Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

My Notes of CISSP CBK > Chapter 9 - Legal Regulations, Investigations, & Compliance > Flashcards

Chapter 9 - Legal Regulations, Investigations, & Compliance Flashcards

1
Q

Where does the greatest risk of cybercrime come from? A. Outsiders B. Nation-states C. Insiders D. Script kiddies

A

C. Insiders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the largest hindrance to fighting computer crime? A. Computer criminals are generally smarter than computer investigators B. Adequate funding to stay ahead of the computer criminals C. Activity associated with computer crime is truly international D. There are so many more computer criminals than investigators that it is impossible to keep up

A

C. Activity associated with computer crime is truly international

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Computer forensics is the marriage of computer science, information technology, and engineering with … A. Law B. Information Systems C. Analytical thought D. The scientific method

A

A. Law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What principal allows an investigator to identify aspects of the person responsible for a crime when, whenever committing a crime, the perpetrator leaves residual traces while stealing information? A. Meyer’s principal of legal impunity B. Criminalistic principals C. IOCE/Group of 8 Nations prinicpals for computer forensics D. Locard’s principle of exchange

A

D. Locard’s principle of exchange

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which of the following is part of the 5 rules of evidence? A. Be authentic, be redundant, and be admissable B. Be complete, be authentic, and be admissable C. Be complete, be redundant, and be authentic D. Be redundant, be admissable, and be complete

A

B. Be complete, be authentic, and be admissable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is not mentioned as a phase of an incident report? A. Documentation B. Prosecution C. Containment D. Investigation

A

B. Prosecution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which best emphasizes the abstract concept of law and is influenced by the writings of legal scholars and academics? A. Criminal Law B. Civil Law C. Religious Law D. Administrative Law

A

B. Civil Law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which type of intellectual property covers the expression of ideas rather than the ideas themselves? A. Trademark B. Patent C. Copyright D. Trade Secret

A

B. Copyright

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which type of intellectual property protects the goodwill a merchant or vendor invests in its products? A. Trademark B. Patent C. Copyright D. Trade Secret

A

A. Trademark

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which of the following are computer forensic guidelines? A. IOCE, MOM, SWGDE B. MOM, SWGDE and IOCE C. IOCE, SWGDE amd ACPO D. ACPO, MOM and IOCE

A

C. IOCE, SWGDE and ACPO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which of the following are categories of software licensing? A. Freeware, Open Source, and Commercial B. Commercial, Academic, and Open Source C. Academic, Freeware and Open Source D. Freeware, Commercial and Academic

A

D. Freeware, Commercial, Academic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the rights and obligations of individuals and organizations with respect to the collection, use, retaintion, and disclosure of personal information BEST related to? A. Privacy B. Secrecy C. Availability D. Reliability

A

A. Privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Triage encompasses which of the following incident response subphases? A. Collection, transport, testimony B. Tracebacl, feedback, loopback C. Detection, identification, notification D. Confidentiality, itegrity, availabiliyt

A

C. Detection, identification, notification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The integrity of a forensic bit stream image is determined by: A. Comapring hash totals to the original source B. Keeping good notes C. Taking pictures D. Encrypted keys

A

A. Comparing hash totals to the original source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

When dealing with digital evidence,the crime scene A. Must never be altered B. Must be completely reproducible in a court of law C. Must exist only in one country D. Must have the least amount of contamination that is possible

A

D. Must have the least amount of contamination as possible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

When outsourcing IT systems A. All regulatory and compliance requirements must be passed on to the provider B. the outsourcing organization is free from compliance obligations C. the outsourced IT systems are free from from compliance obligations D. the provider is free from compliance obligations

A

A. All regulatory and compliance requirements must be passed on to the provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The (ISC)2 code of ethics resolves conflicts between canons by A. there can never be conflicts between canons B. working through adjudication C. the order of the canons D. vetting all canon conflicts through the coard of directors

A

C. the order of the canons

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

When dealing with digital evidence, the crime scene A. Must never be altered B. Must be completely reproducible in a court of law C. Must exist only in one country D. Must have the least amount of contamination that is possible

