Deck 3: Legal, Ethical, and Professional Issues in Information Security

Question 1

The Department of Homeland Security works with academic campuses nationally, focusing on resilience, recruitment, internationalization, growing academic maturity, and academic research.

Answer 1

True

Question 2

The difference between a policy and a law is that ignorance of a law is an acceptable defense.

Answer 2

False

Question 3

Studies on ethics and computer use reveal that people of different nationalities have different perspectives; difficulties arise when one nationality's ethical behavior violates the ethics of another national group.

Answer 3

True

Question 4

Since it was established in January 2001, every FBI field office has started an InfraGard program to collaborate with public and private organizations and the academic community.

Question 5

In the context of information security, confidentiality is the right of individuals or groups to protect themselves and their information from unauthorized access.

Question 6

The key difference between laws and ethics is that ethics carry the authority of a governing body and laws do not.

Question 7

Due care and due diligence require that an organization make a valid effort to protect others and continually maintain this level of effort, ensuring these actions are effective.

Question 8

The Computer Security Act of 1987 is the cornerstone of many computer-related federal laws and enforcement efforts; it was originally written as an extension and clarification of the Comprehensive Crime Control Act of 1984.

Question 9

The United States has implemented a version of the DMCA law called the Database Right, in order to comply with Directive 95/46/EC.

Question 10

The Council of Europe Convention on Cybercrime has not been well received by advocates of intellectual property rights because it de-emphasizes prosecution for copyright infringement, but it has been well received by supporters of individual rights in the United States.

Question 11

Individuals with authorization and privileges to manage information within the organization are most likely to cause harm or damage by accident.

Question 12

Laws, policies, and their associated penalties only provide deterrence if offenders fear the penalty, expect to be caught, and expect the penalty to be applied if they are caught.

Question 13

The Department of Homeland Security is the only U.S. federal agency charged with the protection of American information resources and the investigation of threats to, or attacks on, those resources.

Question 14

Cultural differences can make it difficult to determine what is ethical and not ethical between cultures, except when it comes to the use of computers, where ethics are considered universal.

Question 15

The Secret Service is charged with safeguarding the nation's financial infrastructure and payments systems to preserve the integrity of the economy.

Question 16

Criminal laws address activities and conduct harmful to society and is categorized as private or public.

Question 17

Employees are not deterred by the potential loss of certification or professional accreditation resulting from a breach of a code of conduct, because this loss has no effect on employees' marketability and earning power.

Question 18

For policy to become enforceable, it only needs to be distributed, read, understood, and agreed to.

Question 19

The NSA is responsible for signal intelligence, information assurance products and services, and enabling computer network operations to gain a decision advantage for the United States and its allies under all circumstances.

Question 20

Unethical and illegal behavior is generally caused by ignorance (of policy and/or the law), by accident, and by inadequate protection mechanisms.

Question 21

In a study on software license infringement, licenses from the United States were significantly more permissive than those from the Netherlands and other countries. _________________________

Question 22

According to the National Information Infrastructure Protection Act of 1996, the severity of the penalty for computer crimes depends on the value of the information obtained and whether the offense is judged to have been committed for each of the following except __________.

A) for purposes of commercial advantage
B) for private financial gain 
C) to harass
D) in furtherance of a criminal act

Question 23

__________ law regulates the structure and administration of government agencies and their relationships with citizens, employees, and other governments.

A) Public
B) Private 
C) Civil
D) Criminal

Question 24

The communications networks of the United States carry(ies) more funds than all of the armored cars in the world combined. _________________________

Question 25

__________ law comprises a wide variety of laws that govern a nation or state.

A) Criminal
B) Civil 
C) Public
D) Private

Question 26

The Digital Millennium Copyright Act is the American law created in response to Directive 95/46/EC, adopted in 1995 by the European Union. _________________________

Question 27

Privacy is the right of individuals or groups to protect themselves and their information from unauthorized access, providing confidentiality._________________________

Question 28

The U.S. Secret Service is currently within the Department of the Treasury. _________________________

Question 29

The Federal Privacy Act of 1974 regulates government agencies and holds them accountable if they release information about national security without permission. _________________________

Question 30

Civil law addresses activities and conduct harmful to society and is actively enforced by the state. _________________________

Question 31

Intellectual privacy is recognized as a protected asset in the United States. _________________________

Question 32

Laws, policies, and their associated penalties only provide deterrence if, among other things, potential offenders fear the probability of a penalty being applied. _________________________

Question 33

The Graham-Leach-Bliley Act is a critical piece of legislation that affects the executive management of publicly traded corporations and public accounting firms. _________________________

Question 34

​The FTC recommends that people place an initial fraud alert (among other things) when they suspect they are victims of identity theft.

Question 35

The code of ethics put forth by (ISC)2 focuses on four mandatory canons: "Protect society, the commonwealth, and the infrastructure; act honorably, honestly, justly, responsibly, and legally; provide diligent and competent service to principals; and advance and protect the profession." _________________________

Question 36

The Economic Espionage Act of 1996 protects American ingenuity, intellectual property, and competitive advantage. _________________________

Question 37

Ethics are the moral attitudes or customs of a particular group. _________________________

Question 38

The Computer __________ and Abuse Act of 1986 is the cornerstone of many computer-related federal laws and enforcement efforts.

A) Violence
B) Fraud 
C) Theft
D) Usage

Question 39

The Federal Bureau of Investigation's National InfraGard Program serves its members in four basic ways: Maintains an intrusion alert network using encrypted e-mail; maintains a secure Web site for communication about suspicious activity or intrusions; sponsors local chapter activities; and operates a help desk for questions. _________________________

Question 40

The Department of Homeland Security was created in 2003 by the 9/11 Memorial Act of 2002. _________________________

Question 41

What is the subject of the Computer Security Act  

A) Federal agency information security 
B) Telecommunications common carriers 
C) Cryptography software vendors 
D) All of the above

Question 42

The Council of Europe adopted the Convention of Cybercrime in 2001 to oversee a range of security functions associated with __________ activities.

A) online terrorist
B) electronic commerce 
C) cyberactivist
D) Internet

Question 43

__________ are rules that mandate or prohibit certain behavior and are enforced by the government.

Question 44

Which of the following acts defines and formalizes laws to counter threats from computer-related acts and offenses  

A) Electronic Communications Privacy Act of 1986 
B) Freedom of Information Act (FOIA) of 1966 
C) Computer Fraud and Abuse Act of 1986 
D) All of the above

Question 45

Which of the following acts is a collection of statutes that regulate the interception of wire, electronic, and oral communications  

A) Electronic Communications Privacy Act 
B) Financial Services Modernization Act 
C) Sarbanes-Oxley Act 
D) Economic Espionage Act

Question 46

Which of the following acts is also widely known as the Gramm-Leach-Bliley Act  

A) Financial Services Modernization Act 
B) Communications Act 
C) Computer Security Act 
D) Health Insurance Portability and Accountability Act

Question 47

The Privacy of Customer Information Section of the common carrier regulation states that any proprietary information shall be used explicitly for providing services, and not for any __________ purposes.

A) troubleshooting
B) billing 
C) customer service
D) marketing

Question 48

Laws, policies, and their associated penalties only deter if which of the following conditions is present  

A) Fear of penalty 
B) Probability of being caught 
C) Probability of penalty being administered 
D) All of the above

Question 49

The __________ attempts to prevent trade secrets from being illegally shared.

A) Electronic Communications Privacy Act 
B) Sarbanes-Oxley Act 
C) Financial Services Modernization Act 
D) Economic Espionage Act

Question 50

__________ is the legal obligation of an entity that extends beyond criminal or contract law.

Question 51

The __________ defines stiffer penalties for prosecution of terrorist crimes.

