How would you address suspicions of unauthorized access to sensitive GIS databases within your organization?

This requires immediate, follow up and long term actions including immediate reporting and following IT SOPs e.g. takeing the db off net, checking log files, login history, and data transfer for suspicious activities. Then, notify all stakeholders, and recruit security experts to put together a preventive plan for future attacks. Review SOPs, train different users on best practices in security, and perform Audits. Stop collecting unnecessary GIS data, always mask it, and properly manage info production and sharing since I noticed that legitimate users are usually the ones who unintentionally disclose GIS data in their maps / dashboard, and sometimes allow downloading data that is in the backend via these products.

It is also critical to keep your devices especially laptop on proper shut down mode to reduce risk of random access . Minimise use of unrestricted public WIFI.

Según mi experiencia, es muy importante en primer lugar revisar los sistemas de seguridad y cambiar las claves. Por otro lado, que las conexiones a WIFI estén autorizadas y no sean de uso público o de uso general.

Lorsque vous constatez un accès non autorisé une des accès immédiate après la vérification de la légitimité et la désactivation temporaire est de revoir les accès et leurs niveaux d'attributions. après il faut planifier une nouvelle attribution des accès avec une modification des mots de passe.

IT urgent help desk request if any breach is suspected. Trust only cos emails, Authenticator communication. Review access. Direct trusted links only.

Investigate: Review access logs and identify anomalies. Enhance Security: Update passwords, implement multi-factor authentication, and review access controls. Monitor: Set up continuous monitoring and conduct regular audits. Train: Educate employees on data security practices. Document and Report: Record the incident and report if necessary. Review Policies: Update security policies and ensure they’re communicated. Ensure Compliance: Follow legal and regulatory requirements. Prepare: Develop or update an incident response plan.

My priority would be to assess the scope of the unauthorized access. Understanding what data and systems were compromised will help us prioritize our response and mitigation efforts effectively.

Must also assess the validity and integrity of the data after an intrusion. The originality of the data could have been altered by intrusion

Une fois avoir constaté et vérifié qu'il y avait bel et bien intrusion, on peut voir quelles sont les données récemments modifiées ou vues. Pour limiter les risques d'intrusion, il s'agirait de limiter les accès, de changer les mots de passe régulièrement et d'instaurer le système de connection à deux palliers.

Collaborate with the team to analyse the data and look at the leaks and data loss and port used to get access. Try also to have a general view on the data that was downloaded or stolen.

For example, if the breach was due to a vulnerability in your GIS software, immediately apply the latest security patches provided by the software vendor. Additionally, strengthen your firewall settings to block any suspicious IP addresses that might have been involved in the breach. Implementing MFA can be particularly effective, as it requires users to provide two or more verification factors to gain access, significantly reducing the likelihood of unauthorized access. Educating staff on the importance of cybersecurity best practices, like creating complex passwords and recognizing phishing attempts, further fortifies your defenses against future breaches.

We would promptly implement necessary security updates and patches to address any vulnerabilities that may have been exploited. Enhancing access controls and reviewing user permissions will be key to preventing similar incidents in the future.

It may also be very important to change of passwords and other security features. This may be of strong essence If it were possible, changing IP address and may be even the source of Internet may be essential

- Limiter les accès des utilisateurs - Effacer l'accès des utilisateurs obsolètes régulièrement. - Changer les mots de passe sur une base régulière - Authentification multifactorielle

Es simple, pensar como puede actuar y razonar el intruso, estar miles de pasos más a lo que quiere ir, que se lleve la sorpresa y quede helado

The first and foremost thought for monitoring systems should be the inclusion of a version control system with GIS databases such as Git and QGIS. The organization should have a clear visibility on access rights for the DBs in consideration with a clear auditory system in place. The audits can be automated so that the frequency of checks can be increased.

Para lidar com suspeitas de acesso não autorizado a bancos de dados GIS confidenciais, é necessário implementar um sistema de monitoramento robusto, com alertas para atividades incomuns e auditorias regulares. A realização de testes e simulações periódicas é excelente para preparar não só o sistema, mas também a equipe envolvida com os BD(s). Idealmente, a equipe precisa ser unida e estar ciente de que incidentes e simulados podem e vão acontecer. Isso é complementado pelo oferecimento de treinamento contínuo. Que além de garantir a proteção dos dados GIS, essas ações criam um time culturalmente ativo, demonstram a preocupação com o bem-estar dos envolvidos e os preparam para situações reais.

Increasing monitoring of our GIS databases and related systems for any unusual activities will be essential. Setting up alerts for suspicious access patterns and conducting regular security audits will help us stay proactive.

Após uma situação dessas ocorrer, é necessário analisar o sistema de proteção atual, e verificar se o mesmo precisa passar por atualizações. Uma alternativa seria realizar um monitoramento das atividades dos usuários cadastrados, e estabelecer padrões de uso de dados, como ferramenta de análise. Caso o uso dos dados apresente um padrão fora da curva, alertas de anomalias irão ser emitidas, e o usuário detectado a prestar informações e esclarecimentos sobre o uso dos dados.

- Instaurer un système de surveillance en temps réels pour détecter les accès suspect - Demander aux utilisateurs de signaler toutes modifications ou actions qu'ils ont pu faire au fur et à mesure - Faire des audits de façon régulière

It’s important to carefully evaluate our legal obligations concerning data breaches and unauthorized access. Depending our jurisdiction and industry regulations, we may need to notify affected parties and regulatory bodies accordingly.

For example, if your GIS database contained personal information protected under regulations like GDPR or CCPA, you might be required to notify affected individuals within a specific timeframe. Legal counsel can guide you on drafting notification letters and managing potential penalties. Additionally, maintaining detailed records of the breach investigation and remediation efforts will be crucial if you need to demonstrate compliance or defend against legal claims.

- Consulter un conseiller juridique - Revoir les licences et conditions de partage des données et voir comment ils ont été violés - Contacter les différentes parties prenantes

Se debe tener una normativa del manejo de datos, todos los presentes y actuantes del manejo del mismo, llegar a un común acuerdo y pacto de protección de dato con constante y fluida comunicación interna del monitoreo del dato y vulnerabilidad que puede presentar , el intruso siempre estará estudiando la situación y el momento

For instance, your recovery plan might include restoring data from backups, verifying the integrity of recovered data, and updating security policies based on lessons learned from the incident. Regular drills, such as simulated attacks or tabletop exercises, can help your team practice their responses and identify areas for improvement. Having a well-documented and tested recovery plan ensures that your organization can quickly rebound from security incidents while minimizing impact on operations and data integrity.

Another pre-event action might be defining proper access levels to user roles. The four possible levels of data access are read-only, write, full control, and none at all. The least privilege principle, which calls for allowing the least amount of access required for the performance of the task or responsibility, must be followed in order to strike a balance between the needs for data protection and access.

Regular Testing of all the potentially attacked systems is key. Doing exercises with known vulnerabilities is important. Make sure your teams are up to speed on new software and keep up to date on new risks and information. Be knowledgeable of the skills within your teams and have them review what new threats they need to learn about. Treat your teams well. Make sure they are not overworked or underpaid. You fo not want their knowledge of the systems to leave the company.