1. Chapter 4 Law, Regulations, and Compliance
CISSP Study Guide
BIS 4113/6113

2. Cybercrime goes unreported
FBI estimates that electronic crimes have occurred for virtually all Fortune 500 corporations, run about $10B a year, and are only reported about 17 percent of the time
44 percent of computer crime committed by members of organization
(Stambaugh)

3. What is “cybersecurity law?”
1) Victim response to intrusions
2) Liability for intrusions
3) Computer and network regulations
4) Special issues for government and defense

4. Intellectual Property (p.132)
Intangible assets
Trademarks
Patents
Trade secrets
Coca-Cola, KFC
Original works of authorship

5. Workplace searches (Dhillon)
Exceptions for warrantless searches of computer equipment
Prior consent
Implied consent (IT usage policy)
Exigent circumstances
Evidence is in danger from destruction
Plain view
Relevant to a lawful arrest occurring
*Mobile devices yet to be determined
Inventory searches
Purpose other than accumulating evidence
Border searches

6. Computer Fraud and Abuse Act (1984)
Covers computer crimes crossing state boundaries
See page 128 for scope and damages
Government, financial, medical fields
Information assets
Recently proposed changes
Hacking defined as “organized crime”
“Fix the CFAA” advocacy group

7. Major Legislation (IP)
Copyrights protected 70 years after author(s) death
Examples: Blurred Lines Stairway to Heaven
Digital Millennium Copyright Act (1998)
Restricts transmission of copyrighted material, incl. webcasts and P2P
Economic Espionage Act (1996)
Penalties for stealing trade secrets

8. Major Legislation (Privacy)
Fourth Amendment (US Con)
Privacy Act (1974)
Gov’t agencies may not disclose info about individuals
Electronic Communications Privacy Act (1986)
Extends wiretap laws to CMC and mobile

9. Major Legislation (Internet Privacy)
Health Insurance Portability and Accountability Act (1996)
Children’s Online Privacy Protection Act (1998)
Gramm-Leach-Bliley (1999)
Limits exchange of cust info between banks
Patriot Act (2001)
June 2015 USA Freedom Act
NSA must use warrant to receive mobile metadata
Federal Educational Rights and Privacy Act (aka Buckley Amendment – 1974)
SB1386 (California) Other States

10. Compliance with Regulations
Example: Payment Card Industry – Data Security Standard (PCI DSS)
(p.146)
Standards required to stay within trusted network
12 main requirements
Verified by independent auditors

11. Sarbanes-Oxley (2002) Public corporations and financial disclosures
Misleading info = up to $5M in fines and 20 yrs in prison
2017 Protiviti survey

12. Sarbanes-Oxley (2002) Section 404
“Issuers are required to publish information in their annual reports concerning the scope and adequacy of the internal control structure and procedures for financial reporting. This statement shall also assess the effectiveness of such internal controls and procedures.”
Authentication standards
User account management (incl. segregation of duties)
Logs and monitoring
Network security
Physical security
Risk assessment