Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Chapter 9 - Legal Compliance > Flashcards

Chapter 9 - Legal Compliance Flashcards

(79 cards)

Start Studying
0
Q

Computer targeted crime

A

A computer was the target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

Computer assisted crime

A

When a computer is used as a tool to commit the crime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Computer is incidental

A

A computer is used towards the crime but not for the crime, like storing discovered lotto ticket numbers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Zombie, bots, and a botnet oh my

A

Zombie - a compromised computer
Bots - the software
Botnet - the collection of compromised computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Advanced persistent threat APT

A

Advanced - highly knowledgable and understanding of the environment
Persistent - will wait for the perfect moment and stake a foothold

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CoE convention on cybercrime

A

First true attempt at making internationally accepted cybercrime policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

OECD

A

Cross border policy companies that transfer data across borders should be aware of

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

EU principles on privacy

A

A directive on how private data should be handled internationally

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

EU data protection directive

A

All EU union companies must abide by the data protection laws put into place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Safe harbor

A

A set of stopgap policies to make non EU companies in compliance with EU standards more quickly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Wassenaar agreement

A

Exportation restrictions including technology - these are restricted by good and bad countries and some countries have import restrictions like big brother countries who don’t want people to have cryptography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Tort law

A

This is a civil law in the common law system, ie crime against a business or a person financially .. Jury judges on liability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the law systems of the world?

A 
Common - US/UK
Civil - Most of Europe 
Religious - Muslim
Customary - How it has always been
Mixed - various systems based on local
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Criminal law

A

Murder kidnapping etc, judged based on guilt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Regulatory law

A

Building codes and other administrative policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Intellectual property law

A

Copyright and trademark laws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Trade secret

A

A profitable secret idea or recipe of ideas that could damage a company if leaked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Copyright

A

Protects the expression of an idea, like a painting or programming code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Trademark

A

This is a brand or slogan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Patent

A

This is claiming an invention for a certain number of years before being public domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Software protection association

A

A group of major companies working together against piracy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

FAST

A

London based federation against software theft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Digital millennium copyright act

A

Law that makes it federally illegal to create products or methods that circumvent copyright mechanisms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Generic approach to privacy

A

Horizontal enactment rules that stretch across all industry bounderies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Regulation by industry approach to privacy
Specific sector enacted privacy like healthcare
25
PII
Personally identifiable information - this is what people want to keep private and unique
26
SOX
Uses COSO model for compliance and helps keep companies honest
27
HIPAA
Health information privacy act used to secure your PID - violations are extremely steep
28
HITECH act
An added protection for HIPAA rules govern in the civil and criminal sector
29
GLBA
Gramm-Leach-Bliley act enforces financial institutions to develop privacy notices and options for information sharing This is not just banks
30
Computer fraud and abuse act
Written in 1986 and amended several times after .. Most recently in 2008 .. Protects against knowingly accessing a computer without authorization to or the distribution of malicious code
31
Federal privacy act of 1974
Federal law that states one has the right to sue if government uses private data in an unintended manner
32
PIPEDA
Canadian privacy law protecting PID
33
Basel II
Basel forces banks to have a certain amount of actual money not just ledgers of money .. Basel II requires them to have strong risk mitigation in place
34
PCIDSS
Credit company standardization of security and must be followed by any company that uses them (ie most)
35
FISMA
A law that requires each federal agency to have a risk based for cost effective security policy
36
Economic espionage act
Defined trade secrets to include tech and allowed FBI to investigate industrial and corporate espionage
37
USA PATRIOT
An anti terrorism act to unify and unbound the federal and civil ability to spy on suspected terrorist activity (ie big brother)
38
REP
Reasonable expectation of privacy - implied right of privacy stated by the 4th amendment of the constitution
39
what is the challenge of REP?
If it isn't stated in the privacy policy and you are terminated, lawsuits can be won for wrongful termination
40
Due care vs due diligence
Due care is when a company does all it could have and properly mitigated damages Due diligence is the proper investigation into weakness and vulnerability prior to making decisions
41
SAS
Statement on auditing standards
42
SAS 70
Service providing organizations must follow and comply with this standard
43
Downstream liability
When a company that is relying on yours gets affected by your negligence
44
Legally recognized obligation
When a legally written law has been broken
45
Proximate cause
This is the direct and obvious chain of events that are the cause of the plaintiffs damages
46
Procurement process
This is everything from discovery to evaluation to purchasing and aquiring
47
RFP
Request for proposal - a request to vendors designed to solve a business problem and security requirements
48
Vendor management
Developing and monitoring vendor activity and governance of SLA
49
Steps to becoming compliant ?
1. Find out laws that govern your business (SOX HIPPA or GLBA etc) 2. Determine security framework to match the laws (ISO 27001,COSO, etc) 3. Choose a risk methodology (ISO 27005, OCTAVE) 4. Choose a control method (CoBit, NIST 800-53) 5. Implement and comply to standards
50
GRC
Governance Risk Compliance is the three key things that must be accounted for in a business in regard to business health
51
KPI
Key performance indicator - each of the GRC can be audited for key points, these are the KPI
52
What is the difference between incident and event?
Event is a single documented occurrence if an issue and an incident is a series of events
53
What is the purpose of an incident response team?
To follow the incident response policy and know exactly what to do when
54
Incident management
What proactive and reactive steps can be instituted to improve the incident handling?
55
what are the 6 steps to incident response?
``` Triage Investigation Containment Analysis Tracking Recovery ```
56
Computer forensics
Used to discover digital evidence from the network and computer crime scene
57
What is the key steps to ensure a system does not lose forensic information?
Unplug network Dump ram to disk Power off Clone disk
58
IOCE/SWDGE
Standardization of computer forensics
59
MOM did it
Motive - who? why? Opportunity - where? When? Means - knowledge and capability to commit the crime
60
Modes operandi
MO.. A computer hackers habits, call sign, signature or anything to link
61
What are some tools to use to make sure to properly copy a drive?
Encase, FTK Imager, -dd unix
62
Primary and working image
Primary image is stored in a library | Working image is used for analysis
63
Chain of custody
Who has touched the evidence and what was done, precisely, to it since the crime
64
Logs hearsay
Logs will be viewed as heresay unless they are collected on a regular basis by the business before hand
65
Primary vs secondary vs direct evidence
Primary is most reliable and verifiable Secondary is tamper able yet valid, like verbal or document copies Direct evidence relies on nothing else to support it
66
Corroboration
The necessity to combine evidence to make a point
67
Enticement vs entrapment
Enticement is the desire to do something illegal | Entrapment is making them do something illegal by tricking them
68
Salami attack
If I take 5c from 50,000 bank accounts I could make 30,000 more a year
69
Data diddling
It was just an extra 0.. I fixed it by moving the extra !
70
Password sniffing
I can find your password if I just got to .shadow file and find your reverse hash!
71
IP spoofing
It wasn't me, I have a different IP
72
Dumpster diving
You know how you don't shred anything? Hmm.
73
Wiretap
You really wanted to hear that conversation with grandma didn't you?
74
Cyber squatting
Not illegal but generally requires legal entities to resolve. A.com will cost 1 million dollars
75
Where can I find the cissp code of ethics?
www.isc2.org
76
Computer ethics foundation
Wrote Ten Commandments of computer ethics
77
Internet architecture board
Internet engineering and top level architect responsible for the health of the Internet based on ethics in RFC 1087
78
Federal sentencing guidelines for organizations
Federal code of ethics used for modifying sentencing

CISSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions