Logfiles? GDPR Says YES!
•Download as PPTX, PDF•
0 likes•479 views
Presentation by Andrew Cormack at Networkshop50 in June 2022. Andrew gives advice on how network logging and monitoring data should be safely handled with due consideration to GDPR.
Recommended
More Related Content
Similar to Logfiles? GDPR Says YES!
Similar to Logfiles? GDPR Says YES! (20)
More from Jisc
More from Jisc (20)
Recently uploaded
Recently uploaded (20)
Logfiles? GDPR Says YES!
- 1. Logfiles? GDPR Says YES! Andrew Cormack (@Janet_LegReg)
- 2. GDPR Principles Lawful, fair, transparent Purpose limitation Data minimisation Accuracy Storage limitation Integrity and Confidentiality Accountability Logfiles? Data Protection says "YES" 2
- 3. GDPR Principles Compromised Lawful, fair, transparent Purpose limitation Data minimisation Accuracy Storage limitation Integrity and Confidentiality Accountability Logfiles? Data Protection says "YES" 3
- 4. Needed to prevent/detect/remedy breaches: Data Data • To spot patterns and abnormalities • Flows, activity, logs • Network/email, Website visits, file/process creation/deletion • Lots of personal data • Normal & abnormal Logfiles? Data Protection says "YES" 4
- 5. Data • To spot patterns and abnormalities • Flows, activity, logs • Network/email, Website visits, file/process creation/deletion • Lots of personal data • Normal & abnormal History • To understand how breach happened • To mitigate current harm • To prevent future harm Needed to prevent/detect/remedy breaches: History Logfiles? Data Protection says "YES" 5 +
- 6. Needed to prevent/detect/remedy breaches: Care Data • To spot patterns and abnormalities • Flows, activity, logs • Network/email, Website visits, file/process creation/deletion • Lots of personal data • Normal & abnormal History • To understand how breach happened • To mitigate current harm • To prevent future harm Care • To be (much) less threat than the badguys… Logfiles? Data Protection says "YES" 6 + != +
- 7. GDPR => Goldilocks logfiles => Good IR GDPR Principle IR/Logging process IR benefit Lawful, Fair Write your process Rapid response Data Minimisation Log data the process needs Ready when required Storage Limitation/Accuracy Keep while meaningful Manage the haystack Integrity/Confidentiality Keep secure Don’t help badguys Process minimisation Automate early stages Reduce human burnout Purpose limitation Identify (only) victims Help those who need it Logfiles? Data Protection says "YES" 7
- 8. Where we should be Virtuous circle Logfiles? Data Protection says "YES" 8 Logfiles Incident Response GDPR
- 9. Data Protection Impact Assessment (DPIA) Valuable for thinking, and confidence-building Why are we doing this? What do we need to do to achieve that? What risks does it create? What safeguards can we apply? Is residual risk justified by harm prevented? Logfiles? Data Protection says "YES" 9 E.g. https://repository.jisc.ac.uk/8433/1/jisc-security-operations-centre-dpia-may-2021.pdf
- 10. Automated Response: Automation Logfiles? Data Protection says "YES" 10 Levers Data
- 11. Automated Response: Oversight Logfiles? Data Protection says "YES" 11 Levers Signals Data Controls What does goodguy need?
- 12. Automated Response: Adversary Logfiles? Data Protection says "YES" 12 Levers Signals Data Controls What can badguy do? What does goodguy need?
- 13. Sharing logs Hint from Commission NIS2D draft… Logfiles? Data Protection says "YES" 13 GDPR NIS2D When to share • Necessary for “important public interest” • GDPR Art.49(1)(d) …including • Financial losses • User confidence • Economy damage • Society damage • NIS2D Rec.3 What to share? • Necessary for legitimate interests • Not over-ridden by rights and freedoms • “balancing test” • GDPR Art.6(1)(f) …protected by • Traffic light protocol • Pseudonyms • State norms (e.g. GGE) • NIS2D Rec.6
- 14. help@jisc.ac.uk jisc.ac.uk Thank you Andrew Cormack Chief Regulatory Adviser Andrew.Cormack@Jisc.ac.uk
- 15. References •https://regulatorydevelopments.jiscinvolve.org/wp/2021/02/15/data-protection-and- incident-response/ Incident Response blogs, presentations and papers •https://www.doi.org/10.2966/scrip.130316.258 (GDPR + Incident Response) •https://www.doi.org/10.2966/scrip.170220.197 (GDPR + Logfiles) •https://www.doi.org/10.2966/scrip.180121.83 (NIS2D + Sharing) •https://repository.jisc.ac.uk/8433/1/jisc-security-operations-centre-dpia-may- 2021.pdf Janet Security Operations Centre DPIA •https://dl.acm.org/doi/10.1145/3370084 Fingerpointing False Positives Logfiles? Data Protection says "YES" 15
Editor's Notes
- From time to time, security people ask me if logfiles are OK under the GDPR. They do contain a lot of personal data, after all. I hope this talk will reassure you that data protection law has become increasingly positive about keeping systems and networks secure, and now provides a really good guide to preventing and responding to security incidents. I was invited to present this thinking to a European Commission lunchtime talk last year, and they pointed out some extra ideas I had missed. So…