1. ACAA Summer Meeting Carrie O’Brien June 1, 2017
Data Breach Exercise
ACAA Summer Meeting
Carrie O’Brien
June 1, 2017

2. Data Breach Exercise
This is a small group exercise that simulates a data breach within a small city.
It is intended to assist your city to think about how it would respond to a real data breach.
As is true in real life, you will begin this exercise with very little information and discover more over time.

3. Your Team What are the roles each person should play IT Director Mayor
City Manager
Counsel
Public Information Officer
Vendor Representative

4. Your Goal Prepare an Incident Response Plan
Public and Internal Communications

5. ABC City ABC has 20000 residents and 100 employees
Last year, you have procured a highly regarded web-based employee information system and you maintain other databases using amazon web services.
You decided to allow all administrative staff to be “super users” of the system. They have access to everything.

6. The Situation Begins…
A City Court employee reports that he lost his laptop sometime during a conference last week.
Your IT Department determines that the same user’s information accessed databases last night.
Your IT Department also reports that reports of employee information was downloaded from other systems and those files contain private information of employees.

7. Check In How are you building a response plan?
What more information do you need?
Does the fact that the breach involves employee information change the way you plan to respond?

8. Incident Response Plan
Outline the steps to identify the source of the breach, catalog the data affected and how it occurred.
Should you involve law enforcement?
What are the legal ramifications?
How could this be prevented in the future?

9. Lessons Learned What was threat involved in the incident?
What was the vulnerability?
What safeguards should have been in place?
What processes could have been carried out better?
What incident response best practices could've been helpful if implemented?
What resources could've been used to avoid the incident scenario?