SOC 2: Security, Privacy, and Compliance for the ISC Exam

Worked Example: Analyzing the Omni Health Breach

Scenario: Recall the Omni Health ransomware attack. A ransomware variant was deployed after an employee in the billing department clicked on a malicious link in a phishing email. The attack encrypted all patient databases and the appointment scheduling system. The attackers exfiltrated 50,000 patient records containing names, social security numbers, and medical diagnoses before encrypting the systems. The IT department's most recent backup was three weeks old and was also found to be encrypted.

1. Step 1: Identify CIA Triad Failures Confidentiality: Failed. The attackers accessed and exfiltrated sensitive patient data, which is a massive unauthorized disclosure. Integrity: Failed. The data was encrypted, meaning it was altered without authorization and is no longer in its original, usable state. Availability: Failed. The ransomware attack made patient records and the scheduling system inaccessible to doctors and staff.
2. Step 2: Pinpoint Control Weaknesses Preventive Controls: Failed. Security awareness training was ineffective (employee clicked the link). Email filtering may have failed to block the phishing attempt. Detective Controls: Failed. Log monitoring or an Intrusion Detection System (IDS) should have flagged the unusual data exfiltration and encryption activity much sooner. Corrective Controls: Failed catastrophically. The backup and recovery plan was inadequate, as backups were not properly isolated and tested, rendering them useless.
3. Step 3: Assess Privacy and Compliance Violations The breached data includes both Personally Identifiable Information (PII) and Protected Health Information (PHI). This triggers major compliance issues. HIPAA: Omni Health violated the HIPAA Security Rule by failing to implement adequate administrative, physical, and technical safeguards. They now face mandatory breach notifications under the Breach Notification Rule and severe fines from the Department of Health and Human Services. GDPR: If any of the 50,000 records belong to EU citizens, Omni Health has 72 hours to report the breach to regulators and could face fines up to 4% of global annual revenue.
4. If you picked just one area, like a failed preventive control, you would be missing the bigger picture. The ISC exam tests your ability to see the cascading effect of failures. The weak preventive control allowed the entry, the weak detective control allowed it to spread unnoticed, and the weak corrective control made the damage permanent.