4.4.2. Mitigation Strategies and Regulatory Compliance
💡 First Principle: Mitigation isn't elimination—most threats can be reduced but not eliminated. The goal is making exploitation harder, detecting it faster, and reducing impact when it occurs. Layered controls (defense-in-depth) ensure that no single control failure creates total exposure.
Technical Mitigation Strategies
- Data monitoring: Continuous monitoring of data access patterns. Deviations from normal (unusual volumes, unusual hours, unusual destinations) trigger alerts.
- Log analysis / SIEM: Aggregating and correlating events across systems to detect multi-step attacks that aren't visible in any single log.
- Two-person integrity: Critical actions require sign-off from two people—neither can act alone. Applies to split encryption keys, financial transfers, and access to the most sensitive data.
- Separation of roles: Different people control different parts of a system. No one person has complete end-to-end control.
Regulatory Compliance Frameworks
| Framework | Scope | Key Requirement |
|---|---|---|
| PCI DSS (Payment Card Industry Data Security Standard) | Any organization that processes credit/debit card data | Protect cardholder data, maintain security controls, undergo audits |
| HIPAA | Healthcare organizations and their business associates | Protect Protected Health Information (PHI); breach notification |
| GDPR | Any organization handling EU residents' data | Data minimization, consent, right to erasure, 72-hour breach notification |
PII (Personally Identifiable Information)
PII is any information that can be used to identify an individual: name, SSN, address, email, biometric data. PII handling requires:
- Minimization (collect only what's needed)
- Protection (encryption, access controls)
- Retention limits (don't keep it longer than required)
- Breach notification when compromised
Legal Considerations
- Data retention (legal hold): When litigation is anticipated, normal retention policies are suspended and relevant data must be preserved.
- Subpoenas: Legal orders to produce records. Organizations must have documented processes to respond while preserving chain of custody.
⚠️ Exam Trap: PCI DSS applies to any organization that stores, processes, or transmits cardholder data—not just banks. A small retail website that accepts credit cards is in PCI DSS scope.
Reflection Question: A healthcare IT admin is asked to delete all records of a specific patient to "clean up the database." Before complying, what regulatory consideration must be verified?
