CISSP Domain 1.0: Investigation Types and the Device Behind the Television (376)

Machine-generated from the episode audio, with names and acronyms corrected. Spoken wording is otherwise unedited, so expect the occasional rough sentence.

Welcome And Today’s Game Plan 0:00

Good morning, everybody. It's Shon Gerber with CISSP Cyber Training and hope you all are having a beautifully blessed day today. Today is Monday, and we have some awesome stuff we're going to be going over today as relates to different aspects of the CISSP. We've got an article to go over, followed by training, and then some CISSP questions. And the goal is what? Yeah, it's to get you to pass the CISSP the first time and get you some great information so that those that are listening to this that are already CISSP holders know full well that you can use this for your CPEs. And so knowledge is power.

So here's what's going on

Hidden Recorder Found In Boardroom 1:01

today. A company found a listening device hidden in a room where its executives meet. Now, I don't know if you've ever dealt with this before, but that is something that's definitely out there. And they did everything you would want a company to do when they discovered it. They pulled it, they analyzed it, they pulled the camera footage, and then they went through the logs. They figured out who it was, they fired the individual, and then they called the FBI. Now every single one of those steps was reasonable and expected. And somewhere in the middle of that list, though, the investigation stopped being there specifically, and then nobody ever sent a notice that said, hey, this changed.

That's domain 1.6, investigation types. And it's one of the least taught subdomains in the entire CBK. And it shows up on the exam anyway, but you really need to kind of understand what it relates to different types of investigations. So the incident in late September, staff at a major AI company found a recording device in an executive's conference room. So we've talked about this and you've seen it in the news. And it was plugged into a USB port on the back of a television. It was wrapped in toilet paper and it was very nondescript. And I want to be careful here. Right from the start, a former engineer has been arrested and charged in federal court.

He's not been convicted of anything. Everything about what he did is an allegation, and in that complaint specifically. So I'm going to be saying alleged a lot, and I'd ask you to kind of hear it every single time that I say it, because you know, we don't know. And the way it works is he's innocent until proven guilty. So we'll see how this all plays out. So here's what the company did next. And this is the part worth your knowledge and attention. They analyzed device, they used their own models specifically, their AI models, to do this. And according to the complaint, the thing had been modified, possibly to stop it from talking to the television it was plugged into.

They made a forensic image of the storage card, bit for bit, so that nobody was ever poking at the original, which is what we expect to have happen. And they got absolutely nothing, right? The card appears to have been encrypted, and whatever was on it, they could not read it. Now hold on to that because it's going to matter later. They did the right thing and it produced no data. And the image they made is still the evidence, right, of what was specifically on the device, how it was configured, and what state the device was in when they took it. But the absence of readable audio is not the absence of a finding.

They went back through the building's camera footage. Prosecutors say they put them near the conference room on several occasions in a room he had no business being in. They went through this tool usage, and the complaint alleges that over about a month he used an internal productivity agent to ask about building addresses, meeting rooms, room capacities, calendars, and partner venues. They put a camera in the room because there had not been one covering it when the device went in. And a few days later, that camera allegedly caught him coming back to check behind the television. They found a second device in a bag he had left in another room.

Security staff opened the bag, inside it was a second recorder, his wallet, and his ID. Now, since something happened that I want you to sit with for a minute. He reported the bag missing. He collected it from Lost and Found the next day. And afterward he said things were gone. They were missing from it. A credit card, a few hundred dollars in cash, and some AirPods. So now you have a company holding on to what it believes is evidence taken out of a bag belonging to an employee. So who is specifically on the record saying the property went missing from the bag while the company had it?

So I'm not telling you who's right about this whole situation, and I'm not telling you that this is a chain of custody problem, because you know what? I'm not a lawyer and I don't play their one on TV. But it arrived uninvited. They did not plan on this at all. They then terminated him and they reported it to the FBI. So earlier this month, he was arrested. He's been charged with using or endeavoring to use a device to intercept oral communications. If he is convicted, the maximum is five years and a quarter of a million dollars. I mean, that's huge. You're talking large amounts of money.

