Compliance Flashcards
Law
Law is a system of rules created by either government or a society, recognized as binding by the group, and enforced by some specific authority
Regulation
By contrast, are written rules dealing with specific details of procedures, issued by an executive body and having the force of law.
Types of Legal System
Civil (Code ) Law
Common law
Criminal law
Civil/ Tort law
Administrative (Regulatory) law
Customary law
Religious law
Mixed law
A Computer Assisted Crime
Is where a computer was used as a tool to help carry out a crime.
Computer Targeted Crime
Concerns incidents where a computer was the victim of an attack crafted to harm it (and its owners) specifically
Computer is Incidental
Computer is not necessarily the attacker or the target, but just happened to be involved when a crime was carried out.
Engaging in Hactivitism
Which is protesting a government’s or organization’s activities by attacking its systems and/or defacing its website
Attackers commonly hop through several systems before attacking their victim so that tracking down the attackers will be more difficult. This exemplified by threat actor approach know as _____
Island-hopping attack
Island-hopping attack also known as ___
Supply Chain Attack
Three Powerful forces converged in the mild to late 1990s to catapult cybercrime, they are:
- Explosive growth in internet
- Abundance of computer experts who have lost their livelihood with the end of Soviet Union
- Increase in Software developers, ignoring security
Now a days exploited targets are known as _____
Malicious bots
Malicious Bots organized into _______
Botnets
Botnets can be used to carry out ________
DDoS attacks, transfer spam or pornography
Hackers who do not have the requisite skills to carry out specific attacks without the tools provided on the internet or through friends are known as _____
Script Kiddies
HaaS
Hacking as a Service- commercializing the hacking skills
Hackers who patiently wait for the right time to attack you is called ______
Advanced Persistent Threat (APT)
This is a military term that has been around for ages.
Group of attackers is not in a hurry to launch an attack quickly, but will wait for the most beneficial moment and attack vector to ensure that activities go unnoticed. This referee to as_______
Low-and-Slow attack
A handful of users are targeted by two phishing attacks; one user opens zero-day payload
Phishing and Zero-Day payload
The user machine is assessed remotely by a specific tool.
Back door
The attacker elevates access to important user, service, and admin accounts, and specific systems. ______ Movement
Lateral Movement
Data is acquired from target servers and staged for exfiltration
Data Gathering
Data is exfiltrated via encrypted files over HTTP to external, compromised machine at a hosting provider
Exfiltrate
Common Internet Crime Schemes
- Business e-mail compromise
- Business fraud
- Charity and disaster fraud
- Counterfeit prescription drugs
- Credit card fraud
- Election crimes and security
- Identity Theft
- Illegal Sports Betting
- Nigerian letter or “419”
- Ponzi/ Pyramid
- Ransomware
- Sextortion
The First International treaty seeking to address computer crimes
The Council of Europe (CoE) Convention on Cybercrime
The Council of Europe (CoE) Convention on Cybercrime also known as ____
The Budapest Convention.
(Creation of a framework for establishing jurisdiction and extradition of accused. This can only take place only if it is crime in both countries)
As of ________ (this date) countries around the world (not just in Europe) have signed or ratified the treaty, contributing to the global growth in effective cybercrime legislation that is internationally interoperable.
April 21, 1968
According to the United Nations (UN), how many countries in the world now have cybercrime laws.
154 Countries- 79%
Some of the U.S. laws are most relevant to data breaches
- California Consumer Privacy Act (CCPA)
- Health Insurance Profitability and Accountability Act (HIPPA)
- Health Information Technology for Economics and Clinical Health (HI-TECH) Act
- Gramm-Leach-Bliley Act of 1999
- Economic Espionage Act of 1996
Global organizations that move across borders must be aware of and follow the _______
Organization for Economic Cooperation Development (OECD)
The Principle of OECD (8)
- Collection Limitation
- Data Quality
- Purpose Verification
- Use Limitation
- Security Safeguards
- Openness
- Individual Participation
- Accountability
The European Union in many cases takes individual privacy much more seriously than most other countries in the world, so in 1995 it enacted _______
Data Protection Directive
_______ was adopted by EU in April 2016 and became enforceable in May 2018
The General Data Protection Regulation (GDPR)
GDPR is very stringent and violating them exposes an organization to a maximum fine of ______%
4%
How many entities GDPR Defines?
Three
What are (3) entities in GDPR?