A

D. Must have the least amount of contamination as possible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

To ensure proper forensics action when needed, - an incident response progam should … A. Avoid conflicts of interests by ensuring organization legal council is not part of the process B. Routinely create forensic images of all desktops and servers C. Only promote dlosed incidents to law enforcement D. Treat every incident a though it may be a crime

A

D.Treat every incident as though it may be a crime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A hard drive is recovered from a submerged vehicle. The drive is needed for a court case. What is the best approach to pull information off the drive? A. Wait for the drive to dry and then install it is a desktop and attemp to retrieve the information via normal operating system commands B. Place the drive in a forensic oven to dry it and then use a degausser to remove any residual humidity prior to installing the drive in a laptop and using the OS to pull off the information C. While the drive is still wet use a forensic bit to bit copy program to ensure the drive is preserved in its “native” state D. Contact a professional data recovery organization, explain the situation and request they pull a forensic image

A

D. Contact a professional data recovery organization, explain the situation and request they pull a forensic image

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Common Law

A

Based on legal precedents, past decisions, an societal traditions - judges not actively involved in the determination of facts - common law now relies on statutes and regulations: Crimimal, Tort and Administrative. Criminal - harmful to public; tort - against individual or business (origin - criminal law); administrative - artifact of Anglo-American common law lega system = governance of public bodies - proper scope

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Civil Law

A

Roman Empire, Napolean-Code of France 1804-thought to be a codification of law, reliance on legislation over jurisprudence - this is not accurate in all places. Emphasizes abstract concepts, influenced by writings legal scholars and academics, judges distinct from lawyers and play a more active role.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Customary Law

A

Reflect’s scoeity’s norms and values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Religious Law

A

Discover truth of law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Mixed Law

A

Convergence of two or more legal systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Liability

A

Legally responsible - negligence is acting without care or failure to act as a reasonable person

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Computer Crime

A

As a tool, as a target (viruses, digital identity theft, computer hacking), or incidental. Greatest risk comes from the inside.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Council of Europe (COE) Convention on Cyber crime -

A

Attempt to respond to criminal behaviors, 30 countries - laws against child porn, ability to prosecute cybercrime, provide international cooperation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Licensing & Intellectual Property

A

Laws - protect tangible and intangible items.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Industrial property

A

Inventions, trademarks, industrial designs and geographic indications of source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Copyright

A

Literary and artistic work; expression of ideas - minimum 50 years (covered under Berne Convention)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Trademark

A

Good will invested - word, name, symbol, color, sound, product shape, device or a combination to identify goods - registered with government registrar WIPO (UN Agency) manages.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Patent (strongest)

A

Exclude others from practicing invention for a specific time - usually 20 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Trade Secret

A

not generally known and provides economic benefit, reasonable steps to protect secrecy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Licensing Issues

A

42% worldwide - for every $2 in software legally purchased, $1 pirated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Master agreements

A

General overall condidtions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

End-user licensing

A

More granular conditions and restrictions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Import/Export

A

Maybe illegal to import software - e.g. encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Transborder Data Flow

A

Developed in one country, transmitted through another, and stored in a third - latter can gain jurisdiction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Privacy

A

Organization of Economic Cooperation and Development (OECD): Collection limiation; Data quality; Purpose specification; Use limitation; Security safeguards; Openness; Individual participation; and Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Employee Monitoring and Surveillance

A

Europe’s Directive in Data Protection: Notice - types of 3rd parties or other uses; Choice - Must be explicit with use - opt out of third party; Onward Transfer - written agreement with third party to adhere to same level of privacy protection; Security - loss, misues, unauthorized access, disclosure, alteration, and destruction protection; Data Integrity - reliable; Access - individual access; Enforcement - complaints investigated, damages awarded

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Cybernetics

A

Science of information feedback systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Walter Maner coined

A

“Computer Ethics”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Regulatory requirement

A

Miminal ethic standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

1991 US Federal Sentencing Guidelines for Organizations

A

Outlines minimal ethical requirements; provides reduced penalties if ethics programs are in place. Leader must be knowledeable about content and operation of program, exercise due diligence, promote ethical culture; Needs 3 sections: purpose of program, 7 minimum requirements, periodically assess.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