The FBI is investigating and the U. S. Attorney's Office for Northern District of California is prosecuting. And then finally, the Justice Department of National Security Division is assisting in this overall investigation. The company in question has said that there's been no indication that the model weights, source code, or customer data was accessed by any of this. So there's a lot of squishy stuff going on in all of this.

The Quiet Shift To Criminal 5:36

So let's look at this from the manager's perspective. And let's go back through this from a security point of view. How should this be done with and how should you deal with it? Because realistically, they didn't do anything specifically wrong. There's just some gray areas in there that can get extremely squishy. So if we go back to that list, every step on it was competent. Honestly, most companies could not do what they did. The forensics, the correlation, the speed. Again, most small companies wouldn't have that ability or the capabilities to do that. But notice what happened to the kind of investigation they were running. At the start of it, it was an administrative one, right?

An internal investigation. Their building, their equipment, their employee, their policies. They can look at whatever the policy says they can look at. And the standard they have is basically their own. They can do however they feel. But by the end, it went from being an internal investigation to a criminal investigation, including federal charges, an FBI case, and a standard of proof that really isn't theirs and a set of evidence rules that they truly do not control. So here's the thing nobody announced the switch. They installed a camera to catch somebody they already suspected. They opened a bag that another person's wallet was in it. Those are not reckless acts, but they are collection acts, and they happen on a way into what they call a criminal case.

So now they have to be careful because I'm not saying that they did anything wrong, just to be clear here. I'm not saying any of that. I have no idea, nor neither do you. The question is not whether they were right or wrong. The question is whether anybody in that room at that moment was asking this question. Whose case is this now? Because the type of investigation determines your standard of proof. Who has the authority to collect? What makes evidence admissible? And who you're allowed to tell. Change the type, and all four of these things change underneath you. So that's the subdomain. That's and that's not an incident response question.

It's a domain one question because it's about what you're accountable for and you know what you're dealing with. So this is where we're gonna get into the training around domain 1.6. And 1.6 is the requirements for investigation types, the moment it stops being yours. And that's what we're gonna get into related to the incident that we saw as it related to the Department of Justice. But before we get into that, I gotta put a shameless plug out there for CISSP cyber training and the ability for me to help you pass the CISSP the first time. So there's three ways of studying with me. We have the accelerator, the pro, and the sprint cohort.

My accelerator program is divine for those that want to do self-study, and it's got everything you need to pass the exam the first time. My pro edition is gives you a little bit more in-depth in some of the diagnostic aspects of it, also some more in-depth aspects around the questions, and it gives you direct connection with me and my office hours. So it's it's the pro, it's just a it's a bump up from where you're at with the accelerator. And then there is the Sprint cohort. This is the best if you really want to get your CISSP knocked out within the next 90 days. We have it's there, it's available for you, and I've been having great success with this because the students have been taking this and they've been passing the CISSP exam.

So it's it's awesome. Things are going well. I actually, because of that, we have opened up two specific cohorts. They're going to be starting an AM version and a PM version. I have a lot of folks that listen to me from all over the globe, and so that each of those are designed to help you, whatever MOT method you are. So I got a 7 a. m. and a 7 p. m. , and they start November 17th. So go check it out at CISSP Cyber Training and sign up for which one works best for

Domain 1.6 Investigation Types Explained 9:12

you. Okay, so we're dealing with 1.6. There are 13 subdomains. Now, this is one that's typically skipped quite a bit when you're dealing with domain one, and it's the investigation types 1.6. And so we're going to kind of get into this and how you've seen this pass and how this is kind of working with the most recent incident that we just kind of recently talked about. So there are five types, and you need to learn them by basically what they can do for you. So the types are there's administrative, there's criminal, there's civil, there's regulatory, and then there are industry standard types. So when you're dealing with an administrative one, who is the authority in this?

This is the organization itself. You have the administrative ability to go and deal with these types of investigations. You have a criminal investigation. This is where law enforcement or prosecutors will be involved in this. This is outside of the organization. Now, the organization may work with the criminal or with the law enforcement, but this is specifically set up with law enforcement as a whole. Civil is dealing with the private party. So in many cases, someone may actually have deal with an administrative lawsuit or maybe even a criminal lawsuit. And let's say it's not reached to the level of beyond a reasonable doubt from a criminal standpoint.

