CMU5XX-INFOSEC

Information Security for Industry

Session 12: Compliance, Laws, and Auditing

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Navigate the global regulatory landscape (GDPR, CCPA).
  • Understand industry-specific mandates (PCI-DSS, HIPAA).
  • Execute mandatory data breach notification procedures.
  • Differentiate between Internal Audits, External Audits, and Penetration Tests.
  • Prepare technical evidence for a SOC 2 or ISO 27001 formal audit.

Seminar Structure (3 Hours)

Part 1: The Regulatory Landscape (1.5 hrs)
  • GDPR and the Cost of Non-Compliance
  • Industry Frameworks (PCI-DSS)
  • Task 1: GDPR Breach Notification
Part 2: The Audit Process (1.5 hrs)
  • The Purpose and Pain of Audits
  • Evidence Collection and SOC 2
  • Task 2: Audit Evidence Preparation

Part 1: The Regulatory Landscape

Duration: 1.5 Hours

Compliance vs Security

They are not the same thing.

  • Security is protecting the business from threats based on actual risk.
  • Compliance is proving to a third party (government, regulators) that you meet a minimum baseline of requirements.
  • "You can be compliant but not secure, and you can be secure but not compliant." (Though excellent security usually leads to easy compliance).

Global Privacy: GDPR

The General Data Protection Regulation (EU/UK) changed the world.

  • Shifted the paradigm: Data does not belong to the company; it belongs to the Data Subject (the user).
  • The Right to be Forgotten: Users can demand a company permanently delete all their PII. (Extremely difficult to execute technically across backups and legacy databases).
  • The Fines: Up to 4% of global annual turnover. This made privacy a boardroom issue instantly.

Industry Specific Mandates

If you play in their sandbox, you play by their rules.

  • PCI-DSS: Payment Card Industry Data Security Standard. Required for any company that processes credit cards. Highly prescriptive (e.g., explicitly requires 7-character passwords and quarterly vulnerability scans).
  • HIPAA: US Healthcare regulation protecting Patient Health Information (PHI). Heavy focus on data-in-transit encryption and access auditing.

Introduction to Task 1

When a breach occurs, the clock starts ticking. Legal and regulatory notifications must be flawless to minimize fines.

We will simulate the mandatory 72-hour GDPR breach notification process.

Task 1: GDPR Breach Notification

Timing: 45 minutes

You discovered yesterday that a misconfigured AWS S3 bucket exposed 10,000 UK customer email addresses and home addresses to the public internet for the last 3 weeks.

  1. Under GDPR, who must be notified, and what is the strict timeline for this notification?
  2. Draft a concise (3-4 sentences) notification email to the affected customers. The tone must be transparent, outline the data exposed, and offer immediate mitigation (e.g., credit monitoring).
  3. Identify one technical control failure that caused this breach, and the administrative control that failed to detect it.

15 Minute Break

Please return promptly for Part 2.

Part 2: The Audit Process

Duration: 1.5 Hours

The Audit

Trust, but verify. (And then provide 500 pages of screenshots).

  • Internal Audit: Conducted by the company's own staff to prepare for external audits and ensure policies are working.
  • External Audit: Conducted by an independent third party (e.g., a Big 4 accounting firm) to issue a formal certification (like ISO 27001 or SOC 2).
  • Auditors don't care how secure you feel. They care what you can prove through documented evidence.

Evidence Collection

The bane of an engineer's existence.

  • If the policy says "All accounts must be reviewed quarterly," the auditor will ask for the signed spreadsheet from Q2 showing the review happened.
  • If you reviewed the accounts but didn't sign the spreadsheet, you failed the audit.
  • System Generated Evidence: A screenshot of an Active Directory configuration showing that the password length is set to 12. Must include the timestamp and the server name in the screenshot to prove it's authentic.

SOC 2 Reports

The standard currency of B2B trust.

  • Type I: A snapshot in time. "On January 1st, they had a firewall." (Easy to pass).
  • Type II: A period of time. "From Jan 1st to Dec 31st, they had a firewall, and here are the logs proving it was never turned off." (Hard to pass, highly trusted by the industry).
  • If you are a SaaS company and do not have a SOC 2 Type II report, large enterprise clients will simply refuse to do business with you.

Introduction to Task 2

Auditors sample data. They will pick 5 random employees hired last year and ask for their onboarding security training certificates. You must know how to pull evidence.

We will simulate an evidence-gathering request from an external auditor.

Task 2: Audit Evidence Preparation

Timing: 50 minutes

An external auditor for your upcoming SOC 2 Type II assessment sends the following request: "Provide evidence that the principle of least privilege is enforced for developers accessing the production AWS environment."

  1. List two specific pieces of technical evidence (e.g., screenshots, export logs) you would provide to satisfy this request.
  2. List one piece of administrative evidence (a policy or process document) you would provide to show this is a formalized standard, not just a technical accident.
  3. Explain why providing too much evidence (e.g., dumping the entire IAM user list to the auditor) is a bad strategy.

Module Conclusion

  • Security without governance is chaos. Governance without security is a paper shield.
  • You are now equipped to bridge the gap between technical operations and executive risk management, driving a mature, resilient, and compliant security posture.
End of Module: CMU5XX-INFOSEC