All language subtitles for 009 Regulatory Compliance (OBJ 1.1)

Speaker: When working as a penetration tester,

you need to be familiar with a wide range

of basic laws and regulations.

Especially for performing a compliance based assessment.

There are numerous laws and regulations

that organizations may be subject to,

and it's our job to help test

or prove their compliance with various legal

and regulatory requirements based upon their industry.

Now, in exam objective 1.1,

it states that regulatory compliance considerations

are important to know,

but then it only lists two sub bullets, GDPR and PCI-DSS.

That said, I wanna take a moment and direct your attention

to the bottom of page two

of your official CompTIA PenTest+ exam objectives,

because this is an area that I usually get a lot

of questions from students about when I bring up concepts

that aren't clearly listed as one of the sub bullets

in the exam guide.

Now notice, in big red letters it says, please note,

and then it provides us with a paragraph

of important but often overlooked information.

It goes on to state this, the list of examples provided

in bulleted format are not exhaustive lists.

Other examples of technologies, processes,

or tasks pertaining to each objective may be included

on the exam, although not listed or covered

in this objectives document.

So what does this mean for us as we're studying

for the exam?

Well, it means that even though GDPR and PCI-DSS

are the only sub bullets listed,

on test day you could easily get a question

about GLBA, SOX, HIPAA, FISMA,

or other regulatory considerations.

When you hear the term regulation or regulatory,

this is just a fancy word for a law

with some compliance requirements associated with it.

So you need to ensure you're well prepared.

And to help you do that,

we're gonna do a quick coverage

of the main regulatory compliance considerations

that you should know as a penetration tester

just in case you get one of them on the exam,

and then we're gonna do a bit of a deeper dive into GDPR

and PCI-DSS because those two were specifically called

out in the sub bullets.

Now, you don't have to memorize everything I'm about to say,

but you should be able to do some basic keyword association.

For example, if I say HIPAA,

you should realize that this affects healthcare data

and so if you're assessing a doctor's office, a hospital,

a healthcare insurance company,

then HIPAA is going to affect you and your engagement.

All right, let's first talk about HIPAA.

Now, HIPAA is the Health Insurance Portability

and Accountability Act,

and it's often commonly just referred to as HIPAA.

Now, HIPAA affects healthcare providers, facilities,

insurance companies, and medical data clearing houses.

HIPAA has rigorous requirements

for anyone dealing with patient information

or computerized electronic patient records or other forms

of protected health information, which we call PHI.

Now, if the organization is processing

or storing medical data,

they're gonna be affected by HIPAA.

Now, the Healthcare and Education Reconciliation Act of 2010

also affects both healthcare and educational organizations,

and it increases some security measures necessary

to protect healthcare information too.

SOX, or Sarbanes-Oxley was enacted by Congress

under the name Public Company Accounting Reform

and Investor Protection Act of 2002,

but it's almost always referred to simply as Sarbanes-Oxley

after the two lead senators who sponsored this bill

and fought for it to become law.

If you're targeting an organization that is

a publicly traded US corporation,

it is gonna be affected by this regulation

and it must follow certain accounting methods

and financial reporting.

Failure to follow Sarbanes-Oxley can even result

in senior leadership receiving jail time for non-compliance.

So it's a really big deal for public corporations.

GLBA, or the Gramm-Leach-Bliley Act of 1999

was written to affect banks, mortgage companies,

loan offices, insurance companies, investment companies,

and credit card companies.

Basically, it affects financial institutions of all kinds.

Now, GLBA directly affects the security

of personally identifiable information, known as PII,

and it prohibits sharing financial information

with any third parties as well as providing guidelines

for securing that financial information.

Next, we have FISMA,

or the Federal Information Security Management Act of 2002.

Now, FISMA only affects federal agencies

because it is a federal program.

Now, each federal agency is gonna be required

to develop, document, and implement

an agency-wide information system security program.

FISMA's goal is to create more secure networks

across the whole of the US government.

Prior to this act,

there was the Computer Security Act of 1987,

but FISMA replaced it and added

a lot more stringent requirements.

Another federally focused regulation

is the Federal Privacy Act of 1974.

And this affects any US government computer system

that collects, stores, uses, or disseminates

personally identifiable information, known as PII.

Now note, the Federal Privacy Act only places requirements

directly upon federal government agencies

as they collect information.