The civil people, well, the folks that are involved, a private party, will then try to do a civil lawsuit against you, and or whoever that might be. And that would be a private party doing that. The regulatory aspect, this is a regulator or by statute that is set up specifically. And that is something that could happen from PCI, DSS, whoever it might be, that is going to be doing or SOCS, they're going to be doing an audit or some sort of regulatory finding against you. Could be the Department of Energy, it could be any of these SEC regulators could be in doing this. And then there's industry standards.

This is contracts that you sign specifically. This is set by the contract, and there could be penalties or a loss to the right to operate if there is an investigation that needs to be occurring. So again, these are all different types of burdens of proof that will tie to this. Administrative is the lowest because it's based on your own policy. If you don't like what the person's doing based on the policy and they are contradictory, they can be released, they can be fired, they could have potentially wages garnished. But it's the lowest burden of proof. Your criminal one is beyond a reasonable doubt here in the United States.

Obviously, that may change in different parts of the world where you may be, but in the United States, it's beyond a reasonable doubt. Civil is preponderance of the evidence. This is where it's made by a judge or potentially in a courtroom where that would be then determined whether the preponderance of evidence meets the or is exceeds the need for them to be able to have some sort of garnishment completed against them. Regulatory, this will vary by statute and by the form that's out there specifically. And the industry standards are set specifically by the contract. So now to connect all of this, is the type needs to be set by who's the authority, the inquiry it runs under, not by how serious it is and not by what the conduct was.

So let's look at there's two one case with two specific investigations. So what they were running at 9 a. m. in this last conversation we had, it was their building, their equipment, their employee. That's where it started was an internal investigation. They decided to scope and they decided what to look at. No subpoena was required. The policy that they created, what is allowed them to do this because it was based on a condition of employment. So the standard must meet one that they wrote. The worst outcome available to them is, in this case, termination. And so that's the administrative investigation. Now, what happened by the end of the week, though, is it became a criminal one alongside, and I want to make this key firm, key term, alongside the administrative one.

So then an FBI case and a federal complaint were completed. And because of that, the scope that they had, the business was no longer theirs. The standard that they had went moved from basically having the ability to do it to beyond a reasonable doubt. And what was admissible was decided by somebody else. So it went from administrative into the criminal aspects of this. So two investigations can run in parallel. One investigation is never both. And it was in this case where we look at it, where it went from being administrative to criminal, but it kind of had the squishiness of being both. Again, I don't know.

This is just looking at the information we have, and I'm not a lawyer, but this is something that we can look at and to make decisions around and kind of help as we look to the you go into your other businesses, and as a security professional, using your practice, you can decide, hey, when do I need to bring the FBI in or law enforcement in this situation? So again, we're going to go through more of that here in just a second. So you change the type, four things specifically will move. So we talked about the types, right? You're at your administrative, your civil, your uh criminal.

If you change any of these types, these four things will move. Standard of proof, right? So if you change it and you go from civil to criminal, the standard of proof changes. Your authority to collect, that will also change. From again, what you look at, whose consent do you need, all of those pieces. The moment you think a criminal investigation occurs and now you are taking people's private property, does your policy have the right to do that? Are you now in a criminal investigation? What is the chain of custody related to that? Is this admissible? Whether you can gather it and it can be used.

Collecting properly for an HR file is not the same as collected properly for the courtroom. They are very different. And that needs to be really defined and worked out well. Who you may tell. Disclosure is controlled differently in every specific type. You tell the wrong person at the wrong moment, in and of itself, is its own finding. So you've got to truly understand. This is where legal counsel really comes into play. And I would highly recommend you take this as an example as we go through this and bring it up to your uh counsel and your HR teams and make sure that they understand this and maybe define how you want to go about this.

Bag Search Chain Of Custody Risks 15:20

So they opened a bag, then it was custody. So what does this mean? The security staff opened an unattended bag. What is this specifically? It is collection. Now, it's a policy question and a consent question. Is it fit your policy? Potentially. Is there consent? I don't know. Is that set up within the policy that the moment anything that's in your building, the consent is that you have the ability to open it? Inside was a second device, a wallet, and an ID. Now, this was a seizure thing. Now you're holding on to somebody's property. How is that defined? How does legal counsel deal with that? He had reported the bag missing.

So that's a custody issue. So he does not know that you have it, so he's going, well, it's missing now. It has walked away. So who actually owned the custody of it? That's another thing that's called out in question. And then he collected it from Lost and Found. You transferred it from you, from this business to him. So that was he who handled it? Who dealt with it in between? Was that written down? Was it documented? What was actually taken out of it? He says things were missing outside. He didn't mention the fact that the recorder was missing, but he said AirPods and money. Well, you how do you answer that?

How do you deal with that? So again, I'm trying to make this comment that nobody did anything reckless as far as I'm concerned. Plus, I'm not a lawyer. I can't say they did or they didn't. But I'm telling you that these, based on the information we have, there's some things in here that can get a little squishy. And so that the ultimate point is bringing this up because, like I mentioned, the the folks that are dealing with this, and you've seen in the news, they have a large forensics team and they have a team of folks that can handle this. The company I used to work with, they had a team that handled these things.

And they had third parties that they would bring in. But if you're a small company, you probably aren't dealing with this. So now, thinking you're doing the right thing, you could open yourself up to a lot more challenges than what you have originally anticipated. If you're a startup and you're working in this, how does this affect you? So again, good information to study and to learn and try to figure out what is best. But as you know, when you're studying for the CISSP and the exam, these are kind of questions that could potentially come up. So now you understand the overall scenario, it may be something that you would have to deal with on an exam question.

So now they imaged it and they received nothing. They got nothing out of it. Babkus, no things at all. So the pharyngic image was done bit by bit, but when it was done, there was nothing there because it was encrypted. They couldn't read a thing off of it. So what did they actually had? They had a documented state. The device was, they had how it was configured, that they knew it was encrypted, the state that in which they took it, and then who took it. But at the end of it, it was empty. But it can be admissible, right? So this could be done. They can show that, well, this was encrypted for a reason.

All of these aspects can be done from a configuration standpoint to prove this individual may have been doing something that he wasn't, we didn't want him to be doing. Now the question though comes into is is that admissible now because you gathered it? Or did you have a chain of custody with that so that it could be passed off to the law enforcement

What Makes Evidence Usable In Court 18:20

folks? So process produces admissible evidence. Content produces a conclusion. So the investigation that confuses the two gets a good answer it basically can't use. So there's five things evidence has to be. Accurate. It has to be what you say it is. It has not changed since you took it. Authentic. You can show where it came from and connect it to the thing that it's about. Complete. It concludes what helps your case and does not help your case. It curated it is not complete. Basically meaning if you chopped and made it all fit perfectly, it's not complete. Convincing. It's a reasonable person can follow it without taking your word for the gaps.

It makes sense. If there are gaps, it makes sense why there are gaps, but it's not you telling them, well, the gap is because I moved it from here to here. Well, okay, where's that documented? Well, it's not documented, just take my word for it. That's that's not convincing. Admissible. It is permissible in this forum, and the forum changes with the type. Depending upon the type, civil, criminal, that's how the forum changes. So four of these are about the evidence. The fifth is about the room, the type. The same item, different investigation types, equal different answers. So again, we're gonna get into the civil aspect.

I want to just highlight the fact, again, I'm not a lawyer. These are things that have been out there that you may deal with related to the CISSP. The

Civil Preservation And Litigation Holds 19:40

trigger is the condition. What ends up happening when litigation potentially starts and when a complaint is filed, this is where the condition, the trigger is for that. A demand letter is enough. So if there's a credible threat, an internal escalation, or a regulator notice, this is where you will be. That's enough to continue this civil process. Now, your jurisdiction may change in that, but that's enough. Preservation is an act. You define the scope, you issue the hold, you suspend routine deletions. All of those things are done. Again, that is leaving things alone so that it is not deleted. The preservation is an act. You must document what you did and you must define what is going to be preserved.

Those are very important parts of any sort of civil action. And then routine deletion is a risk. You need to really deal with this, and this is something that I dealt with before is that you would get a letter, and a letter would come in, and the lawyers would come talk to you, and they would say, make sure you stop any level of deletion. So you need to be aware of any routine deletions that may be occurring on your systems. Many times they're on a schedule, right? You don't want to have all of this ballooning data, and so there are routine deletions that are occurring.

