Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 4 - Laws, Regulations, and Compliance > Flashcards

Chapter 4 - Laws, Regulations, and Compliance Flashcards

1
Q

What are the categories of law

A

Criminal law - laws that police and law enforcement concern them with and threaten other people’s rights

Civil law - designed to provide an orderly society and govern matters that are not crimes but that require an impartial arbiter to settle between individuals and organizations.

Administrative law - executive orders, policies, procedures, regulations, that govern daily operations of the agency.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Where are Administrative laws published?

A

Code of Federal Regulations (CFR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the CFAA

A

Computer Fraud and Abuse Act

crime to:
Access govt systems without authorization
Cause malicious damage in excess of $1000
MOdify med records
Any financial systems
Any combination of computers used to commit offense when not all located in the same state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

An ammendment to what act made it illegal to produce malicious code for any reason?

A

CFAA - Computer Fraud and Abuse Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What was the purpose of the National Information Infrastructure Protection Act of 1996

A

Broadens the CFAA to cover computer systems used in international commerce in addition to systems used in interstate commerce.

Extends similar protections to critical infrastructure (railroads, gas pipelines, electric power grids, and telecom systems)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What law requires that federal agencies implement an information security program that covers the agency’s operations?

A

FISMA - Federal Information Security Management Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

In 2014 President Obama signed into law - modernization of federal government approach to cyber security. Consolidated Cyber security with the Homeland security.

A

FISMA - Federal Information Systems Modernization Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the two exceptions to the FISMA consolidation of cybersecurity within DHS?

A

Defense related cyber - DoD

Intelligence related cyber - DNI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A law that charges NIST with the responsibility for coordinating nationwide work on voluntary cybersecurity standards.

A

Cybersecurity Enhancement Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Law charging homeland security with establishing a national cybersecurity and communications ntegration center that serves as the interface between federal agencies and civilian orgs for sharing cybersecurity risks, incidents, analysis, and warnings.

A

National Cybersecurity Protection Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Intangible assets that take the form of secretive recipes, processes, or production techniques

A

Intellectual Property

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Original works of authorship can be protected by?

A 
Copyright Law
Literary
music
drama
sound records
architectural 
graphical
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Can copyright protect software such as the look and feel of a graphical interface and/or the ideas and processes?

A

The courts have gone both ways on the look and feel and ideas and processes are not protected - only the source code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Do you need to go through copyright court to prove copyright status?

A

No - original creators have copyright as long as they can prove they were the author.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Law was created to penalize copyright offenders through pirated media.

A

Digital Millenium Copyright Act
$1 MM fine
10 years prisonment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Protection mechanism for words, slogans, mottos, logos

A

Trademark

17
Q

Three requirements of a utility patent

A

New - original idea
Useful - actually work and accomplish a task
Not obvious - can’t patent a drinking cup as a rainwater collection device

18
Q

Difference between design and utility patent

A

A design patent only protects something for 15 years vice 20 years
Design patent only covers the appearance of the invention
Easier to obtain design patent

19
Q

What are the benefits and disadvantages of a trade secret

A

Do not expire
No public disclosure required

Must create and maintain NDA and access policies that sufficiently demonstrate it is a trade secret. (failure to do so results in loss of trade secret status).

20
Q

What law governs protects trade secrets from theft.

A

Economic Espionage Act of 1996

Anyone found guilty of stealing trade secrets from a US corporation with the intention of benefiting a foreign government or agency may be fined up to 500k and imprisonment for 15 years

Anyone found guilty if stealing trade secrets under other circumstances may be fined up to 250k and imprisonment for ten years.

21
Q

Written agreement between the software vendor and the customer, outlining the responsibilities of each.

A

Contractual license agreement

usually found on high-priced and/or highly specialized software

22
Q

Written agreement on the outside of software packaging that includes a clause that user acknowledges agreement by opening package.

A

Shrink wrap license agreement

23
Q

Agreement terms are included in software documentation and user is required to click a button acknowledging that they agree to the terms of the agreement.

A

Click through license agreement

24
Q

Law governing import/export that controls the export of items that specifically designated as military and defense items, including technical information related to those items.

A

International Traffic in Arms Regulations (ITAR)

25
Q

Law governing import/export that controls a broad set of items that are designed for commercial use but have military applications.

A

Export Administration Regulations (EAR)

26
Q

Law severely limiting the ability of the federal government to disclose private information about individual citizens to other people or among agencies wthout written consent of affected individuals, court orders, law enforcement, or health and safety.

A

Privacy act of 1974

27
Q

Law protects against the monitoring of email and voicemail communications and prevents providers of those services from making unauthorized disclosures of their content.

A

Electronic Communications Privacy Act of 1986 (ECPA)

28
Q

Law requires all communications carriers to make wiretaps possible for law enforcement with an appropriate court order, regardless of the technology in use.

A

Communications Assistance for Law Enforcement Act (1994)

29
Q

Privacy and security regulations requiring strict security measures for hospitals, physicians, insurance companies, and other organizations that process or store private medical information about individuals

A

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

30
Q

Law updated HIPPA’s privacy and security requirements and was implemented through the HIPAA Omnibus Rule in 2013. What is unique about it?

A

Helath information Technology for Economic and Clinical Health Act of 2009 (HITECH)

Provisions a data breach notification rule at the federal level.

31
Q

Law protects kids from websites collecting information about them. Parents must be provided with the opportunity to review any information collected from their children. Parents must give verifiable consent to the collection of information about their children younger than 13.

A

Children’s Online Privacy Protection Act of 1998 (COPPA)

32
Q

Allowed banks to share information but restricted the personal information that could be shared among banks to protect privacy.

A

Gramm-Leach Biley Act of 1999

33
Q

Law broadens powers of law enforcement and intelligence agencies when monitoring electronic communications. Allows blanket warrants for individuals rather than just circuits.

A

USA Patriot act of 2001

Providing Appropriate Tools Required to Intercept and Obstruct Terrorism

34
Q

Requirements of the European Union Data Protection Directive (DPD) prescribe that all processing of personal data meet one of the following criteria:

A 
Consent
Contract
Legal Obligation
Vital interest of data subject
Right to access data 
Right to know data's source
Right to correct inaccurate data
Right to withhold consent to process data in some situations
Right to legal action should these rights be violated
35
Q

How does the European Union General Data Protection Regulation (GDPR) expand upon the EU Data protection Directive (DPD)

A

Widened the scope of DPD
Applies to all orgs that collect data from EU residents
Law applies to orgs not based in the EU if they collect data about EU residents

36
Q

What are the stipulations of cross-border information sharing in the EU

A

Orgs may adopt a set of standard contractual clauses that have been approved for use in situations where information is being transferred outside of EU.

ORgs may adopt binding corporate rules that regulate data transfers between internal units of the same firm.

37
Q

What are the stipulations of cross-border information sharing in the EU

A

Orgs may adopt a set of standard contractual clauses that have been approved for use in situations where information is being transferred outside of EU.

Orgs may adopt binding corporate rules that regulate data transfers between internal units of the same firm.

38
Q

What are the stipulations of cross-border information sharing in the EU

A

Orgs may adopt a set of standard contractual clauses that have been approved for use in situations where information is being transferred outside of EU.

Orgs may adopt binding corporate rules that regulate data transfers between internal units of the same firm.

39
Q

Canadian Law that restricts how commercial businesses may collect, use, and disclose personal information

A

Personal Information protection and Electronic Documentation Act - PIPEDA

CISSP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions