Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Legal Issues and Ethics Chapter 24

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionObjectives Explain the laws and rules concerning importing and exporting encryption software. Identify the laws that govern computer access and trespass. Identify the laws that govern encryption and digital rights management. Describe the laws that govern digital signatures Explore ethical issues associated with information security.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Key Terms Administrative law Click fraud Common law Computer Fraud and Abuse Act (CFAA) Computer trespass Digital Millennium Copyright Act (DMCA) Electronic Communications Privacy Act (ECPA) Gramm-Leach-Bliley Act (GLBA)

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Key Terms (continued) Payment Card Industry Data Security Standard (PCI DSS) Sarbanes-Oxley Act (SOX) Section 404 Statutory law Stored Communications Act (SCA) Wassenaar Arrangement

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionCybercrime Characteristics –Technology is constantly changing –Sophistication of computer crimes has increased –Generally focused on financial gain –Often run by organized crime –Low risk of being caught –Difficult to prosecute

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Types of Cybercrime Computer-involved crimes can be classified as –Computer-assisted –Computer-targeted –Computer-incidental

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Internet Crime Most computer crime revolves around money. Internet Crime Complaint Center (IC3): –FBI, NW3C, and BJA partnership –Produces common Internet crimes list and descriptions –Provides advice on how to prevent becoming a victim of Internet crime

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Common Internet Crime Schemes Auction fraud Counterfeit cashier’s check Credit card fraud Debt elimination Parcel courier scheme Lotteries Escrow services fraud Identity theft Business opportunities Internet extortion Investment fraud Employment opportunities Nigerian Letter or “419” Phishing/spoofing Ponzi/pyramid Reshipping Spam Third-party receiver of funds

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Sources of Laws Statutory law –Laws set by legislative bodies like Congress Administrative law –Power granted to government agencies through legislation Common law –Laws derived from previous events or precedence

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Computer Trespass Unauthorized access of a computer system –Independent of access method Considered a crime in many countries –May warrant significant punishment –Treaties between countries regulate ways to deal with the cyber offenders

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Convention on Cybercrime First international treaty on Internet crimes –EU, U.S., Canada, Japan, and others Created common policies to handle cybercrime Focused on: –Copyright infringement –Computer-related fraud –Child pornography –Violations of network security

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Significant U.S. Laws Electronic Communications Privacy Act Stored Communications Act Computer Fraud and Abuse Act Controlling the Assault of Non-Solicited Pornography and Marketing Act USA Patriot Act Gramm-Leach-Bliley Act Sarbanes-Oxley Act

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Electronics Communications Privacy Act (ECPA) Addresses legal privacy issues related to computer use and telecommunications Warning Banners are common practice in: –Establishing the level of expected privacy –Serving notice of intent to monitor –Obtaining user’s consent to monitoring –Providing consent to law enforcement search

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Computer Fraud and Abuse Act (1986) Foundation of U.S. law on unauthorized access Criminalizes activities such as: –Accessing government or interstate commerce systems –Using a computer in interstate crime –Trafficking in passwords or access information –Transmitting code, commands, or programs that result in damage

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM) Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM) Established spam regulations Provided rules of compliance –Unsubscribe, content, and sending behavior Has had a poor track record of convictions

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition USA Patriot Act Response to the 9/11 terrorist attacks Altered U.S. laws on Internet wiretaps and tracing –Requires ISPs to facilitate Internet monitoring –Provides for federal law enforcement investigation and adjudication of computer intrusions Supported changes in other supporting computer misuse laws –ECPA and CFAA

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Gramm-Leach-Bliley Act (GLBA) Financial industry legislation to protect individual privacy. –Created an opt-out method providing individual control over the use of personal information –Enforced by state, federal and securities laws –Restricts information sharing with third-party firms

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Sarbanes-Oxley Act (SOX) Overhaul of financial accounting standards –Targeted standards of publicly traded firms Section 404 controls –Internal controls on financial reporting processes –Audits required on a regular basis

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Payment Card Industry Data Security Standard (PCI DSS) Contractual rules governing exchange of credit card data between banks and merchants –Voluntary standard Noncompliance may result in: –Higher transaction fees –Expensive fines –Inability to process credit cards

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Import/Export Encryption Restrictions Includes use to secure network communications U.S. export control laws –Administered by the Bureau of Industry and Security –Encryption rules found in Export Administration Regulations (EAR) –Controls include presale product reviews, post-export reporting, and export license reviews.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Non-U.S. Laws Wassenaar Arrangement –International agreement on export controls dealing with dual-use goods and technologies. –Removed key length restrictions on encryption products. Cryptographic use restrictions –Many countries tightly restrict the use and possession of cryptographic technology.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition U.S. Digital Signature Laws Means to show approval for electronic records –Cryptography provides integrity and non- repudiation. –Enables e-commerce transactions Examples: –Electronic Signatures in Global and National Commerce Act –Uniform Electronic Transactions Act

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Other Digital Signature Laws United Nations –UN Commission on International Trade Law Model Law on Electronic Commerce Canada –Uniform Electronic Commerce Act European Union –Electronic Commerce Directive

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Digital Millennium Copyright Act (DMCA) Protects rights of recording artists. Identifies how new computer technology relates to copyright laws. Also regulates software and hardware designed to circumvent copyright protection controls.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionEthics Globalization blurs ethical lines. –Social norms vary among diverse principalities. Challenge for today’s businesses: –Code of ethics must be established. –Employees need to understand what is expected. SANS published a set of IT ethical guidelines.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Chapter Summary Explain the laws and rules concerning importing and exporting encryption software. Identify the laws that govern computer access and trespass. Identify the laws that govern encryption and digital rights management. Describe the laws that govern digital signatures. Explore ethical issues associated with information security.