Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 9 - Legal Compliance > Flashcards

Chapter 9 - Legal Compliance Flashcards

0
Q

Computer targeted crime

A

A computer was the target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

Computer assisted crime

A

When a computer is used as a tool to commit the crime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Computer is incidental

A

A computer is used towards the crime but not for the crime, like storing discovered lotto ticket numbers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Zombie, bots, and a botnet oh my

A

Zombie - a compromised computer
Bots - the software
Botnet - the collection of compromised computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Advanced persistent threat APT

A

Advanced - highly knowledgable and understanding of the environment
Persistent - will wait for the perfect moment and stake a foothold

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CoE convention on cybercrime

A

First true attempt at making internationally accepted cybercrime policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

OECD

A

Cross border policy companies that transfer data across borders should be aware of

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

EU principles on privacy

A

A directive on how private data should be handled internationally

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

EU data protection directive

A

All EU union companies must abide by the data protection laws put into place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Safe harbor

A

A set of stopgap policies to make non EU companies in compliance with EU standards more quickly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Wassenaar agreement

A

Exportation restrictions including technology - these are restricted by good and bad countries and some countries have import restrictions like big brother countries who don’t want people to have cryptography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Tort law

A

This is a civil law in the common law system, ie crime against a business or a person financially .. Jury judges on liability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the law systems of the world?

A 
Common - US/UK
Civil - Most of Europe 
Religious - Muslim
Customary - How it has always been
Mixed - various systems based on local
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Criminal law

A

Murder kidnapping etc, judged based on guilt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Regulatory law

A

Building codes and other administrative policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Intellectual property law

A

Copyright and trademark laws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Trade secret

A

A profitable secret idea or recipe of ideas that could damage a company if leaked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Copyright

A

Protects the expression of an idea, like a painting or programming code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Trademark

A

This is a brand or slogan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Patent

A

This is claiming an invention for a certain number of years before being public domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Software protection association

A

A group of major companies working together against piracy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

FAST

A

London based federation against software theft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Digital millennium copyright act

A

Law that makes it federally illegal to create products or methods that circumvent copyright mechanisms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Generic approach to privacy

A

Horizontal enactment rules that stretch across all industry bounderies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Regulation by industry approach to privacy

A

Specific sector enacted privacy like healthcare

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

PII

A

Personally identifiable information - this is what people want to keep private and unique

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

SOX

A

Uses COSO model for compliance and helps keep companies honest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

HIPAA

A

Health information privacy act used to secure your PID - violations are extremely steep

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

HITECH act

A

An added protection for HIPAA rules govern in the civil and criminal sector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

GLBA

A

Gramm-Leach-Bliley act enforces financial institutions to develop privacy notices and options for information sharing

This is not just banks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Computer fraud and abuse act

A

Written in 1986 and amended several times after .. Most recently in 2008
.. Protects against knowingly accessing a computer without authorization to or the distribution of malicious code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Federal privacy act of 1974

A

Federal law that states one has the right to sue if government uses private data in an unintended manner

32
Q

PIPEDA

A

Canadian privacy law protecting PID

33
Q

Basel II

A

Basel forces banks to have a certain amount of actual money not just ledgers of money .. Basel II requires them to have strong risk mitigation in place

34
Q

PCIDSS

A

Credit company standardization of security and must be followed by any company that uses them (ie most)

35
Q

FISMA

A

A law that requires each federal agency to have a risk based for cost effective security policy

36
Q

Economic espionage act

A

Defined trade secrets to include tech and allowed FBI to investigate industrial and corporate espionage

37
Q

USA PATRIOT

A

An anti terrorism act to unify and unbound the federal and civil ability to spy on suspected terrorist activity (ie big brother)

38
Q

REP

A

Reasonable expectation of privacy - implied right of privacy stated by the 4th amendment of the constitution

39
Q

what is the challenge of REP?

