Data Security Monitoring and Incident Response
Data Security Monitoring and Incident Response tests whether you can detect data-centric threats, run the response lifecycle in order, and decide whether an incident is a notifiable breach. Items commonly ask what to do first, and when the notification clock starts.
Detection sources and use cases
Useful telemetry for data events: authentication and identity logs, database audit trails, file and object storage access logs, DLP alerts, cloud access security brokers, endpoint detection and response, and cloud control-plane audit logs. Centralise into a SIEM with synchronised time and tamper-resistant retention, because logs that an attacker can edit are not evidence.
High-value detection use cases for data: bulk download or volume far above a user baseline, access outside working hours or from unusual geography, first-time access to a sensitive repository, upload to personal cloud storage, mass permission changes, and privilege escalation. User and entity behaviour analytics helps baseline normal patterns rather than relying on static thresholds.
Response lifecycle
NIST SP 800-61 defines the lifecycle as Preparation; Detection and Analysis; Containment, Eradication and Recovery; and Post-Incident Activity. Containment must not destroy evidence - isolate the host, disable the session, preserve memory and disk images, and maintain a chain-of-custody record with who handled what and when.
Whether an incident is a reportable breach turns on the data and the risk, not on the attack technique. Under GDPR, a personal data breach goes to the supervisory authority within 72 hours of becoming aware, and to affected individuals without undue delay where there is high risk. HIPAA requires individual notice of a breach of unsecured protected health information within 60 days. Contractual notice windows are often shorter than statutory ones, so read the agreement.
Worked example
At 02:00 the SIEM alerts on a 4 GB upload from a finance workstation to a personal cloud account. Reasoning: first triage - is this a compromised account or an insider? Pull authentication logs and proxy records to see the source and session. Contain by disabling the session and isolating the workstation without wiping it. Preserve the laptop, memory and logs. Scope the data involved using the DLP and CASB records. If personal data left the boundary, run a breach risk assessment and start the 72-hour clock from awareness, not from confirmation.
Traps that cost marks
Remediating before collecting evidence. Wiping and reimaging the compromised endpoint. Declaring no breach without a data assessment. Starting the notification clock at confirmation rather than awareness. Monitoring only the network perimeter while ignoring data-store access logs.