-: In this lesson 2 2
we're going to talk about information security and privacy. 3 3
Now, when it comes to information security and privacy, 4 4
for a long time these were treated 5 5
as two separate things and they weren't integrated together. 6 6
But with the latest version of RMF 7 7
we actually integrate both of these together 8 8
underneath the Risk Management Framework. 9 9
Now, the first place where we see information security 10 10
and privacy explicitly linked together 11 11
was inside of a document 12 12
known as the OMB Circular A-130. 13 13
Now, OMB is the United States Office 14 14
of Management and Budget. 15 15
And these circulars that they put out 16 16
are essentially memos 17 17
that tell other federal organizations what they have to do. 18 18
Inside these circulars 19 19
there's going to be detailed instructions 20 20
and information that is specifically sent 21 21
to these federal agencies 22 22
and it implements a standard guidance 23 23
for all the federal agencies 24 24
across an array of policy areas. 25 25
So when the OMB puts out a circular 26 26
and they say everybody must follow this, 27 27
they mean everybody inside of the government. 28 28
So whether you're working for the United States Treasury 29 29
or the United States Department of Defense, 30 30
those rules will still apply to you. 31 31
And back in 2016 32 32
the OMB revised their circular, A-130, 33 33
to include the use of RMF for all federal agencies, 34 34
and this linking of information security 35 35
and privacy together. 36 36
In fact, inside of OMB A130, you'll find that it says, 37 37
"While security and privacy are independent 38 38
and separate disciplines, they are closely related, 39 39
and it is essential for agencies to take 40 40
a coordinated approach to identifying 41 41
and managing security and privacy risks 42 42
and complying with the applicable requirements." 43 43
So because of this, OMB had required organizations 44 44
to start using the Risk Management Framework 45 45
in order for them to manage their privacy risk 46 46
beyond those that are typically included 47 47
underneath the confidentiality objectives 48 48
inside of the NIS Cybersecurity Framework 49 49
and other versions of the RMF or Risk Management Framework. 50 50
When you look at the term information security, 51 51
there is a section under there for confidentiality. 52 52
And normally this was focused on things 53 53
like encryption and secrecy and things like that. 54 54
But as of this new revision 55 55
we now include things for privacy underneath this term too. 56 56
Now this is because there are many different privacy risks 57 57
that relate to other unauthorized access 58 58
or disclosure of personal identifiable information, 59 59
privacy risks that can also result from other activities, 60 60
including the creation, collection, use 61 61
and retention of PII, 62 62
and having an inadequate quality or integrity of that PII, 63 63
and all of this can give you a lack 64 64
of appropriate notice transparency or participation. 65 65
So as they started looking 66 66
at all these data breaches that were going on, 67 67
they said, you know what, 68 68
it's not just an information security problem 69 69
but it's also a privacy concern area. 70 70
And that's why they started implementing 71 71
privacy control officers inside the different agencies 72 72
to look at this problem. 73 73
And they included it inside 74 74
of the Risk Management Framework. 75 75
And so as you're going through RMF 76 76
and your seven steps, part of what you're looking at 77 77
is not just the information systems, but also the privacy 78 78
of the data that's being processed, transmitted, 79 79
or stored on those information systems. 80 80
Now, when you're executing the Risk Management Framework, 81 81
it's important that you have close collaboration 82 82
between your information security programs 83 83
and your privacy programs 84 84
because they are intricately linked 85 85
by this new OMB circular. 86 86
Now, even though your information security programs 87 87
and your privacy programs do have different objectives, 88 88
those objectives are considered complimentary 89 89
and many times they overlap as well. 90 90
So as you're putting in place one control 91 91
that gives you better information security 92 92
that same control may also give you better privacy. 93 93
And by working together between our information security 94 94
and cybersecurity teams as well as our privacy teams, 95 95
we're going to be able to take advantage 96 96
of those different controls 97 97
and be able to meet the requirements 98 98
for both of these areas of concern. 99 99
For example, if you look at 100 100
your information security program, 101 101
it's normally going to be responsible 102 102
for protecting information 103 103
and information systems from unauthorized access, 104 104
use, disclosure, disruption, modification or destruction. 105 105
For example, we want to make sure 106 106
there's no unauthorized system activity 107 107
or behavior happening on those systems. 108 108
We do this in order to achieve three main things, 109 109
confidentiality, integrity, and availability. 110 110
And we call this the CIA Triad. 111 111
Now, privacy programs, on the other hand 112 112
are going to be responsible for ensuring compliance 113 113
with the applicable privacy requirements 114 114
and for managing the risk to individuals 115 115
associated with the creation, collection, use, processing, 116 116
dissemination, storage, maintenance, disclosure 117 117
or disposal of PII, 118 118
which is known as Personally Identifiable Information. 119 119
As you can see, information security is really focused 120 120
on CIA, or confidentiality, integrity and availability, 121 121
whereas privacy programs are really focused 122 122
on personally identifiable information known as PII. 123 123
This PII though, when it's stored on an information system 124 124
is going to have to be protected 125 125
underneath confidentiality and integrity, 126 126
and this is why information security 127 127
and privacy really go hand in hand 128 128
underneath the Risk Management Framework. 129 129
So now that you have a better understanding 130 130
of why we're going to be talking about information security 131 131
and privacy together, it's important to realize 132 132
that there are different controls that can apply 133 133
to each of these things. 134 134
For example, if you're going to be using a privacy control, 135 135
this is usually going to be an administrative, 136 136
technical or physical safeguard that's going to be employed 137 137
within an agency to ensure compliance 138 138
with the applicable privacy requirements, 139 139
and to manage privacy risks. 140 140
On the other hand, a security control 141 141
is considered a safeguard or countermeasure, 142 142
prescribed for an information system or for an organization 143 143
to protect the confidentiality, integrity 144 144
and availability of the system and it's information. 145 145
Now, there is a small difference here, 146 146
but you'll see often that RMF will use the same word control 147 147
to refer to both types simultaneously. 148 148
And this can be a little bit confusing 149 149
when you first start working out with RMF, 150 150
but it's important for you to remember 151 151
that in RMF when we talk about a control, 152 152
this control can be a security control or a privacy control 153 153
or sometimes you'll have a single control that will work 154 154
and give you protections in both areas. 155 155
Because of this, RMF will usually only differentiate 156 156
a control by its type if a situation requires it, 157 157
because like I said, you can often use a privacy control 158 158
to give you better confidentiality, 159 159
or you can use an information security control 160 160
to give you better privacy. 161 161
And so they do work together, 162 162
and this is why we have this linkage 163 163
between information security and privacy controls. 164 164
And this is why inside of RMF, 165 165
they'll often treat it just as a control instead of saying 166 166
this is an information security control 167 167
or a privacy control.