Lesson 4 of 6
Lesson 4 — Security Controls and the 72-Hour Breach Clock
Encryption, access control, logging — and exactly what to do in the first three days of a breach.
Learn it
The 'integrity and confidentiality' principle means you must protect data with appropriate technical and organisational measures.
Core controls: encryption in transit and at rest, least-privilege access, MFA, audit logging, backups and staff training.
If a personal data breach is likely to risk people's rights, the regulator must be told within 72 hours — and affected people 'without undue delay' if the risk is high.
Key terms
- Personal data breach
- Accidental or unlawful destruction, loss, alteration or disclosure of personal data.
- Least privilege
- Giving each account only the access it needs, for as long as it needs it.
- Encryption at rest
- Data stored on disk in encrypted form.
- Breach register
- Internal log of all breaches, reportable or not.
- DPA
- Data Processing Agreement — the contract that binds a processor.
The first 72 hours
A misconfigured bucket exposed 40,000 student records.
- 1Hour 0-1: Contain: make the bucket private, rotate keys, preserve logs as evidence.
- 2Hour 1-8: Assess: what data, how many people, what harm is likely?
- 3Hour 8-72: Notify the regulator with what you know; log everything in the breach register.
- 4After: Notify affected people if risk is high, fix the root cause, run a post-incident review.
Least privilege in a database policy
sql-- Support staff may read tickets, never payment data
GRANT SELECT ON support_tickets TO support_role;
REVOKE ALL ON payments FROM support_role;
-- Analysts only see a pseudonymised view
CREATE VIEW analytics_users AS
SELECT user_hash, country, plan, created_at
FROM users;
GRANT SELECT ON analytics_users TO analyst_role;Access control is a compliance control, not just a security one: it limits how bad a breach can get.
Try it
Reportable breach or not? Decide for each incident.
A teacher emails a spreadsheet of grades and medical notes to the wrong parent.
A laptop with an encrypted disk is stolen, keys not compromised.
A public S3 bucket exposed 40,000 student records for a week.
A staff member views a record they are allowed to view.
Challenge
You are the on-call engineer. At 23:10 you discover an API endpoint has been returning other users' order histories for six days. Write your incident plan for the first 72 hours, including who you tell and what you record.
Pick whichever way suits you — every mode earns the same bonus XP.
Write at least 40 more characters to submit.
Mark your own work
Guided walkthrough — 0/3 clues revealed
- Clue 1 locked — reveal it only if you get stuck.
- Clue 2 locked — reveal it only if you get stuck.
- Clue 3 locked — reveal it only if you get stuck.
Each clue costs 5 XP (never below 23 XP). You'd earn 45 XP right now.