You need to be aware of what is on that routine and on that schedule to ensure that you are now obligated to not delete that information. So preservation is an act. You must make sure that that is in place. Now, key part on all this is handing information to law enforcement does not transfer your civil responsibilities. And a criminal case does not pause it. You run in the situation where both if you have a civil and a criminal case going at the same time, they both clocks are running at the same time. Again, you just have to work through that. Again, not a lawyer, work with your counsel to make sure you get this down straight, but understand the overall path of this and the importance of each of these documentations.

Regulatory Inquiries And Scope Control 21:33

Now, when you're dealing in the regulatory space, two investigations that in place, only one is yours. What do I mean by that? Well, let's just say, for example, you have an investigation and you feel like there are the uh regulators come up to you, the SEC, and they say you need you we've found some issues with whatever, with blank. You may decide to do an investigation on your own. Hey, we're gonna dig into this. We need to find out what's going on, we need to get all this information. And we need to see what's actually happening. That's great. You do your investigation. But with that, you cannot go in and start fixing things that are done.

You need to make sure that you do an investigation. You're not changing what has occurred. Now you may find the findings of what this SEC, we'll use this as an example, investigation is, but you cannot go out and start making changes. The reason I say that there's only one is yours, you cannot say, I'm going to provide this investigation and pass it off to the SEC and see what they say in this example. They will conduct their own investigation. They will decide how far they will go. They are going to determine all of that. You do not negotiate with these people to say, hey, we'll give you what we want.

No, these regulatory bodies can decide what they want to investigate and what they do not. So when you're doing an investigation in parallel, you're doing it in parallel. One, to potentially understand the gap and the risk. And then two, if you decide to give any of that information off to them, you have the ability to do that. Then you can make that call at that time. Again, though, do not, I repeat, do not make changes to your network if you're doing an investigation, because there was a reason behind it. You need to document it, determine what's going on, unless that, again, I'm telling you, don't make changes unless, oh my gosh, people are going to get hurt and things like that.

Then you work through that. But realistically, those are two separate investigations. Both real are real and both run at the same time. Handling yours does not close theirs. So just kind of keep that in mind. You also need to decide who decided the scope. Ask that question. So if the scope is not decided by you, the investigation is not yours to

Contract Rules And PCI Forensics 23:41

run. So then we deal with industry standards, and this is dealing with a contract. Now you're probably going, well, there's really what do you mean by that? Well, you may have agreed to an obligation to be able to have some level of investigations that could be done and within your organization. So the payment card rules are a standard example. They have the ability where a forensic investigation is required, it must be done by a PCI forensics investigator from an approved list. So that's a situation where they're saying you have to do it through their people for any sort of investigation. So that's where the contract comes into play.

The investigator cannot work for the organization being investigated. That's a structural problem that you can't have. So it's like saying I'm gonna have my own person do the investigations and I will give you the findings. That doesn't work. So based on contractual aspects, if you have that already built into it, where there's it needs to be a forensics investigation, it must be done by the folks that are defined within that contract. And in most cases, I would say probably all that I've ever dealt with, it would be an outside party that their own list of people they work with. Fines and the loss of right to keep doing business can be a result if you do not follow through with this.

And so that's a big, big deal that you need to deal with. And when you're signing documentations with people, there may be those clauses in there where they may want to do an investigation. Or let's just say, for example, there's a finding of some kind, and because of that finding, they want an investigation, they have the right to do that based on the contractual aspects you have with them. So when an obligation comes from a contract, you need to ask who the contract names specifically. And that's just you've got to really think through that. So I hope that makes sense to you all. But this is something that you may see on the CISSP.

If not, you know what? It's really good information as a security leader for you to keep in mind and use this as a tool that you would use with your security practices.

Manager Checklist When Types Change 25:34

So now you're dealing with the management side of this. The moment it stops being yours, so you need to name the type out loud early. We talk about it. Is it an internal investigation? Is it a criminal investigation? You need to do that before anyone collects anything else. So at the beginning, we're running an administrative investigation, but then at some point the sentence needs to be said, well, we're moving to a criminal investigation. And then that changes things completely. You need to decide the referral trigger in advance. In fact, we find it, it means who do we call? You need to write it down now.

