Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ACCT 5378 - Control & Security of Financial Information > Chapter 3 - Legal, Ethical and Professional Issues in Information Security > Flashcards

Chapter 3 - Legal, Ethical and Professional Issues in Information Security Flashcards

1
Q

Learning Objectives

A

–Describe the functions of and relationships among laws, regulations, and professional organizations in information security

–Explain the differences between laws and ethics

–Identify major national laws that affect the practice of information security

–Discuss the role of culture as it applies to ethics in information security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 3 things an IS practitioner must do to reduce risks and liabilities?

A
  1. Understand the current legal environment
  2. Stay current with laws and regulations
  3. Watch for new and emerging issues
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Laws

A

Rules that mandate or prohibit certain actions or behaviors and are enforced by the state/government.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Ethics

A

Regulate and define socially acceptable behavior.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Cultural mores

A

fixed moral attitudes or customs of a particular group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Main difference b/w laws and ethics

A

laws have the cudgel of force behind them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Liability

A

the legal obligation of an entity beyond criminal or contract law, includes the legal obligation to make restitution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Restitution

A

the legal obligation to compensate an injured party for the wrongs committed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Due care

A

the legal standard requiring a prudent organization to act both legally and ethically and know the consequences of actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Due diligence

A

the legal standard requiring a prudent organization to maintain the standard of due care and ensure actions are effective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Jurisdiction

&

Long-arm Jurisdiction

A

•Jurisdiction: court’s right to hear a case if the wrong was committed in its territory or involved its citizenry

•Long arm jurisdiction: application of laws to those residing outside court’s normal jurisdiction; usually granted when person acts illegally within jurisdiction and leaves

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Policies

A

•Policies: managerial directives that specify acceptable and unacceptable employee behavior in the workplace

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Difference between policy and law

A

ignorance of a policy is an acceptable defense

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

5 Criteria for policy enforcement

A

•Criteria for policy enforcement:

–Dissemination (distribution)

–Review (reading)

–Comprehension (understanding)

–Compliance (agreement)

–Uniform enforcement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Civil Law

A

governs nation or state; manages relationships/conflicts between organizations and people

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Criminal Law

A

•Criminal: addresses activities and conduct harmful to society; actively enforced by the state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Private Law

A

•Private: family/commercial/labor law; regulates relationships between individuals and organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Public law

A

•Public: regulates structure/administration of government agencies and relationships with citizens, employees, and other governments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Computer Fraud and Abuse Act of 1986 (CFA Act)

A

•cornerstone of many computer-related federal laws and enforcement efforts‏

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

National Information Infrastructure Protection Act of 1996

A

–Modified several sections of the previous act and increased the penalties for selected crimes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The National Info Infrastructure Act increased penalties judged on the value of the information and the purpose. What are the three purposes?

A
  1. Purpose of commercial advantage
  2. For private financial gain
  3. In furtherance of a criminal act
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

USA PATRIOT Act of 2001

A

•USA PATRIOT Act of 2001: provides law enforcement agencies with broader latitude in order to combat terrorism-related activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

USA PATRIOT Improvement and Reauthorization Act

A

•USA PATRIOT Improvement and Reauthorization Act: Made permanent fourteen of the sixteen expanded powers of the Department of Homeland Security (DHS) and the FBI in investigating terrorist activity

24
Q

Computer Security Act of 1987

A

•One of the first attempts to protect federal computer systems by establishing minimum acceptable security practices.

25
Q

Privacy

A

•Right of individuals or groups to protect themselves and personal information from unauthorized access

26
Q

What is a major concern with big data and privacy?

A

•Ability to aggregate data from multiple sources allows creation of information databases previously impossible

27
Q

What is the significance of the Privacy Customer Information Section of the Common Carrier Regulation?

A

info cannot be used for marketing purposes, solely for providing services. They also cannot disclose info except when necessary to provide their services, or when a customer requests disclosure of information.

28
Q

Importance of

Federal Privacy Act of 1974

A

Meant to keep the federal government in check if they do not protect the privacy of individuals’ and businesses’ information. They can be held responsible if any info is released w/o permission

29
Q

The Electronic Communications Privacy Act of 1986

A

regulates the interception of wire, electronic, and oral communications. The ECPA works in conjunction with the Fourth Amendment of the US Constitution, which provides protections from unlawful search and seizure

30
Q

Health Insurance Portability and Accountability Act of 1996 (HIPAA), aka Kennedy-Kassebaum Act

A

The act requires organizations that retain health-care information to use information security mechanisms to protect this information, as well as policies and procedures to maintain this security.

31
Q

Financial Services Modernization Act, or Gramm-Leach-Bliley Act of 1999

A

requires all financial institutions to disclose their privacy policies on the sharing of nonpublic personal information.

