Legal and Privacy Implications of Sharing Threat Intelligence TIE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company in the healthcare sector wants to share threat intelligence with a research institution in another country. The data includes IP addresses of systems that store patient records. The company is subject to HIPAA and the other country's data protection law. What is the most important consideration before sharing?

   • ADetermine whether the data constitutes protected health information (PHI) and whether a HIPAA-compliant data use agreement is required.
   • BShare the data without any agreement because it is for research purposes.
   • CObtain a business associate agreement with the research institution.
   • DShare only the IP addresses because they are not PHI.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is preparing a threat intelligence report for a public conference. The report includes a case study of a phishing attack that targeted a specific company. The analyst wants to share the technical details without revealing the company's identity. What is the best approach?

   • ARemove all technical details and share only the high-level summary.
   • BShare the report only with conference attendees under a non-disclosure agreement.
   • CShare the report as-is because the attack is a matter of public record.
   • DAnonymize the company name and any identifying details in the report.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A financial institution is sharing a set of malicious IP addresses with a sector-specific information sharing and analysis center (ISAC). The IPs are associated with a botnet that also infected a few customer-facing kiosks. The institution wants to protect customer privacy while still allowing the ISAC to correlate the IPs with other attacks. Which technique best meets this requirement?

   • AShare the IPs with a data-sharing agreement that prohibits re-identification.
   • BReplace the IP addresses with a one-way hash before sharing.
   • CAggregate the IPs into a single range and share only the range.
   • DShare the IP addresses in plaintext but remove any reference to the kiosks.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A global bank is negotiating a threat intelligence sharing agreement with a fintech partner. The bank requires that the partner not use the shared indicators for any purpose other than defending its own network. The partner wants to use the indicators to improve its commercial threat detection product. The bank also wants to ensure that if the partner suffers a breach, the bank is not liable. Which agreement structure best meets the bank's requirements?

   • AInclude a clause that the partner must delete the data after 90 days, but allow any use during that period.
   • BInclude a confidentiality clause but allow the partner to use the data for product development.
   • CInclude a strict purpose limitation clause and a limitation of liability clause, and define the permitted uses explicitly.
   • DInclude a broad license that allows any use, but require the partner to indemnify the bank.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   An organization is about to share threat intelligence that could potentially be used by the recipient to identify and take action against a suspected attacker who may be an innocent victim of a compromised system. What ethical consideration should guide the sharing decision?

   • AWeigh the potential harm to individuals against the benefit of the intelligence to the community
   • BShare only if the recipient promises not to act on the information
   • CShare the intelligence without consideration because it is for the greater good
   • DShare the intelligence only if it is legally required
   Reveal Solution Discussion Select an answer first