Chapter 4 Law, Regulations, and Compliance CISSP Study Guide BIS 4113/6113
Cybercrime goes unreported FBI estimates that electronic crimes have occurred for virtually all Fortune 500 corporations, run about $10B a year, and are only reported about 17 percent of the time 44 percent of computer crime committed by members of organization (Stambaugh)
What is “cybersecurity law?” 1) Victim response to intrusions 2) Liability for intrusions 3) Computer and network regulations 4) Special issues for government and defense
Intellectual Property (p.132) Intangible assets Trademarks Patents Trade secrets Coca-Cola, KFC Original works of authorship
Workplace searches (Dhillon) Exceptions for warrantless searches of computer equipment Prior consent Implied consent (IT usage policy) Exigent circumstances Evidence is in danger from destruction Plain view Relevant to a lawful arrest occurring *Mobile devices yet to be determined Inventory searches Purpose other than accumulating evidence Border searches
Computer Fraud and Abuse Act (1984) Covers computer crimes crossing state boundaries See page 128 for scope and damages Government, financial, medical fields Information assets Recently proposed changes Hacking defined as “organized crime” “Fix the CFAA” advocacy group
Major Legislation (IP) Copyrights protected 70 years after author(s) death Examples: Blurred Lines Stairway to Heaven Digital Millennium Copyright Act (1998) Restricts transmission of copyrighted material, incl. webcasts and P2P Economic Espionage Act (1996) Penalties for stealing trade secrets
Major Legislation (Privacy) Fourth Amendment (US Con) Privacy Act (1974) Gov’t agencies may not disclose info about individuals Electronic Communications Privacy Act (1986) Extends wiretap laws to CMC and mobile
Major Legislation (Internet Privacy) Health Insurance Portability and Accountability Act (1996) Children’s Online Privacy Protection Act (1998) Gramm-Leach-Bliley (1999) Limits exchange of cust info between banks Patriot Act (2001) June 2015 USA Freedom Act NSA must use warrant to receive mobile metadata Federal Educational Rights and Privacy Act (aka Buckley Amendment – 1974) SB1386 (California) Other States
Compliance with Regulations Example: Payment Card Industry – Data Security Standard (PCI DSS) (p.146) Standards required to stay within trusted network 12 main requirements Verified by independent auditors
Sarbanes-Oxley (2002) Public corporations and financial disclosures Misleading info = up to $5M in fines and 20 yrs in prison 2017 Protiviti survey
Sarbanes-Oxley (2002) Section 404 “Issuers are required to publish information in their annual reports concerning the scope and adequacy of the internal control structure and procedures for financial reporting. This statement shall also assess the effectiveness of such internal controls and procedures.” Authentication standards User account management (incl. segregation of duties) Logs and monitoring Network security Physical security Risk assessment