Deck 12: Protection Mechanisms

Question 1

What is privacy in the context of information security?

Answer 1

Privacy implies maintaining the confidentiality of an individual, and keeping the information intact. This is protected by the privacy law. At present time of centralized database systems, anyone can get complete information of an individual from a single source. Privacy in the term of information security is to ensure the protection of individual information by any means. Information could be the name, address, contact number, office address of an individual. This information of an individual must not be breached.

Question 2

What is another name for the Kennedy-Kassebaum Act (1996), and why is it important to organizations that are not in the health care industry?

Answer 2

The Kennedy-Kassebaum Act (1996) is also known as The Health Insurance Portability and Accountability Act (1996).
This act is important as it regulates all healthcare industry regarding the privacy of information of patients. This act is equally applicable to the organizations that provide the self-insurance for its employees. This law also influences the information security through various means. Each organization is bound by the information security of an individual. Thus, it is important even to the organizations that are not in the health care industry.

Question 3

If you work for a financial service organization (such as a bank or credit union), which law from 1999 affects your use of customer data? What other effects does it have?

Answer 3

Gramm-Leach-Bliley Act of 1999, which is also known as Financial Service Modernization Act (1999), regulates the use of customer data.
This act also amended the Glass-Steagall Act of 1993, which restricted the financial service sector to offer insurance, banking, and investment from the single point. Thus, the GLB Act, 1999 provides the facility to an individual to operate his or her all financial need from single financial service provider. For example, a consumer can get banking, investment, and insurance service from a single point.

Question 4

Iris was a little unsure of what to do next. She had just left the meeting with the other executives of RWW, Inc. At the meeting they confirmed the need for action on the matter of the critical information offered for sale on a public auction site. That was the last point of agreement. This was a risk they had simply not planned for and they were completely unprepared.
Just before the meeting broke up, they had made assignments to various people in the meeting. Robin, the CEO, was going to contact the members of the board of directors to brief them so that if the story became public, they would not be surprised. Jerry, the corporate counsel, was going to start an intensive effort to discover what peer companies had done in situations like this. Mike, the CIO, was assigned to contact the auction site to get the auction shut down and lay the groundwork for working with whatever authorities were brought in for the criminal aspects of the case.
Iris was assigned to investigate which law enforcement agency should be involved in the investigation. She reached for her business card box and began thumbing through the contacts she had.
Do you think the response of the company so far indicates any errors in the matter of this incident?

Question 5

Which 1997 law provides guidance on the use of encryption?

Question 6

What does CISSP stand for? Using the Internet, find out what continuing education is required for the holder of a CISSP to remain current and in good standing

Question 7

What is intellectual property? Is it offered the same protection in every country? What laws currently protect intellectual property in the United States and Europe?

Question 8

What is the difference between criminal law and civil law?

Question 9

What is a policy? How does it differ from a law?

Question 10

Iris was a little unsure of what to do next. She had just left the meeting with the other executives of RWW, Inc. At the meeting they confirmed the need for action on the matter of the critical information offered for sale on a public auction site. That was the last point of agreement. This was a risk they had simply not planned for and they were completely unprepared.
Just before the meeting broke up, they had made assignments to various people in the meeting. Robin, the CEO, was going to contact the members of the board of directors to brief them so that if the story became public, they would not be surprised. Jerry, the corporate counsel, was going to start an intensive effort to discover what peer companies had done in situations like this. Mike, the CIO, was assigned to contact the auction site to get the auction shut down and lay the groundwork for working with whatever authorities were brought in for the criminal aspects of the case.
Iris was assigned to investigate which law enforcement agency should be involved in the investigation. She reached for her business card box and began thumbing through the contacts she had.
With which agency do you think Iris should start? On what factors do you base that recommendation?

Question 11

What are the three general categories of unethical and illegal behavior?

Question 12

For what kind of information security jobs does the NSA recruit? Use the Internet to visit its Web page and find a listing.

Question 13

What is the best method for preventing illegal or unethical behavior?

Question 14

What is tort law and what does it permit an individual to do?

Question 15

Of the professional organizations discussed in this chapter, which has been in existence the longest time? When was it founded?

Question 16

Iris was a little unsure of what to do next. She had just left the meeting with the other executives of RWW, Inc. At the meeting they confirmed the need for action on the matter of the critical information offered for sale on a public auction site. That was the last point of agreement. This was a risk they had simply not planned for and they were completely unprepared.
Just before the meeting broke up, they had made assignments to various people in the meeting. Robin, the CEO, was going to contact the members of the board of directors to brief them so that if the story became public, they would not be surprised. Jerry, the corporate counsel, was going to start an intensive effort to discover what peer companies had done in situations like this. Mike, the CIO, was assigned to contact the auction site to get the auction shut down and lay the groundwork for working with whatever authorities were brought in for the criminal aspects of the case.
Iris was assigned to investigate which law enforcement agency should be involved in the investigation. She reached for her business card box and began thumbing through the contacts she had.
What criminal acts do you think are involved in this situation? What do you think the relationship of the perpetrator to RWW, Inc., might be?

Question 17

Of the professional organizations discussed in this chapter, which is focused on auditing and control?

Question 18

Using the resources available in your library, find out what laws your state has passed to prosecute computer crime.

Question 19

What is the stated purpose of the SANS organization? In what ways is it involved in professional certification for InfoSec professionals?

Question 20

What are the three primary types of public law?

Question 21

Which U.S. federal agency sponsors the InfraGard program? Which agency has taken control of the overall National Infrastructure Protection mission?

Question 22

Using the Web, go to www.eff.org. What are the current top concerns of this organization?

Question 23

What is due care? Why would an organization want to make sure it exercises due care in its usual course of operations?

Question 24

Which law amended the Computer Fraud and Abuse Act of 1986, and what did it change?

Question 25

What can be done to deter someone from committing a crime?

Question 26

Using the ethical scenarios presented in this chapter, consider each scenario and note your response. Bring your answers to class to compare them with those of your peers.

Question 27

How does due diligence differ from due care? Why are both important?

Question 28

Which organization led the efforts to overturn the Computer Decency Act? What happened to the law it opposed?