When nobody is under pressure and nothing is personal, you need to figure out who do we need to call. Collect it as if a type will change. So, what I mean by that is if your type is right now on an internal investigation, you need to be understanding that it very quickly could move into a criminal or a civil investigation. And if that ends up being the case, know full well at what point will we move from being this, let's just say internal, to criminal. How does that work? Because again, it's none of this is wasted if the matter stays internal. You're doing extra work if it's staying internal, and that's fine.

But if it does migrate away, you want to be as successful with it as possible. Again, I talk about a small business. The worst thing can happen is you have, let's just use this example where they have intellectual property theft. The same situation. And now you know you caught them dead to rights. They're doing it. And you know what? You didn't have legal counsel on any of this. You just decided I'm gonna fire the person, then I'm gonna call the police, and we're just gonna do this. And what ends up happening? Well, now none of this information potentially could be inadmissible, could ends up being inadmissible in the court, and it doesn't fall for a criminal activity.

Now you lost all that evidence. Well, now what happens if your IP has already left the building? It's a huge deal, right? You could end up, your company could go away because you did not follow the right processes. And again, I'm not a lawyer. Get with a lawyer to have them walk you through this process and what is best for you and your organization. That being said, this is the expectation around understanding it from a bigger, bigger picture. And lastly, know who you must stop talking to. This is the part where it gets squishy. Again, using that same analogy where you have a business and you're a small business, and you know what?

You're the owner, and you start talking to people, going, Joe, what did Joe do? Blah, blah, blah. You start talking all this way, and next thing you know, Joe, you have just started talking about a criminal investigation to everybody in the office. And now what does that do to your case? So again, back to that point. Keep watch what you do. We always say this when we're flying, loose lips, shit sink ships. Doesn't go into the same thing concept here. Be very careful who you're chatting with. Okay, so three questions you need to ask your people today. Who decides we call law enforcement? A name, not a committee.

If three people think it's someone else, then nobody's making that decision. So you need to ask yourself. Two, what do we do in the first hour that we could not undo? So when you're dealing with collection as an answer, as an option, what happens there? Three, have we ever issued a litigation hold? And what basically what does that mean? Is the lawyers say you can't delete anything. Hold all the documentation, keep it, right? If the answer is no or nobody is sure, well then that's a finding. That's something you need to know. This process does not get invented on the day that it happens. Think about it now.

Again, these are these are big nuggets that will save you tons of time and money and a heartache in the future. These are not hard things to do, especially with the advent of AI and the ability to help you with some of this. And you between lawyers, AI, and taking the time, you can present, you can set yourself up in a situation where when it does happen, probably not if, but probably when, you are in a much better position to protect you, your company, and your people. Now here's a bottom line from a guy who's a consultant. None of these three things needs a tool, a budget line, or a consultant.

You can do this on your own, but you just need to go and work about it and think about it and have a plan. Okay, so domain 1.6 in five lines. The type follows the authority, the inquiry under, not the conduct, not the severity. Two, change the type and the four things move standard approved, collection authority, admissibility, and disclosure. Three, two investigations can run in parallel, but one investigation is never both. Fourth, a civil preservation duty attaches on reasonable anticipation, not on service. And then the fifth, industrial industry standards are contractual, and the contract names who may do the work. Key point on all this is nobody sends you a notice when the type changes.

You need to be aware of it and be able to do it on your own.

CISSP Practice Questions And Traps 30:19

Okay, so here are four CISSP questions related to the content we've been talking about. All right, first question. Your security team has found a concealed recording device in an executive conference room. You may have imaged it, pulled the building's camera footage, and reviewed the employees' internal tool usage. Nothing has been referred to law enforcement yet, and no decision has been made about whether it ever will be. Your general counsel asks what kind of investigations you are running right now. What is the correct answer? A criminal because the intercepting oral communications is a federal offense and that is what's being investigated. B. Administrative because the inquiry is conducted under the organization's own authority for its own purposes.

C a joint criminal and administrative investigation because the material would be shared if it is ever referred. And then D. None of them yet because an inquiry has no type until the formal process has been opened. Okay, so key things to take out of this conversation and things to look at. So which one do you think it is? And the answer is B. Administrative because the inquiry is conducted on the organization's own authority and for its own purposes. So you made sense, right? We've kind of talked about this. It's under an admin, you're doing an internal investigation, makes sense, right? But there's some traps in here that you may bite off on.

One is a this A as a criminal one because you're intercepting oral communications, you know they're doing that. So therefore, that automatically could be a criminal offense. So you you could, you could just say, you know what, we're gonna do this. It's criminal. But once you do that, you have to make the decision because now the administrative one could work in parallel, but like we talked about, it can open up a whole new set of challenges you have to work through. Another one of them is again the like I like the one at the on C, you could bite it and say into it and say it's a joint criminal administration one, right?

Because it is. But when you look at the overall plan of this, there was no referral had ever happened. So there's no second investigation to be joint with. There's no two types that can run in parallel. One inquiry is never both. And then the last one, none of them, because an inquiry has no type until a formal process is set up. There's no typeless state, right? You have to, you either you make a decision at that point, you take it and you do it. You either do administrative, you do criminal, you do whatever that might be, but that's has to decision has to be made.

Next question: a different organization, same failure mode, a regulated financial institution, a regulator has opened the formal inquiry into a security incident. Your chief operating officer proposes that the institution run its own internal investigation first, and then hand the regulator a written summary of the findings. He argues this keeps the work controlled, limits disruption, and gives the regulator what exactly they're looking for. What is the central flaw in this plan? A, the work should be directed by outside counsel so the findings are protected, which the proposed approach does not provide for. B, the internal investigation cannot meet the standard of proof regulator applied to its own findings.

C, the running of an internal investigation first risks spoilage of the evidence later civil plaintiffs would be entitled to, or D, the investigation runs under the regulatory's authority, so the regulator sets the scope and in most regimes can compel production of any information required. And the answer is D. The investigation runs under the regulatory's authority, and the regulator sets the scope and in most regimes can compel production. And that's so that comes down to is the regulator, like we used in our example, the SEC, they're gonna say what scope they want. Do I want everything? Do I want narrow scope? What do I specifically want as a regulator?

And they can compel to say, I need this information. There's lots of ways they can do that. But bottom line is if you are regulated by some sort of regulated body, that is something that is expected that you must provide. Now, the trap in all this is I have outside counsel direct the work till the findings are protected. Now, this is probably the most sophisticated answer on the slide, and I actually would agree in many ways that this is actually really good advice. However, the key on this part is that why is this a flaw? So reading this again, what is wrong with submitting a summary for the cooperation?

Privilege is advice on how to run an internal network. It never touches the assumption underneath the overall plan. So it's a good one. It's one that you might go down this path, but at the end of this, it's the regulators are the ones that are going to say what they're going to do. So general counsel, outside counsel is important to bring this in, and I would highly recommend that they come in if you don't have internal counsel, uh, especially if the regulator is asking and knocking on your door. But that is not the correct answer because where it went wrong was the fact that the senior leader decided that they were going to give this information to the regulators.

And outside counsel does not do that. They will give you recommendations on what to potentially provide to the regulators, but the regulators are going to provide whatever they want, whatever they want. So again, those are important parts around that you just need to be aware of what's going to be potentially happening when you're dealing with these legal aspects. Question three: same company and now a hypothetical build on the facts. Suppose the terminated engineer retains counsel, who writes to the company disputing the termination and claiming that the property went missing from the bag security staff they that the security staff opened. No law lawsuit has been filed.

Your incident led proposes leaving everything exactly as it is and revisiting preservation. And if and when the company is actually served with the litigation or the lawsuit, then they'll provide it. So what is wrong with this situation? A, the duty preserve attaches once the litigation is reasonably anticipated, and the letter has already established that. B, nothing. Preservation obligations begin when the compliant complaint is filed and the company has not been served. C, the criminal case takes precedence, so the company should preserve only the material law enforcement has asked to hold. Or D, nothing. The company's standard retention schedule already keeps everything that would be relevant.

Okay, so again, they're just the same company, now a hypothetical build on what they have. They're supposing that they got counsel. There's nothing that happens that, but this they're expecting that this uh counsel writes to the company disputing the termination. Okay, again, they they have not had a letter, nothing has been filed, nothing is done, but they're supposing that this terminated engineer will retain counsel. So what would be the correct answer? A, the duty to preserve attaches once the litigation is reasonably anticipated and a letter has already established it. So in this case here, right, it's reasonably anticipated. They did not get a letter. They're supposing it's possibly coming.

So because they're thinking it's possibly going to come because they just fired this person, they now are going to uh start having maintaining evidence for this potential civil situation that's going to occur. So that this is one of those aspects where you're going, what do I do? Do I do it? Do I not do it? This is where if you don't have legal counsel, outside counsel will help you with this situation and what to do. But if you just fired a person, what is one of the first things that, and you think it's really squishy like this? This is one of my bosses' uh former CEOs told me he said, lawyer up.

And that's what ends up happening. They end up lawyering up because the guy that gets fired is gonna go get counsel from somebody. Just anticipate it. So it's important for you to reasonably anticipate what's going to occur. Now, spotting the trap is B, nothing is wrong. The duty starts when you are served. That's a very cut and dry answer, right? That's very conservative. Once I'm served, boom, then I'll begin it. But that's the part that gets really squishy, and you'll need to talk to the outside counsel. But when it's reasonably anticipated that it's highly likely I'm going to get something, you may want to start that whole process.

Again, not a lawyer, not telling you what to do. It's just something that I've seen and it's something that you potentially could run into. Last question. A different company, same failure mode, a retail merchant. They is a suspected cardholder data compromise. The merchant's internal forensics team is strong. It has already imaging systems and it can start a full investigation today at no additional cost. Your acquirer has advised that the payment brands are likely to require a foresting a forensic investigation. What is the significant problem with letting the internal team run it? A, there is no significant problem. The team is capable, it can start today, and the greater risk is in delaying.

B, the internal team would be acceptable once its analysts hold the right forensic certifications. C, the required forensics investigation must be performed by a PCI forensics investigator independent of the entity's investigations, or D, evidence gathered by an internal team will not be admissible if the matter later reaches a courtroom. And the answer, what do you all think? The answer is we're dealing with a retail merchant and we're dealing with car suspected cardholder data compromises. The answer is C. A required forensics investigation must be performed by PCI forensics investigator, independent of the entities investigated. So again, this comes down to the contract aspects related to it.

You signed up for it, the PCI forensics investigator must take a look at this if there is a problem. Now, you I would highly recommend you be prepared for that. They does that mean they're gonna do it. I don't know, right? I'm I haven't been in that space, so I don't really know if that's a given. The moment that this happens, you're gonna get investigated by their forensics investigation teams. I don't know. But I would say if folks that are in here, if you want to send me a note, that I'd love the help on that. But I would say that you need to be prepared for it.

Based on the contractual aspects of this, you should be prepared that PCI forensics investigator might be knocking on your door. Okay, so it's just again something to think about. Now, spotting the trap, A, there is no significant problem because your team's got it. They're good, they've got everything they need to do, and it won't cost you a dime. So go for it, right? And this is where the contract aspects come to play. The forensics team is gonna, if they have it in your contract, and depending upon the situation and the relationship you have with them, it might be okay. I don't know. I I can't answer that.

But you need to be prepared because of your contract that they may want to send their own people in here for an investigation.

Closing And How To Study Next 40:24

Okay, so that's all I've got for you today. Again, there are three ways to study with me the accelerator, the pro, and the sprint cohort. Sprint cohort is again, it's available by November 17th. Might have my early bird pricing. If you are interested, two sessions, a 7 a. m. and a 7 p. m. session starting November 17th. And you know what? If you want to get your CISSP done in the next eight weeks, that is the way to do it. It's a structured plan for you. So go check it out. It's CISSP Cyber Training. Thank you guys so much and have a beautiful and blessed day.

We'll catch you on the flip side. See ya. Thanks so much for joining me today on my podcast. If you like what you heard, please leave a review on iTunes. I would greatly appreciate your feedback. Also, check out my videos that are on YouTube and just head to my channel at CISSP Cyber Training, and you will find a plethora or a conopopia of content to help you pass the CISSP exam the first time. Lastly, head to CISSP Cyber Training and sign up for 363 CISSP questions to help you in your CISSP journey. Thanks again for listening.