It also requires due notice to customers so that they can request that their information not be shared with third parties.

32
Q

Identity Theft

A

•It can occur when someone steals victim’s personally identifiable information (PII) and poses as victim to conduct actions/make purchases.

33
Q

What steps should you take if you suspect identity theft?

A
  1. –Report to one of three national credit reporting companies and request initial fraud alert
  2. –Order credit reports and examine for fraud activity; contact fraud department in organization holding suspect account
  3. –Create identity theft report through FTC’s identity theft affidavit
  4. –Document all calls/letters/communications during the process
34
Q

Export and Espionage Act of 1996 (EEA)

A

an attempt to protect American ingenuity, intellectual property, and competitive advantage, Congress passed the Economic Espionage Act (EEA) in 1996. This law attempts to prevent trade secrets from being illegally shared.

35
Q

The Security And Freedom Through Encryption Act of 1997 (SAFE)

A

was an attempt by Congress to provide guidance on the use of encryption and provided measures of public protection from government intervention.

36
Q

Exclusions to U.S. copyright law

A

Fair use of copyrighted materials includes the use to support news reporting, teaching, scholarship, and a number of other related permissions, so long as the purpose of the use is for educational or library purposes, not for profit, and is not excessive.

37
Q

What is the goal of US copyright laws?

A

To protect intellectual property

38
Q

Sarbanes Oxley Act of 2002

A

•Seeks to improve reliability and accuracy of financial reporting and increase the accountability of corporate governance in publicly traded companies

39
Q

Effects of SOX 2002

A
  • Affects executive management of publicly traded corporations and public accounting firms
  • Penalties for noncompliance range from fines to jail terms
40
Q

Freedom of Information Act of 1966 (FOIA)

A
  • Allows access to federal agency records or information not determined to be matter of national security
  • U.S. government agencies required to disclose any requested information upon receipt of written request
41
Q

backlog meaning

A

A backlog is a buildup of work that needs to be completed. The term “backlog” has a number of uses in accounting and finance.

42
Q

Payment Card Industry Data Security Standards (PCI DSS)

A

•offers a standard of performance to which organizations processing payment cards must comply.

43
Q

State(Federal) vs. Local regulations

A

Federal computer laws mainly written specifically for federal information systems; have little applicability to private organizations

Thus, IS professionals are responsible for understanding and complying with state regulations.

44
Q

Digital Millennium Copyright Act (DMCA)‏

A

The Digital Millennium Copyright Act (DMCA) is the U.S. version of an international effort to reduce the impact of copyright, trademark, and privacy infringement especially through the removal of technological copyright protection measures.

45
Q

Three general causes of unethical and illegal behavior

A
  1. Ignorance
  2. Accident
  3. Intent
46
Q

Deterrence

A

methods and strategies used to prevent unethical activity (i.e.: laws, policies, technical controls)

47
Q

Mission of

Department of Homeland Security (DHS)

A

to protect the citizens as well as the physical and informational assets of the US

48
Q

Mission of the US Secret Service

A

–In addition to protective services, charged with safeguarding nation’s financial infrastructure and payments system to preserve integrity of economy

49
Q

Missions of the FBI

A

–Primary law enforcement agency; investigates traditional crimes and cybercrimes

–Key priorities include computer/network intrusions, identity theft, and fraud

50
Q

Mission of the

National Security Agency (NSA)

A

–Is the nation’s cryptologic organization

–Responsible for signal intelligence and information assurance (security)

–Information Assurance Directorate (IAD) is responsible for the protection of systems that store, process, and transmit information of high national value.

51
Q

The 7 Dynamics of Every Successful Dynamic Dating Conversation.

A
  1. Ground to create presence (grounded vulnerability)
  2. Connect
  3. Appreciate
  4. Be Curious
  5. Share
  6. Support
  7. Be Bold
52
Q

Story at the beginning of the Chapter and what can be learned?

A

Henry Macgruder leaves a CD at the coffee station and Iris Majwubu finds it, runs a virus scan, and identifies both the owner and the crime.

Henry was basically selling sensitive company information (names, addresses, SSNs, credit card numbers, etc.)

Henry - bad guy

Iris - person who found out

Jill - person paying Jill for the stolen information

53
Q

ISACA

A

Information Systems Audit and Control Association

54
Q

ISACA Certifications (internal audit careers)

A

Certified Information Systems Auditor (CISA,1978)[18]

Certified Information Security Manager (CISM, 2002)[19]

Certified in the Governance of Enterprise IT (CGEIT, 2007)[20]

Certified in Risk and Information Systems Control (CRISC, 2010)[21]

Certified Data Privacy Solutions Engineer (CDPSE)[22]

Cybersecurity Practitioner Certification (CSX-P)[23]

55
Q
A

ACCT 5378 - Control & Security of Financial Information (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions