CISSP - Legal, Regulations, Investigations, Compliance. Exam Questions and answers, 100% Accurate, graded A+

CISSP - Legal, Regulations, Investigations, Compliance. Exam Questions and answers, 100% Accurate, graded A+ HIPAA - -The law provides national standards and procedures for the storage, use, and transmission of personal medical information and health care data.The privacy and security portion of this law seeks to guard Protected Health Information (PHI) from unauthorized use or disclosure. GLBA - -1999, this law requires financial institutions to: develop privacy notices to give to customers regarding the collection, use, and sharing of PII. Furthermore, it requires a written security policy to be in place and tested and employees are fully trained on information security issues. Computer Fraud and Abuse Act - -1986 amended in 1996, Title 18 section 1030. The primary federal anti-hacking statute. Criminalized attacks on protected computers, which include government and financial computers as well as those engaged in foreign or interstate commerce. This act is amended by the Patriot Act Electronic Communications Privacy Act - -created a similar level of search and seizure protection to non-telephony electronic communication equipment. An example is protection from unwarranted wiretapping Patriot Act - -2001, expanded law enforcement's electronic monitoring capabilities, allowed for search and seizure without requiring immediate disclosure, lessened the judicial oversight required of law enforcement as related to electronic monitoring Federal Privacy Act - -applies to records and documents developed and maintained by specific branches of the federal government that relate to individual's education, medical history, financial history, criminal history, employment, etc. Government agencies can maintain this type of information only if it is necessary and relevant to accomplishing the agency's purpose Freedom of Information Act - -government files are open to the public unless specific legislation deems otherwise Basel II - -prevents banks from overextending themselves, sets minimum capital requirements, addresses information security in that, member institutions must continually address their exposure to risk and implement security controls to protect their data PCI DSS - -applies to any entity that processes, transmits, stores, or accepts credit card data. it is not law but a private sector initiative (self regulation). Major credit card companies should seek to ensure better protection of cardholder data through mandating a security policy, security devices, control techniques, and monitoring of systems and networks comprising cardholder data environments California Senate Bill 1386 - -one of the first state level breach notification laws. Requires organizations experiencing a personal data breach involving California residents to notify them of the potential disclosure. Served as impetus in the US for other breach notification laws Computer Security Act of 1987 - -requires US federal agencies to identify computer systems that contain sensitive information. The agency must develop a security policy and plan for each of these systems and conduct periodic training Economic Espionage Act of 1996 - -also called US Economic and Protection of Proprietary Information Act. Provides the necessary structure when dealing with cares regarding trade secrets and defined trade secrets to be technical, business, engineering, scientific, or financial. Due care - -defines a minimum standard of protection that business stakeholders must attempt to achieve. company practices common sense and acts prudently and responsibly Due diligence - -management of due care; follows a formal process. the process of systematically evaluating information to identify vulnerabilities, threats, and issues relating to an organization's overall risk downstream liability - -the actions of one company negatively affect another company requirements for negligence - -the defendant had an obligation to protect the plaintiff, the defendant failed to fulfill this obligation, the breach of this duty was the proximate cause of the plaintiff's damages event - -a negative occurrence that can be observed, verified, and documented incident - -a series of events that negatively affect a company Incident response team - -a group of people who are properly skilled, follow a standard set of procedures, and response to security incidents. Their primary goal should be to mitigate damage caused by an incident and prevent further damage CERT - -Computer Emergency Response Team, an organization that is responsible for monitoring and advising users and companies about security preparation and security breaches order of procedures in Incident Response - -TICATR: Triage, Investigation, Containment, Analysis,Tracking, Recovery computer forensics - -a set of specific processes relating to reconstruction of computer usage, examination of residual data, authentication of data by technical analysis or explanation of technical features of data, and computer usage that data must be followed in order for evidence to be admissible in court IOCE - -international organization on computer evidence - created to develop international principles dealing with how digital evidence is to be collected and handled so various courts will recognize and use the evidence in the same manner. in the United States we have SWDGE and DFSRW that also address and standardize the collection of electronic/digital data/evidence How do you understand the whys of a crime - -Look at the MOM - motive, opportunity, and means Chain of custody - -history that shows how evidence was collected, analyzed, transported, and preserved in order to be presented in court. A clearly defined chain of custody is necessary and demonstrates the integrity/trustworthiness of evidence Characteristics of proper evidence - -admissible, authentic, complete, accurate, convincing, relevant best evidence rule - -evidence should be relevant, authentic, accurate, complete, and convincing secondary evidence - -Not viewed as reliable and strong in proving innocence or guilt (or liability in civil cases) when compared to best evidence. Oral evidence, such as a witness's testimony, and copies of original documents direct evidence - -Can prove a fact all by itself and does not need backup information to refer to. When direct evidence is used, presumptions are not required. testimony provided by a witness regarding what the witness actually experienced with their 5 senses conclusive evidence - -irrefutable and cannot be contradicted. circumstantial evidence - -Evidence which serves to establish the circumstances related to particular points or even other evidence. It provides details regarding circumstances that allow for assumptions to be made regarding other types of evidence. This type of evidence offers indirect proof, and typically cannot be used as the sole evidence in a case corroborative evidence - -used to strengthen a particular fact or element. provides additional support for a fact that might have been called into question hearsay evidence - -second hand evidence, indirect witnessed, normally considered inadmissible. Computer evidence, generally considered as hearsay, is admissible if it meets the Business Exemption Rule to Hearsay Evidence enticement - -legal and ethical, conditions are made favorable for someone who is already planning to commit a crime entrapment - -illegal and unethical, when someone is persuaded to commit a crime 4th amendment - -protects citizens from unreasonable search and seizure. search warrants are not required if: property is in plain sight or at a checkpoint or exigent circumstances exist exigent circumstance doctrine - -situations where there is an immediate threat to human life or of evidence being destroyed - doesn't require a search warrant salami attack - -attacker commits several crimes in hope that the overall larger crime will go unnoticed data diddling - -the alteration of existing data, modification happens before the data is entered into an application or as soon as it completes processing and is outputted from an application ISC2 Code of Ethics - -Code of Ethics Preamble: - Safety of the commonwealth, duty to our principals, and to each other requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior. - Therefore, strict adherence to this Code is a condition of certification. Code of Ethics Canons: - Protect society, the commonwealth, and the infrastructure. - Act honorably, honestly, justly, responsibly, and legally. - Provide diligent and competent service to principals. - Advance and protect the profession. Other areas of importance of ISC2 Code of Ethics - -o Act honorably, honestly, justly, responsibly, and legally, and protect society. o Work diligently, provide competent services, and advance the security profession. o Encourage the growth of research—teach, mentor, and value the certification. o Discourage unnecessary fear or doubt, and do not consent to bad practices. o Discourage unsafe practices, and preserve and strengthen the integrity of public infrastructures o Observe and abide by all contracts, expressed or implied, and give prudent advice. o Avoid any conflict of interest, respect the trust that others put in you, and take on only those jobs you are fully qualified to perform. o Stay current on skills, and do not become involved with activities that could injure the reputation of other security professionals Computer Ethics Institute's 10 Commandments - -Ten Commandments of Computer Ethics: o Not use a computer to harm other people. o Not interfere with other people's computer work. o Not snoop around in other people's computer files. o Not use a computer to steal. o Not use a computer to bear false witness. o Not copy or use proprietary software for which you have not paid. o Not use other people's computer resources without authorization or proper compensation. o Not appropriate other people's intellectual output o Think about the social consequences of the program you are writing or the system you are designing. o Shall use a computer in ways that ensure consideration and respect for your fellow humans IAB - -Internet Architecture Board, coordinating committee for internet design, engineering, and management. responsible for IETF (internet engineering task force) activities, Internet Standards Process oversight and appeal, and editor of Request for Comments (RFCs) RFC 1087 - -IAB's Ethics and the Internet guide to unacceptable and unethical behavior: o Purposely seeking to gain unauthorized access to Internet resources o Disrupting the intended use of the Internet o Wasting resources (people, capacity, and computers) through purposeful actions o Destroying the integrity of computer-based information o Compromising the privacy of others o Conducting Internet-wide experiments in a negligent