It does not apply to private corporations.

For example, my company, DION Training,

does not have to follow the Federal Privacy Act

because we are not considered a US government agency

or organization underneath the US government.

Next, we have FERPA,

which is the Family Education Rights and Privacy Act.

This is a federal law that protects the privacy

of student educational records.

This regulation applies to all schools that receive funding

from the US Department of Education,

including colleges and universities

within the United States.

Next, the Economic Espionage Act of 1996

is gonna affect organizations with trade secrets

and anyone who tries to use encryption

for criminal activities.

Under this act, even intangible trade secrets

like certain processes or procedures

are considered protected.

If anyone tries to steal our trade secrets,

they could be prosecuted under this federal law.

Next, we have COPPA.

Now, COPPA, or the Child Online Privacy Protection Act

is going to impose certain requirements on website owners

and online services that are directed to children

under the age of 13,

as well as other websites or online services

that have actual knowledge that they're collecting

personal information online from a child

who is under 13 years of age.

So if an organization is running a website,

like let's say Facebook,

and they're gonna be collecting data on their users,

they're gonna be subject to COPPA.

Now, a lot of Big Tech companies are trying to say

they shouldn't fall under this law

because they're not targeting people under 13.

In fact, when you try to create a regular account

on Facebook, for example, it's gonna ask for your birthday

to check your age.

And if you're under 13, it won't let you create an account

without your parents' consent.

But what this really does is just have children lying

about their age and selecting a year a little bit older

than they are, that way they can bypass the age check

and create an account anyway.

Now with COPPA, the fines are gonna come

from the Federal Trade Commission, or FTC

anytime there's a violation,

and they charge about $40,000 per violation.

Now, this amount of money could bankrupt smaller operators

and small businesses,

but for a company like Facebook, or Google, or TikTok,

this isn't even a blip on their radar.

COPPA tends to be a pretty controversial regulation

actually, because it puts a ton of extra requirements

on companies that are trying to serve younger markets

with educational content too.

So keep this in mind if you're dealing with an organization

that has products that are gonna be used

by younger users like a toy company, for example.

COPPA is going to apply to them.

All right, now it's time for us to dive into GDPR

and PCI-DSS.

First, we're gonna take a look at GDPR.

Now, GDPR, or the General Data Protection Regulation

is one of the biggest requirements

and one of the best requirements

in terms of consumer privacy protections.

GDPR is a law that was created by the European Union

and it places specific requirements

on how consumer data must be protected.

This regulation applies to any organization or company

that does business with residents

of the European Union and Britain.

GDPR states that personal data cannot be collected,

processed, or retained without the individual's

informed consent.

Now, when I talk about informed consent,

this means that the data must be collected and processed

only for the stated purpose,

and that purpose has to be clearly described

to the user in plain language

and not in some kind of legal jargon.

So if you go to a website and they say,

please enter your name, your email, and your home address

so that we can sell you this product

and then deliver it to your house, well, guess what?

That is the stated purpose.

That doesn't mean they can now send you junk mail

every single week to your home address.

That doesn't mean they can now send you junk mail

every single week to your home address or to your email.

They can't try and just use this

to get you to buy more stuff,

that wasn't part of their privacy policy that you accepted.

Now, additionally, the company must get your permission

for each separate piece of data

that they wanna collect on you.

For example, you could provide permission

to collect your IP address for analytics,

but not give them permission to collect your email address

for marketing.

Basically, GDPR says you have to be upfront with this,

and it also provides a provision in the law

to ensure a user has the right to withdraw their consent

at any time.

It also gives them the ability to inspect, amend,

or erase any data that's held about them

in that organization's database.

This is referred to as the right to be forgotten.

If you're a resident and citizen of the European Union,

you can call up the company or fill out their form online

and say, "I want you to forget everything you've ever known

about me," and they have to go into their database

and scrub you out of it.

That is part of this law.

So if you're a European Union citizen,

GDPR gives you a lot of protections.

But if you're an American citizen,

we don't have those same rights.

So if I'm sitting in Florida and I wanna be forgotten,

I can't do it.

That's not just something that the companies

have to do for me.

Now, I can request it,

but by law they are not required to do it

because I'm an American citizen sitting in Florida.

Now, one of the most unique things about GDPR

is that it actually applies globally to all companies

and organizations that are performing business

with European Union citizens.

