User Logged into In-Scope System They Should Not Have

Problem:

Under the GDPR, organizations are required to maintain a complete audit trail about the authorized access of employees/vendors/suppliers to systems and applications that process personal data.

Impact:

Per GDPR Article 15, individuals have the right to ask an organization where their data is stored. In order to fulfill such a request, an organization will need to identify which vendors and processors have accessed the personal data in question, and also identify and report on which other services the personal data in question is processed regularly. When processing personal data on behalf of a controller - there will also be a requirement to prove that only authorized individuals have accessed the data in question (Article 28). If there is an audit trail that shows unauthorized access, then this will need to be documented and reported to the data privacy authorities.

First, use the results of the data mapping exercise from your data privacy officer to build a lookup that associates systems to the GDPR category. Then do the same for users. Use your data mapping results to build a lookup that associates systems to their GDPR category, and the same for users. At that point, as long as you have the data onboarded with common information model compliance, everything should go smoothly!

This will fire when someone is not in the documented list, so the most common scenario is that the documented list is just old. You can think about automating the update of the authorized user list and pull it from the source where you DPO holds the definitive record of authorized users. Another option is to generalize and enrich the information to departments who are allowed access by enriching the username with the department names.

The most likely scenario when this alert fires is that the documentation is simply out of date. Look for indications that someone should be added to the documentation or removed, but validate with your data protection officer or their team before doing so.

User Logged into In-Scope System They Should Not Have Help

This example leverages the Simple Search assistant. Our example dataset is a collection of anonymized Windows Authentication logs, during which someone logs into a new system. Our live search looks for Windows Authentication activity across any index in the standard sourcetype.