A) USA PATRIOT Act
B) Sarbanes-Oxley Act 
C) Gramm-Leach-Bliley Act
D) Economic Espionage Act

Question 52

__________ are the fixed moral attitudes or customs of a particular group.

Question 53

The Health Insurance Portability and Accountability Act of 1996, also known as the __________ Act, protects the confidentiality and security of health-care data by establishing and enforcing standards and by standardizing electronic data interchange.

A) Gramm-Leach-Bliley
B) Kennedy-Kessebaum 
C) Privacy
D) HITECH

Question 54

The National Information Infrastructure Protection Act of 1996 modified which act  

A) USA PATRIOT Act 
B) USA PATRIOT Improvement and Reauthorization Act 
C) Computer Security Act 
D) Computer Fraud and Abuse Act

Question 55

In 2002, Congress passed the Federal Information Security Management Act (FISMA), which mandates that all federal agencies __________.

A) provide security awareness training 
B) periodic assessment of risk 
C) develop policies and procedures based on risk assessments 
D) All of the above

Question 56

What is the subject of the Sarbanes-Oxley Act  

A) Banking
B) Financial reporting 
C) Privacy
D) Trade secrets

Question 57

Individuals with authorization and privileges to manage information within the organization are most likely to cause harm or damage __________.

A) with intent
B) by accident 
C) with malice
D) with negligence

Question 58

Criminal or unethical __________ goes to the state of mind of the individual performing the act.

A) attitude 
B) intent 
C) accident 
D) All of the above

Question 59

Which of the following countries reported the least tolerant attitudes toward personal use of organizational computing resources  

A) Australia
B) United States 
C) Singapore
D) Sweden

Question 60

The __________ of 1999 provides guidance on the use of encryption and provides protection from government intervention.

A) Prepper Act 
B) Economic Espionage Act 
C) USA PATRIOT Act 
D) Security and Freedom through Encryption Act

Question 61

"Long arm __________" refers to the long arm of the law reaching across the country or around the world to draw an accused individual into its court systems whenever it can establish jurisdiction.

Question 62

The __________ is a respected professional society that was established in 1947 as "the world's first educational and scientific computing society."

Question 63

Guidelines that dictate certain behavior within an organization are known as __________.

Question 64

The __________ is the American contribution to an international effort to reduce the impact of copyright, trademark, and privacy infringement, especially when accomplished via the removal of technological copyright protection measures.

Question 65

List the five fundamental principles of HIPAA.

Question 66

__________ information is a form of collective data that relates to a group or category of people and thathas been altered to remove characteristics or components that make it possible to identify individuals within the group.

Question 67

__________ is the unauthorized taking of personally identifiable information with the intent of committing fraud or another illegal or unethical purpose.

Question 68

Family law, commercial law, and labor law are all encompassed by __________ law.

Question 69

Key studies reveal that the overriding factor in leveling the ethical perceptions within a small population is __________.

Question 70

Software license infringement is also often called software __________.

Question 71

The __________ Act seeks to improve the reliability and accuracy of financial reporting, as well as increase the accountability of corporate governance, in publicly traded companies.

Question 72

The __________ Act of 1986 is a collection of statutes that regulates the interception of wire, electronic, and oral communications.

Question 73

The __________ Act of 1996 attempts to prevent trade secrets from being illegally shared.

Question 74

The __________ Act of 1999 contains a number of provisions focusing on facilitating affiliation among banks, securities firms, and insurance companies.

Question 75

The __________ Act of 2001 provides law enforcement agencies with broader latitude in order to combat terrorism-related activities.

Question 76

The Payment Card Industry Data Security Standards (PCI DSS) are designed to enhance the __________ of customers' account data.

Question 77

The __________ Act of 1966 allows any person to request access to federal agency records or information not determined to be a matter of national security.

Question 78

The __________ is a nonprofit organization that focuses on the development and implementation of information security certifications and credentials.

Question 79

The low overall degree of tolerance for __________ system use may be a function of the easy association between the common crimes of breaking and entering, trespassing, theft, and destruction of property to their computer-related counterparts.

Question 80

The _________ is a professional association that focuses on auditing, control, and security and whose membership comprises both technical and managerial professionals.