Chapter 3: Compliance Flashcards
Regulations
Written rules issued by an executive body covering specific issues, and apply only to the specific entities that fall under the authority of the agency that issued them
Civil law system
Uses prewritten rules and not based on precedent; is different from civil (tort) laws, which work under a common law system
Common Law System
made up of criminal, civil, and administrative laws
Customary law system
Addresses mainly personal conduct and uses regional traditions and customs as the foundations of the law; is usually mixed with another type of listed legal system rather than being the sole legal system used in a region
Religious law system
Laws are derived from religious beliefs and address an individual’s religious responsibilities; commonly used in Muslim countries or regions
Mixed law system
Uses two or more legal systems
Criminal law
deals with an individual’s conduct that violates government laws developed to protect the public
Civil law
deals with wrongs committed against individuals or organizations ending in injury or damages; no prison time as a punishment, usually requires financial restitution
Administrative law
Regulatory law; covers standards of performance or conduct expected by government agencies from companies, industries, and certain officials
Island-hopping attacks
an attacker compromises an easier target that has a trusted connection to the ultimate target
APT
advanced persistent threat; sophisticated threat actor with the means and will to devote extraordinary resources to compromising a specific target and remaining undetected for extended periods of time
Data breach
a security event which results in the actual or potential compromise of the confidentiality or integrity of protected
PII
personally identifiable information; data which can be used to uniquely identify, contact, or locate a single person or used with other sources to identify a single individual
TDF
transborder data flow; movement of machine-readable data across a political boundary like a country’s border
Data localization laws
Require certain types of data to be stored and process in that country, sometimes exclusively
IP
Intellectual property; type of property created by human intellect consisting of ideas, inventions, and expressions uniquely created by a person and protected from unauthorized use by others
License
an agreement between an IP owner (licensor) and somebody else (licensee), granting the party rights to use the IP in very specific ways
Trade secrets
proprietary to a company, often include information which provides a competitive edge; information is protected as long as the owner takes the necessary protective actions
Copyright
protects the expression of ideas rather than the ideas themselves
Trademarks
protect words, names, product shapes, symbols, colors, or a combination of these used to identify products or a company; items used to distinguish products from the competitors’ products
Patent
grants ownership and enables the owner to legally enforce their rights to exclude others form using the invention covered by the patent
Due diligence
defined as doing everything within one’s power to prevent a bad thing from happening; normally associated with leaders, laws, and regulations
Due care
taking the precautions that a reasonable and competent person would take in the same situation; normally applicable to everyone; its absence could show negligence
Administrative investigations
focused on policy violations
Criminal investigations
aimed at determining whether there is cause to believe someone committed a crime
Civil investigation
Triggered when a lawsuit is imminent or ongoing and similar to a criminal investigation; except that instead or working with law enforcement agencies you will probably be working with attorneys from both sides
Regulatory investigation
initiated by a government regulator when there is reason to believe the organization is not in compliance
Data breach notification requirements
GDPR has strictest breach notification requirements; within 72 hours of becoming aware of the breach
Software piracy
using a software product that it is not authorized to use; can have significant financial and even criminal repercussions
To control the public distribution of an original white paper written by staff
Copyright to protect
Federal Privacy Act of 1974
created to protect personal data; information can only be used for the reason for which it was collected
GDPR
General Data Protection Regulation; privacy law