So even if the company doesn't have a physical boundary

inside the European Union,

if you're gonna be doing business with citizens there

then you have to meet the compliance requirements of GDPR.

These rules are something that a penetration tester

might be asked to validate to make sure the organization

is in compliance with it during an engagement.

Additionally, GDPR states that businesses must only collect

the minimal amount of data that's needed to interact

with that website.

So there's a lot less data there that could be exposed

in the event of a data breach if you're following GDPR.

Now, if a data breach does occur,

the company must notify all of its customers

within 72 hours.

GDPR also states that if your company

has over 250 employees,

it's gonna be required to audit their systems

and take rigorous steps to protect any data stored

within their system or in the cloud.

Failure to comply with GDPR's requirements can lead

to fines or fees that are levied upon your organization.

If you're gonna perform an engagement

and you wanna include a GDPR check,

there's a great checklist over at https://gdpr.eu.

And you can go there and download it and then use that

to test the strength of the organization's infrastructure

against vulnerabilities known to cause data breaches.

Now, the last thing we're gonna cover is PCI-DSS.

Now, PCI-DSS is technically not a regulation,

it's a standard.

Standards don't have the enforcement that laws

and regulations do, but instead,

they're created by specific industries

and they're followed as a form of best practice.

Now, some standards though do have penalties associated

with them for non-compliance,

and PCI-DSS is one of them.

Because of this, a lot of penetration testers do a lot

of work with PCI-DSS to ensure that companies

and organizations are in compliance with its requirements.

PCI-DSS, or the Payment Card Industry Data Security Standard

is an agreement that any organization that collects, stores,

or processes credit card customer information

has to abide by.

This is not actually a law or regulation,

but instead, it's a contractual agreement

and a standard that must be followed if the organization

wants to handle credit card transactions.

The PCI-DSS standard specifies the controls

that must be in place by the organization

to minimize vulnerabilities, employ strong access control,

and consistently conduct testing and monitoring

of their infrastructure.

PCI-DSS is gonna apply equally to both E-commerce stores

and traditional brick and mortar stores.

To protect cardholder data,

the organization must create and maintain

a secure infrastructure using dedicated appliances

and software to monitor and prevent attacks.

They also must employ best practices,

such as changing default passwords

and training users not to fall victim of phishing campaigns.

They also need to continuously monitor for vulnerabilities

and use updated antimalware protections.

And finally,

they must provide strong access control mechanisms

and utilize the concept of lease privilege.

Now, if an organization fails to comply

with these standards,

they can actually face substantial fines

or even lose their ability to take credit cards.

And for an E-commerce company,

that would completely demolish their ability to do business.

So while PCI-DSS isn't a law or regulation,

it is followed extremely closely by most organizations

to ensure they remain compliant.

Now, PCI-DSS requires a consistent process

of assessment, remediation, and reporting

when using their prescribed controls to secure

an organization and maintain the highest levels of security.

All organizations that process credit cards

are gonna be categorized under four security levels

based upon the volume of transactions that they perform

in a given year.

Level one is for large merchants,

and these are merchants who process

over 6 million transactions per year.

These level one merchants must have an external auditor

perform their PCI-DSS assessment,

and the auditor must be

an approved qualified security assessor, known as a QSA.

Now, a QSA is actually a designation for authorization

of independent security organizations that are certified

to the PCI-DSS standard.

Now, this is not a certification

that you or I as individuals can obtain.

It's only assigned to the organization.

Now, a level one merchant must also complete a report

on compliance, known as an ROC.

This is gonna detail an organization's security posture,

environment, systems, and protection of cardholder data.

Level two is gonna be for merchants who process

between one and 6 million transactions per year.

A level two merchant must also submit a report

on compliance just like a level one merchant does,

but a level two merchant does have the ability to not

have to use an external auditor to perform that assessment.

Level two, level three, and level four merchants

can instead conduct a self-test that proves they're

taking the active steps to secure their infrastructure.

Level three is for merchants who process

between 20,000 and 1 million transactions per year.

And level four is for merchants who process

less than 20,000 transactions per year.

Now, PCI-DSS also requires vulnerability scans

that have to be conducted routinely.

These should be conducted every 90 days

and after any major change inside of your infrastructure.

(upbeat music)