A

If it isn’t stated in the privacy policy and you are terminated, lawsuits can be won for wrongful termination

40
Q

Due care vs due diligence

A

Due care is when a company does all it could have and properly mitigated damages

Due diligence is the proper investigation into weakness and vulnerability prior to making decisions

41
Q

SAS

A

Statement on auditing standards

42
Q

SAS 70

A

Service providing organizations must follow and comply with this standard

43
Q

Downstream liability

A

When a company that is relying on yours gets affected by your negligence

44
Q

Legally recognized obligation

A

When a legally written law has been broken

45
Q

Proximate cause

A

This is the direct and obvious chain of events that are the cause of the plaintiffs damages

46
Q

Procurement process

A

This is everything from discovery to evaluation to purchasing and aquiring

47
Q

RFP

A

Request for proposal - a request to vendors designed to solve a business problem and security requirements

48
Q

Vendor management

A

Developing and monitoring vendor activity and governance of SLA

49
Q

Steps to becoming compliant ?

A
  1. Find out laws that govern your business (SOX HIPPA or GLBA etc)
  2. Determine security framework to match the laws (ISO 27001,COSO, etc)
  3. Choose a risk methodology (ISO 27005, OCTAVE)
  4. Choose a control method (CoBit, NIST 800-53)
  5. Implement and comply to standards
50
Q

GRC

A

Governance Risk Compliance is the three key things that must be accounted for in a business in regard to business health

51
Q

KPI

A

Key performance indicator - each of the GRC can be audited for key points, these are the KPI

52
Q

What is the difference between incident and event?

A

Event is a single documented occurrence if an issue and an incident is a series of events

53
Q

What is the purpose of an incident response team?

A

To follow the incident response policy and know exactly what to do when

54
Q

Incident management

A

What proactive and reactive steps can be instituted to improve the incident handling?

55
Q

what are the 6 steps to incident response?

A 
Triage
Investigation
Containment
Analysis
Tracking
Recovery
56
Q

Computer forensics

A

Used to discover digital evidence from the network and computer crime scene

57
Q

What is the key steps to ensure a system does not lose forensic information?

A

Unplug network
Dump ram to disk
Power off
Clone disk

58
Q

IOCE/SWDGE

A

Standardization of computer forensics

59
Q

MOM did it

A

Motive - who? why?
Opportunity - where? When?
Means - knowledge and capability to commit the crime

60
Q

Modes operandi

A

MO.. A computer hackers habits, call sign, signature or anything to link

61
Q

What are some tools to use to make sure to properly copy a drive?

A

Encase, FTK Imager, -dd unix

62
Q

Primary and working image

A

Primary image is stored in a library

Working image is used for analysis

63
Q

Chain of custody

A

Who has touched the evidence and what was done, precisely, to it since the crime

64
Q

Logs hearsay

A

Logs will be viewed as heresay unless they are collected on a regular basis by the business before hand

65
Q

Primary vs secondary vs direct evidence

A

Primary is most reliable and verifiable
Secondary is tamper able yet valid, like verbal or document copies
Direct evidence relies on nothing else to support it

66
Q

Corroboration

A

The necessity to combine evidence to make a point

67
Q

Enticement vs entrapment

A

Enticement is the desire to do something illegal

Entrapment is making them do something illegal by tricking them

68
Q

Salami attack

A

If I take 5c from 50,000 bank accounts I could make 30,000 more a year

69
Q

Data diddling

A

It was just an extra 0.. I fixed it by moving the extra !

70
Q

Password sniffing

A

I can find your password if I just got to .shadow file and find your reverse hash!

71
Q

IP spoofing

A

It wasn’t me, I have a different IP

72
Q

Dumpster diving

A

You know how you don’t shred anything? Hmm.

73
Q

Wiretap

A

You really wanted to hear that conversation with grandma didn’t you?

74
Q

Cyber squatting

A

Not illegal but generally requires legal entities to resolve. A.com will cost 1 million dollars

75
Q

Where can I find the cissp code of ethics?

A

www.isc2.org

76
Q

Computer ethics foundation

A

Wrote Ten Commandments of computer ethics

77
Q

Internet architecture board

A

Internet engineering and top level architect responsible for the health of the Internet based on ethics in RFC 1087

78
Q

Federal sentencing guidelines for organizations

A

Federal code of ethics used for modifying sentencing

CISSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions