5.5Protected data, intrusion models, and SOC metrics

Even in the same breach, whether what was stolen is a published catalog or a patient's medical record changes both the severity and the legal obligation entirely. That is why a SOC must be able to identify what is protected data. Furthermore, fitting fragmentary alerts into an intrusion model (Cyber Kill Chain, Diamond Model) reveals the whole picture of the attack and "what comes next." And a team's strength is measured and improved with SOC metrics (time to detect, contain, respond, control). This section ties these together as "the judgment of classifying events and improving."

5.5.1Protected data in a network

• PII (personally identifiable information)—information that can identify an individual, such as name, address, date of birth, and national ID. PHI (protected health information)—healthcare-related personal information such as medical records, history, and insurance, subject to especially strict regulation (e.g., U.S. HIPAA). Given the impact and legal weight of a leak, both are top-priority protection targets.
• PSI (sensitive personal information / payment-related information)—payment card numbers and especially sensitive personal data whose leak is highly damaging (including regulated data such as PCI DSS). Intellectual property (IP)—designs, source code, trade secrets, the source of an organization's competitiveness; even with lighter regulatory duties, leakage directly damages the business. Which data type it is changes how to protect it, notification duties, and priority.