’s • Toll-free contact number • url: www.universityname.edu/datatheft

27. Dedicated Telephone Assistance • This should be a toll-free number, dedicated to this incident • Staff answering the assistance line should be individuals familiar with and focused on the situation (i.e., probably not staffed from a generic help desk) • Number and staffing should remain in place until call volume drops to zero

28. Dealing with the News Media • Speak with a single voice -identify a spokesperson for the institution • Be sure the spokesperson is well briefed – ideally, she/he will be part of the response team • Inform everyone involved of the identity of the spokesperson, and ask that all inquiries be referred to him/her.

29. Remediation • Be sure that the exposure has been identified and removed. • Your system administrators/computer security staff should be charged with doing this • Law enforcement’s needs for evidence takes priority over clean-up

30. Resources • Blair, Mitrano and Schuster, “Data Incident Notification Policies and Procedures”, Presented to the Educause/Internet2 Security Professionals Conference, April, 2006 • Educause, “Data Incident Notification Toolkit”, http://www.educause.edu/DataIncidentNotificationToolkit/9320 • Educause, “Data Incident Notification Templates”, http://www.educause.edu/LibraryDetailPage/666?ID=CSD4237 • Keller, “Managing a Data Compromise: Is Your Organization Prepared?” Presented at the OSU Second Annual Security Day, October, 2005 http//cio.osu.edu/communications/community/2005/prepared.ppt • Petersen, “Security Breaches: Notification, Treatment and Prevention”, EDUCAUSE Review (Volume 40, Number 4, July/August 2005)

31. Questions for Another Time… • How do you discover disclosures? • Device theft • Weak/stolen/poorly managed passwords • Poorly managed accounts • Improper/poorly managed access permissions • Use of email or IM to move information • Weak vulnerability detection/management • Inadequate host based defenses • HR risk / disgruntled employee / poor separation of duties • Process risks – inadequate security review of technical information systems • Process risks – inadequate process controls for publicly accessible information • How do you know which machines house sensitive data?

32. Author Contact Information • Cathy Bindewald Bindewald.2@osu.edu 614.247.6980 • Charles Morrow-Jones Morrow-jones.2@osu.edu 614.292.1302