U.S. Sarbanes-Oxley Act

A

Accounting refore, attest to accuracy of financial reporting documents: Section 103 - Auditing, Quality, Control and Independence - register pulic accounting firms, establish audit and quality control ethics; New Item 406(a) - Regulation S-K companies disclose - written code of ethics applied to senior officers, any waivers to above, changes to code, and if no code of ethics explain why not.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Computers in the Workplace

A

How they impact health and job satisfaction, computer crime, privacy and anonymity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Debate on Intellectual Property

A

Free or get money for development efforts?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Professional Responsibility and Globalization

A

Gloabal laws, business, education, information flows, rich & poor nations, and interpretation

50
Q

Computer Game Fallacy

A

Computers work with exacting accuracy; if computer allows it, it must be permissable

51
Q

Law-abiding Citizen Fallacy

A

Laws and reasonable behavior - some users do not realize ramifications of actions

52
Q

Shatter Proof Fallacy

A

What a person does with computer can do minimal harm - not considering impact of actions

53
Q

Candy from a baby Fallacy

A

Easy doesn’t make it right

54
Q

Hacker Fallacy

A

Acceptable to do anything as long as motivation isto learn and not profit

55
Q

Free information fallacy

A

Information wants to be free - emerged from so easy to ccopy

56
Q

Hacker

A

Originally a person who sought to understood - soon it became associated with Phreaking

57
Q

Stephen Levy - Hacker Ethic

A
  • Access to compters unlimited - all information free - authority shold be mistrusted & decetralization promoted - hackers should be judeged solely on hacking skills - computers can create art and beauty - computer can change life for the better
58
Q

3 main hacker functions

A

-promote belief of individual activity -support free market approach to exchange of information -promote belief that computers can have a beneficial and life changing effect

59
Q

Code of Fair Information Practices

A

Similar to: Organization of Economic Cooperation and Development (OECD): Collection limiation; Data quality; Purpose specification; Use limitation; Security safeguards; Openness; Individual participation; and Accountability

60
Q

Internet Architecture Board (IAB) and RFC 1087

A

Unethical to: -gain unathorized access -disrupt intended use of internet -waste resources -destroy integirty of computer-based information -compromise privacy of users

61
Q

Computer Ethics Institute - 10 commandments

A
  1. Thou shall not use a computer to harm other people 2. Thou shall not interfere with other people’s computer work 3. Thou shall not snoop around in other people’s computer files 4. Thou shall not use a computer to steal 5. Thou shall not use a computer to bear false witness 6. Thou shall not copy or use propreitary software for which you have not paid 7. Thou shall not use other people’s computer resources without authorization or proper compensation 8. Thou shall not appropriate other people’s intellectual output 9. Thou shalt think about the social consequences of the program you are writing or the system you are designing 10. Thou shalt always use a computer in ways that insure consideration and respect for you fellow humans
62
Q

National Conference on Computing Values

A
  1. Preserve public trust and confidence in computers 2. Enforce fair information practices 3. Protect the legitimate interests of the constituents of the system 4. Resist fraud, waste, and abuse
63
Q

Working Group on Computer Ethics - End User’s Basic Tenets

A
  1. I understand that just because something is legal, it isn’t necessary moral or right. 2. I understand that people are the ones hurt when computers are used unethically. The fact that computers exist between me and those harmed does not change moral responsibility toward my fellow human 3. I will respect the rights of authors - just because copying is easy, it is not necessarily right 4. I will not break into other people’s computers or read their information 5. I will not write, acquire or distribute harmful software
64
Q

National Computer Ethics and Responsiblities Campaign (NCERC)

A

Foster computer ethics awareness and education

65
Q

(ISC)2 Code of Professional Ethics

A

Professionals resolve conflicts between the canons in the order of the canons. Preamble - adhere to the code Canons: - Protect society, Common Wealth, & Infrastructure - Act honorably, honestly, justly, responsibly, legally - Provide diligent and competent service to principals -Advance and protect the profession

66
Q

Peter Tippett’s Action Plan to instill ethical computer culture

A
  1. Develop guide to computer ethics 2. Develop policy to computer ethics 3. Add information to employee handbook 4. Expand business ethics policy 5. Learn about it 6. Foster awareness 7. E-mail privacy policy 8. Make sure employees know policy
67
Q