- Data Subject: The individual to whom the data pertains
- Data Controller: Any Organization that collects data on EU residents
- Data Processor: Any Organization that processes data for a data controller
To ensure that data is protected, the GDPR requires that most data controllers and data processors formally designate a _______
Data Protection Officer (DPO)
DPOs are internal compliance officers that act semi-independently to ensure that their organizations follow the _________
The Letter of Regulation
Key provisions of GDPR (5)
- Consent
- Right to be informed
- Right restrict processing
- Right to be forgotten
- Data Breaches
According to GDPR; data breaches to be report within ______ hours of ______
72 hours of becoming aware of it.
How many countries have no legally mandated notification requirements whatsoever?
UN lists 62 countries
Wassenaar Arragement implements export controls for ________
Conventional Arms and Dual-Use Goods and Technologies.
Conventional Arms and Dual-Use Goods and Technologies - how many countries lays out rules
42 Countries
Wassenaar arrangements
Rules of Export Controls for the following laid up by Wassenaar arrangements. (9) Categories
- Category 1: Special Materials and Related Equipment
- Category 2: Material Processing
- Category 3: Electronics
- Category 4: Computers
- Category 5: Part1: Telecommunications
- Category 5: Part 2: information Security
- Category 6: Sensors and Lasers
- Category 7: Navigation and Avionics
- Category 8: Marine
- Category 9: Aerospace and Propulsion
The main goal of Wassenaar Agreement is to _____
Prevent the build up of military capabilities that could threaten regional and international security and stability.
In some cases, no products that contain ____________ functions can be exported to specific country.
Cryptographic functions
___________ is a movement of machine-readable data across a political boundary such as country’s border.
Transborder data flow (TDF)
Transborder Data Flow (TDF) sometimes called _________
Cross-border data flows.
Privacy Generic approach is _______ rules that stretch across all industry boundaries.
Horizontal Enactment
Regulatory by Industry is _________ Enactment
Vertical Enactment
Examples of Intellectual Property (IP) ____
Song Lyrics, Inventions, Logos, and Secret recipes
Four types of IP laws
- Trade Secrets
- Copyrights
- Trademarks
- Patents
Four important type of IP (Intellectual Property) law
Trade Secrets
Copy Rights
Trademarks
Patents
Copyright protection exists for the duration of ______
Life of the creator plus 70 years
What does the term “warez” sites means….
Warez is a term that refers to copyrighted works distributed or traded without fees or royalties, in general violation of the copyright law.
What is the Protocol warez uses
BitTorrent
Patent is the strongest form of Intellectual Property (IP)
Protection. Patent is usually up ______ years from the date of approval
20 Years
Another reason for the increase in patent litigation is emergence of nonpraticing entities (NPEs), also known as
Patent troll
Four Categories of software licensing
Freeware
Shareware or Trialware
Commercial Software
Academic Software
If your company process credit cards, then it has to comply with _________
Payment Card Industry Data Security Standard (PSI DSS)
If your Organization is financial institution that is considered part of the critical infrastructure of the United Kingdom, then it has to comply with _______
CBEST Standard
If your organization wants to sell cloud services to the U.S. government, it has to be certified by _______
Federal Risk and Authorization Management Program (FedRAMP)
Under the GPDR, you’d have 72 hours from the time of discovery, while HIPPA, you could have up to
60 Days
Due diligence and Due Care associated with which level of management
Due Diligence: Leaders, laws, and regulations
Due Care: Applicable to everyone, failure to exercise it could be used to show negligence
Responsibility generally refers_______
To the obligation and expected actions and behaviour of a particular party.
An Obligation may have _____
A defined set of actions that are required, or a more general and open approach, which enables the party to decide how it will fulfill the particular obligation.
Accountability refers____
To the ability to hold a party responsible for certain actions or inaction
Proximate cause is an__
- Act or omission that naturally and directly produces a consequence.
- It is the superficial or obvious cause for an occurrence.
- it refers to a cause that leads directly, or in an unbroken sequence, to a particular result. It can be seen as an element of negligence in a court of law.
Administrative investigation focuses on____
Policy violations
Worse case - someone get fired
LEA stands for
Law enforcement agencies
Regulatory investigations initiated by ______
Government regulator when there is a reason to believe that the organization is not in compliance
Business Software Alliance (BSA) is mainly for
Software and Piracy
The Federation Against Software Theft (FAST) and BSA promotes
The enforcement of proprietary rights of software
_________ is an act of omission that naturally and directly produces a consequence
Proximate Cause
Canadian Law that deals with Protection of person information
Personal Information Protection and Electronic Documents Act
Legal System - Rule-Based and not Precedent based
Civil (code) Law
