Cissp Chapter 4

Front 1

Understand the differences between criminal law, civil law, and administrative law.

Back 1

Criminal law- protects society against acts that violate the basic principles we believe in.Violations of criminal law are prosecuted by federal and state governments.

Example: Murder, assault, robbery, and arson.

Civil law- Provides the framework for the transaction of business between people and organizations. Violations of civil law are brought to the court and argued by the two affected parties.

Example: Contract dispute, real estate transactions, employment matters.

Administrative law-is used by government agencies to effectively carry out their day to day business.

Example: Immigration policy

Front 2

Explain the basics of the Computer Fraud and Abuse Acts (as amended)

Back 2

Originated in 1984 as the Comprhensive Crime Control Act(CCCA), Protects computers used by the government or in interstate commerce from a variety of abuse.

In 1994, the amendment outlawed the creation of any type of malicious code that might cause damage to a computer system.

1. Protected all interstate commerce and not just federal interests.

2.Allowed imprisonment of offenders, regardless of whether they actually intended to cause damage.

3.Provide legal authority for victims of computer crime to pursue civil action to gain injunction relief and compensation for damages.

Front 3

Explain the basics of the Computer Security Act

Back 3

1.Computer Security Act of 1987 outlines steps the government must take to protect its own systems from attack.

2.National Institute of Standards and Technology became responsible for developing standards and guidelines for federal computer systems.

3. Provides for enactment of such standards and guidelines.

4.To require the establishment of security plans by all operators of federal computer systems that contain sensitive information.

Front 4

Explain the basics of the Government Information Security Reform Act

Back 4

The government information security reform act of 2000 further develops the federal government information security program.

- Provide a comprehensive framework for establishing and ensuring the effectiveness of controls over information resources that support federal operations and assets.

-Implementation of security management measures,to assure that opportunities for interoperability are not adversely affected.

Front 5

What are the differences among copyrights, trademarks, patents, and trade secrets

Back 5

Copyright-this law guarentees the creator of "original works of authorship" protection against the unauthorized duplication of their work. Example Literary, Musical, Dramatic, Motion picture, Sound Recordings, Architectural works

Trademark- words, slogans, and logos used to identify a company and its products or services are protected under trademark. ® represents trademark. Even if you opt not to register your trademark with the PTO, your protection begins only when the first use the trademark.

Patent- protect the intellectual property rights of inventors. For a period of 20 years during which the inventor is granted exclusive rights to use the invention. At the end of the 20 years it becomes in the public domain.

Trade Secret- protection of trade secrets are not registered but rather maintained by the company. By keeping it secret they don't have to publicly disclose the info. They are protected under the Economic Espionage act of 1996

Front 6

What is the basic provisions of the Digital Millennium Copyright Act of 1998

Back 6

Prohibits the distribution of copyright material on digital media such as CD's and DVD's.

This ACT limits the liability for ISP's when their circuits are used by criminal violations as long as they are not monitoring the information or manipulating the info.

Front 7

What are the basic provisions of the Economic Espionage Act of 1996?

Back 7

The economic Espionage act provides penalties for individuals found guilty of the theft of trade secrets. Harsher penalties are for people who are giving it to foreign governments.

Front 8

Explain contractual license agreements

Back 8

Contractual license agreements use a written contract between the software vendor and the customer, outlining the responsibilities of each. These agreements are commonly found for high-priced and/or highly specialized software packages.

Front 9

Explain Shrink- wrap agreements

Back 9

Shrink- wrap licensing agreements are written on the outside of the software packaging. They commonly include a clause stating that you acknowledge agreement and the terms by simply breaking the shrink-wrap seal on the package.

Front 10

Explain click- wrap agreements

Back 10

Click- through license agreements are becoming more commonplace than shrink wrap agreements. In this type of agreement, the contract terms are either written on the software box or included in the software documentation. During installation it will prompt you to agree to the terms.

Front 11

On software licensing, what is the impact of the Uniform Computer Information Transaction Act?

Back 11

Uniform Computer Information Transaction Act is the federal law designed for adoption by each of the 50 states to provide a common framework for the conduct of computer-related business transactions. This gave legal backing for the shrink wrap and click-wrap licensing .

Front 12

What are the notification requirements placed on organizations that experience a data breach.

Back 12

Due to the HITECH act, an amendment of HIPAA, federal law mandates the notification of affected individuals resulting from a breach

Front 13

Explain the European Union Privacy Law

Back 13

The law requires that all processing of personal data meet one of the following : consent, contract, legal obligation, etc.

It also gave rights of individuals about whom data is held and/ or processed.

1. The right to access the data, right to know the data's source.

2.right to correct inaccurate data,

3.right to withold consent to process data in some situations.

4. right of legal action should these rights be violated.

Front 14

Explain the Children's Online Privacy Protection Act of 1998

Back 14

Parents must give verified consent to collect info about children younger than the age of 14 prior to collection of data.

Parents must be provided the opportunity to review any information collected from their children.

Websites must provide a clear privacy notice that states the types of information they collect and what it's used for, including whether any information is disclosed to third parties.

Front 15

Explain the importance of a well- rounded compliance program

Back 15

Most organizations are subject to a wide variety of legal and regulatory requirements related to information security. Building a compliance program ensures that you become and remain compliant with these often overlapping requirements.

Example: PCI compliance

Front 16

Which law first requires operators of the federal interest computer systems to undergo periodic training in computer security issues

Back 16

Computer Security Act

Front 17

Which law protects the rights of citizens to privacy by placing restrictions on authority granted to government agencies to search private residences and facilities?

Back 17

Fourth Amendment