Golden Rule (Grupe, Garcia-Jay, Kuechler)

A

Treat others as you would like to be treated

68
Q

Kant’s Categorical Imperitive (Grupe, Garcia-Jay, Kuechler)

A

Action not right for everyone, not right for anyone

69
Q

Descartes’ Rule of change (Grupe, Garcia-Jay, Kuechler)

A

Action not repeatable at all times, not right at any time

70
Q

Utilitarian Principle (Grupe, Garcia-Jay, Kuechler)

A

Take action that achieves the greatest good

71
Q

Risk Aversion Principle (Grupe, Garcia-Jay, Kuechler)

A

Incure least harm or cost

72
Q

Avoid Harm (Grupe, Garcia-Jay, Kuechler)

A

Do no harm

73
Q

No Free Lunch (Grupe, Garcia-Jay, Kuechler)

A

All property and information belongs to someone

74
Q

Legalism (Grupe, Garcia-Jay, Kuechler)

A

Is it against the law?

75
Q

Professionalism (Grupe, Garcia-Jay, Kuechler)

A

Is action contrary to code of ethics?

76
Q

Evidentiary Guidance (Grupe, Garcia-Jay, Kuechler)

A

Is there evidence to support or deny the value of taking an action?

77
Q

Client Choice (Grupe, Garcia-Jay, Kuechler)

A

Let the people affected decide

78
Q

Equity (Grupe, Garcia-Jay, Kuechler)

A

Will cost and benefits be equally distributed?

79
Q

Competition (Grupe, Garcia-Jay, Kuechler)

A

Knowledge of Market - build/buy - aware of risk?

80
Q

Compassion/Last Chance (Grupe, Garcia-Jay, Kuechler)

A

Equal opportunities exist?

81
Q

Impartiality/Objectivity (Grupe, Garcia-Jay, Kuechler)

A

Are decisions biased?

82
Q

Openness/Full Disclosure (Grupe, Garcia-Jay, Kuechler)

A

Are people affected aware of system, data being collected?

83
Q

Confidentiality (Grupe, Garcia-Jay, Kuechler)

A

Protect information where need to know is not proven, security features reduces to hold down expenses

84
Q

Trustworthiness/Honesty (Grupe, Garcia-Jay, Kuechler)

A

Accountable for actions

85
Q

Michael Davis Ethics Code

A

Contract between professionals

86
Q

Donn Parker Ethical Principles

A
  1. Informed consent 2. Higher ethic in the worst case 3. Change of scale test 4. Owners’ conservation of ownership 5. Users’ conservation of ownership
87
Q

Digital Investigation

A

Methodical, verifiable, & auditable - set of procedures and practices

88
Q

Digital Forensic Science

A

Collection, Validation, identification, analysis, interpretation, documentation, and presentation of digital evidence

89
Q

International Organization of Computer Evidence

A

(IOCE)

90
Q

Scientific Working Group in Digital Evidence

A

(SWGDE)

91
Q

Association of Chief POlice Officers

A

(ACPO)

92
Q

Generic Guidelines for Forensic Evidence

A
  • Identifying Evidence - Collecting or Acquiring Evidence - Examing or Analyzing the Evidence - Presentation of Findings
93
Q

Crime Scene

A

Indentify the scene, protect the environment, identify evidence and potential sources of evidence, collect evidence, and minimize the degree of contamination - both physical (servers) and virtual (Data)

94
Q

Locard’s Principle of Exchange

A

When a crime is committed the perpetrators leave something behind and take something with them

95
Q

MOM

A

Means, Motive and Opportunity

96
Q

MO

A

Modus of operandi - method of operation

97
Q

Incident Response

A

Identifying root cause correctly and quickly is extremely important

98
Q

General Guidelines for Investigation

A
  • All general forensic principles apply also with digital evidence - actions should not change the evidence - person should be trained to access original digital evidence - all activity relating to seizure, access, storage, or transfer must be documented, preserved and available for review - individual is responsible for all actions while digital evidence is in his possession - agency that is responsible for seizing, accessing, storing, or transferring digital evidence is responsible for compliance with these principles
99
Q

