NIST SPECIAL PUBLICATION 1800-29

---

Data Confidentiality: Detect, Respond to, and Recover from Data Breaches

Data Confidentiality:

Detect, Respond to, and Recover from Data Breaches

---

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

William Fisher

R. Eugene Craft

Michael Ekstrom

Julian Sexton

John Sweetnam

February 2024

FINAL

This publication is available free of charge from https://doi.org/10.6028/NIST.SP.1800-29

The first draft of this publication is available free of charge from: https://www.nccoe.nist.gov/publications/practice-guide/data-confidentiality-detect-respond-and-recover-data-breaches-nist-sp-0

NIST SPECIAL PUBLICATION 1800-29

Data Confidentiality: Detect, Respond to, and Recover from Data Breaches

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

William Fisher

National Cybersecurity Center of Excellence

NIST

R. Eugene Craft

Michael Ekstrom

Julian Sexton

John Sweetnam

The MITRE Corporation

McLean, Virginia

FINAL

February 2024

U.S. Department of Commerce

Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Volume A

• Executive Summary
  • Challenge
  • Benefits
  • Approach
  • How to Use This Guide
  • Share Your Feedback
  • Collaborators

Volume B

• 1 Summary
  • 1.1 Challenge
  • 1.2 Solution
  • 1.3 Benefits
• 2 How to Use This Guide
  • 2.1 Typographic Conventions
• 3 Approach
  • 3.1 Audience
  • 3.2 Scope
  • 3.3 Assumptions
  • 3.4 Privacy Considerations
  • 3.5 Risk Assessment
    • 3.5.1 Security Risk Assessment
    • 3.5.2 Privacy Risk Assessment
  • 3.6 Technologies
• 4 Architecture
  • 4.1 Architecture Description
• 5 Security & Privacy Characteristic Analysis
  • 5.1 Assumptions and Limitations
  • 5.2 Security Scenarios
    • 5.2.1 Exfiltration of Encrypted Data
    • 5.2.2 Spear Phishing Campaign
    • 5.2.3 Ransomware
    • 5.2.4 Accidental Email
    • 5.2.5 Lost Laptop
    • 5.2.6 Privilege Misuse
    • 5.2.7 Eavesdropping
  • 5.3 Privacy Scenarios
    • 5.3.1 User Login with Multifactor Authentication
    • 5.3.2 Authentication to Virtual Desktop Interface Solution
    • 5.3.3 Monitoring by Network Detection Solution
    • 5.3.4 Monitoring by Logging Solution
• 6 Future Build Considerations
• Appendix A List of Acronyms
• Appendix B Glossary
• Appendix C References
• Appendix D Security Control Map
• Appendix E Privacy Control Map

Volume C

• 1 Introduction
  • 1.1 How to Use this Guide
  • 1.2 Build Overview
  • 1.3 Typographic Conventions
  • 1.4 Logical Architecture Summary
• 2 Product Installation Guides
  • 2.1 FireEye Helix
    • 2.1.1 Installing the Communications Broker
    • 2.1.2 Forwarding Event Logs from Windows 2012 R2
  • 2.2 PKWARE PKProtect
    • 2.2.1 Configure PKWARE with Active Directory
    • 2.2.2 Create a New Administrative User
    • 2.2.3 Install Prerequisites
    • 2.2.4 Install the PKProtect Agent
    • 2.2.5 Configure Discovery and Reporting
  • 2.3 Cisco Duo
    • 2.3.1 Installing Cisco Duo
    • 2.3.2 Registering a Duo User
  • 2.4 Cisco Stealthwatch
    • 2.4.1 Configure Stealthwatch Flow Collector
    • 2.4.2 Configure Stealthwatch Management Console
    • 2.4.3 Add Stealthwatch Flow Collector to the Management Console
  • 2.5 Dispel
    • 2.5.1 Installation
    • 2.5.2 Configuring IP Addresses
    • 2.5.3 Configuring Network
    • 2.5.4 Adding a Device
  • 2.6 Integration: FireEye Helix and Cisco Stealthwatch
    • 2.6.1 Configure the Helix Communications Broker
    • 2.6.2 Configure Stealthwatch to Forward Events
  • 2.7 Integration: FireEye Helix and PKWARE PKProtect
    • 2.7.1 Configure the Helix Communications Broker
    • 2.7.2 Configure PKWARE PKProtect to Forward Events
  • 2.8 Integration: FireEye Helix and Dispel
  • 2.9 Integration: Dispel and Cisco DUO
• Appendix A List of Acronyms