Advice for any form of incident response

A

Act ethically, in good faith, attempt to do no harm, and do not exceed one’s knowledge, skills and abilities

100
Q

Rule of Thumb for Investigator’s Methodology

A
  • Minimize handling/corruption of original data - Account for any changes and keep logs - Comply with 5 rules of evidence - Don’t exceed knowledge - Follow your local security policy and obtain written permission - Capture as accurate an image of the system as possible - Be prepared to testify - Ensure your actions are repeatable - Work fast - Proceed from volatile to persistent evidence - Do not run any programs on the affected system
101
Q

Framework for Incident Handling

A
  • Creation of a Response Capability - Incident Response & HAndling - Recovery & Feedback
102
Q

CERT/CC - Computer Emergency Response Team Coordination Center at Carnegie Melon

A

Incident handling model is circular and feeds back into itself - can be broken down into triage, investigation, containment, and analysis and tracking.

103
Q

Triage Phase

A

Encompasses detection, identification and notification. False positives are one of the most time consuming aspects of information security. If not a false positive then the next step is to classify the type of incident then down to more specific and granular characteristics - this determines the level of potential risk/criticality and to determine notifications required.

104
Q

Investigative Phase

A

Analysis, interpretation, reaction, and recovery from an incident. Desired outcome is to reduce impact, identify root cause, get back up and running and prevent a reoccurrence.

105
Q

Containment

A

Reduce the number of other systems and devices that can become affected. Proper documentation must be maintained.

106
Q

Analysis and Tracking

A

Focus on determining root cause - look at initial event, not just the symptoms. Attempt to determin source and point of entry. Ability to read and parse through large log files.

107
Q

Recovery Phase

A

Get system back up and running. Also, so it can withstand another directed incident. Before putting back it should be tested for vulnerabilities and weaknesses.

108
Q

Chain of Custody

A

who, what, when, where, and how the evidence was handled from identification through its entire life cycle which ends with destruction or permanent archiving.

109
Q

Ensuirng authenticity and integrity of evidence is critical.

A

Currently relies on hash functions that create unique numberical signatures that are sensitive to any bit changes, e.g. SHA-256

110
Q

Interviewing

A

An art and science - only properly trained individuals. Investigator can be charged if violations of policy, law or constituional rights are violated. Do not conduct alone and video tape if possible. Legal counsel should be present.

111
Q

End of Incident Phase

A

Should not end without debriefing and feedback - metric data can start being built as well.

112
Q

Five rules of evidence

A
  • Be authentic - Be accurate - Be complete - Be convincing - Be admissable
113
Q

Media analysis

A

recovery of information for hard drvise, DVDs, CD-ROMs or portable memory devices

114
Q

Network Analysis

A

Coined by Markus Ranum. Data from network logs and network activity

115
Q

Software Analysis

A

anaysis and examination of program code

116
Q

Author identification

A

unique style and eccentricities

117
Q

Content analysis

A

Finding purpose of the code

118
Q

Context analysis

A

develop meta view of the impact of the suspicious software

119
Q

US National Institute of Standards for hardware/embedded devices

A
  • no actions performed by investigators should change data contained on digital devices or storage media - individuals accessing original data must be competent to do so and have the ability to explain their actions - an audit trail or other record of applied processes, suitable for independent third party review, must be created and preserved, accurately documenting each investigative step - the person in charge of the investigation has overall responsibility for ensuring the above mentioned procedures are followed in compliance with governing laws - upon seizing digital evidence, actions taken should not change that evidence - when it is necessary for a person to access original digital evidence, that person must be forensically competent -all activity relating to the seizure, access, storage, or transfer of digital evidence must be full documented, preserved, and available for review - an individual is responsible for all actions taken with respect to digital evidence while the digital evidence is in their possession
120
Q

Health Insurance Portablity and Accontability Act (HIPPA)

A

Law reuires organizations to comply with reporting information security breaches and several other controls - failure to comply mean fines for an organization

121
Q

Federal Information Security Management Act (FISMA)

A

Requires agencies to self-audit and have an independent auditor review their security implementation annually

My Notes of CISSP CBK (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions