Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IT Management > Information Security Legal and Regulatory Issues > Flashcards

Information Security Legal and Regulatory Issues Flashcards

1
Q

What is intellectual propery and how can it be protected?

A
  • intangible assets created through intellectual efforts
  • can be protected through:
    • Patent
    • Trademark
    • Copyright
    • Trade Secret
    • Licensing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Describe Patent

A
  • form of legal protection granted to inventors for their inventions or discoveries
  • provides exclusive rights to the inventor for a limited period, typically 20 years from the date of filing, to prevent others from making, using, selling, or importing the patented invention without permission
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Describe Trademark

A
  • recognizable sign, symbol, design, word, phrase, logo or combination thereof that distinguishes goods or services of one business from those of others
  • serves as an identifier of the source of the goods or services and helps build brand recognition and customer trust
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Describe Copyright

A
  • legal protection granted to authors, artists, musicians, and creators of original works
  • automatically applies upon creation of an original work in a fixed tangible form, such as literature, music, software, paintings, photographs, or films
  • duration of copyright protection varies depending on the country, but in general, it lasts for the lifetime of the author plus a certain number of years after their death
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Describe Trade Secret

A
  • confidential and valuable business information that is absolutely critical to the business, as it provides a competitive advantage to its owner
  • can include formulas, recipes, manufacturing processes, customer lists, marketing strategies, or any other information that is not generally known or readily accessible to others
  • unlike patents or trademarks, trade secrets are not publicly disclosed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Describe Licensing

A
  • granting of rights to use, distribute, or modify software according to the terms outlined in a software license agreement
  • define the terms of use, such as the number of installations, permitted usage, limitations, support provisions, and restrictions on copying or modification
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the 4 types of licensing?

A
  1. Contractual License
  2. Shrink-Wrap License
  3. Click-Through License
  4. Cloud Services License
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Describe Contractual License

A
  • software licensing agreement that is negotiated and agreed upon through a formal contract between the software vendor and the user or organization
  • the terms and conditions of the license, including usage rights, limitations, and fees, are outlined in the contract
  • typically used for custom software solutions or specialized software tailored to specific business needs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Describe Shrink-Wrap License

A
  • type of software license that is packaged with the software product and is presented to the user upon opening the shrink-wrapped package
  • typically printed inside the package or included as a separate document
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Describe Click-Through License

A
  • type of software license agreement that is presented to the user during the installation or download process of the software
  • user is required to read and accept the terms and conditions of the license agreement by clicking an “Accept” or “Agree” button before proceeding with the installation or use of the software
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Describe Cloud Services License

A
  • licensing models used for software or services delivered through cloud computing platforms
  • typically outline the usage rights, data ownership, service level agreements (SLAs), and any restrictions or limitations on the use of the cloud services
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are Import and Export Controls?

A

regulations and measures imposed by governments to manage the cross-border movement of goods, services, technologies, and information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the Purpose of Import and Export Controls? (3)

A
  • National Security
  • Non-Proliferation
  • Economic Interests
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What might be the regulated items for import/export?

A
  • physical goods, software, technologies, technical data, encryption devices, or cryptographic materials
  • may also cover the transfer of services, such as consulting or technical assistance, related to controlled items
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are Dual-Use Technologies?

A

goods, software, or technologies that have both civilian and military applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Wassenaar Arrangement?

A

international export control regime that focuses on the non-proliferation of conventional arms and dual-use goods and technologies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does Wassenaar Arrangement cover?

A

covers a wide range of items, including firearms, military equipment, and certain dual-use goods and technologies that have both civilian and military applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the impact of Wassenaar Arrangement on information security?

A

may require security professionals to be aware of and comply with export control regulations when dealing with certain software, encryption technologies, intrusion software, or other technologies that could have military or security implications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Data Privacy is protection of what?

A
  • Personal Information (PI)
  • Personally Identifiable Information (PII)
  • Protected Health Information (PHI)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Personal Information (PI)?

A
  • any information that can identify an individual, either directly or indirectly
  • can be sensitive and must be protected to maintain individuals’ privacy and prevent unauthorized use or disclosure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the key distinction between Personal Information (PI) and Personally Identifiable Information (PII)?

A
  • ambiguity and direct identification
  • PII directly and unambiguously identifies an individual, whereas PI may require some additional effort, context, or data correlation to link the information to a specific person
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is Personally Identifiable Information (PII)?

A
  • specifically refers to information that can be used to identify an individual
  • protecting PII is crucial to prevent identity theft, fraud, and unauthorized access to individuals’ personal data
  • subset of Personal Information
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Protected Health Information (PHI)?

A
  • individually identifiable health information that is created, received, stored, or transmitted by healthcare providers, health plans, or healthcare clearinghouses
  • includes personal details related to an individual’s physical or mental health, healthcare services received, medical history
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is Right to be Forgotten?

A
  • individual’s right to request the removal or deletion of their personal data from online platforms or search engine results
  • individuals have the right to have their personal data erased, made inaccessible, or no longer linked to their identity when certain conditions are met
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is Transborder Data Flow?

A
  • movement or transfer of personal data across national borders or jurisdictional boundaries
  • data privacy laws and regulations often impose restrictions and requirements on such cross-border data transfers to ensure the protection and privacy of individuals’ personal information
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Transborder Data Flow has legal constraints over where data can be what?

A
  • processed
  • stored
  • accessed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the different typs of law?

A
  • Criminal Law
  • Common Law
  • Civil (Statutory) Law
  • Administrative Law
  • Customary Law
  • Religious Law
  • Maritime Law
  • Contract and Tort Law
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What’s Criminal Law?

A
  • contains prohibitions against acts such as murder, assault, robbery and arson
  • crime against society as a whole
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What’s Common Law?

A
  • based on legal precedents, or decisions made by judges in previous cases
  • originated in England and expanded through the British Empire and later to countries influenced by English legal traditions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the primary sources of common law?

A
  • primary sources of common law are court decisions (case law) and legal customs
  • judicial decisions are considered binding on future cases with similar facts or legal issues, creating a doctrine of stare decisis (to stand by things decided)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is Civil (Statutory) Law?

A
  • based on codified legal systems that rely on comprehensive written codes of law enacted by legislatures
  • traces its roots back to ancient Rome and continental Europe
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is the role of courts in Civil Law?

A
  • courts in civil law systems play a narrower role compared to common law systems
  • they primarily interpret and apply legislation rather than establishing legal principles through case law
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is Customary Law?

A

also known as traditional or indigenous law, is a legal system based on customs, traditions, and practices of specific communities or groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What’s Administrative Law?

A
  • branch of law that governs the activities and operations of administrative agencies, regulatory bodies, and government departments
  • establishes the legal framework for the functioning of administrative bodies and the relationship between these agencies and the public
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What’s Maritime Law?

A

specialized branch of law that governs legal matters and activities related to navigation, shipping, maritime commerce, and marine affairs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What’s Contract Law?

A
  • deals with agreements between parties that create legally enforceable obligations
  • governs the creation, interpretation, performance, and breach of contracts
  • provides remedies and legal recourse if one party fails to fulfill their contractual obligations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What’s Tort Law?

A
  • deals with civil wrongs that cause harm or injury to individuals or their property
  • unlike contract law, tort law does not require a pre-existing agreement between parties
  • aims to compensate the injured party for the harm suffered and may also serve as a deterrent to prevent similar wrongful conduct in the future
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What’s Copyright and the Digital Millennium Copyright Act?

A

covers literary, musical and dramatic works

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What does GDPR mean?

A

General Data Protection Regulations

40
Q

What’s the goal of GDPR?

A

aims to protect the privacy and rights of individuals within the EU and governs the processing and handling of personal data

41
Q

What’s the Scope and Territorial Application of GDPR?

A
  • applies to organizations that process personal data of individuals residing in the EU, regardless of where the organization is located
  • has extraterritorial reach and can impact organizations globally
42
Q

Who are data controllers in GDPR?

A

entities that determine the purposes and means of processing

43
Q

Who are data processors in GDPR?

A

entities that process data on behalf of the controller

44
Q

What does a business need to obtain from a subject before processing their data?

A

consent

45
Q

What is Data Protection Officer (DPO)?

A

some organizations are required to appoint a Data Protection Officer, responsible for overseeing GDPR compliance, data protection impact assessments, and acting as a point of contact for individuals and supervisory authorities

46
Q

How is the Data Breach Notification defined under GDPR?

A
  • organizations are required to notify the relevant supervisory authority without undue delay, and where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals
  • notification should include details of the breach, its impact, and any mitigating measures taken
47
Q

What are the penalties for lower-level infringements under GDPR?

A

up to €10 million or 2% of global annual turnover for lower-level infringements

48
Q

What are the penalties for more severe infringements under GDPR?

A

up to €20 million or 4% of global annual turnover for more severe infringements

49
Q

What’s the point of Health Information Technology for Economic and Clinical Health (HITECH)?

A
  • adoption and meaningful use of health information technology (IT) and the security of electronic health records (EHRs)
  • strenghtening the privacy and security provisions of HIPAA by introducing new provisions
  • introducing mandatory breach notification requirements for covered entities and business associates
50
Q

What’s the point of Communications Assistance for Law Enforcement Act (CALEA)?

A

ensure that telecommunications service providers have the necessary technical capabilities to comply with authorized law enforcement surveillance requests

51
Q

What’s a cyber crime?

A

crime committed against a computer

52
Q

What are the stages of Evidence Lifecycle and how should it be protected in each step?

A
  • identification
    • as soon as possible, capture everything that is available at the time when the investigation starts
  • seizure
    • once evidence is seized, it’s documented and chain of custody process is triggered
  • transportation
    • evidence and integrity cannot be altered during the transportation process
  • analysis
    • needs to analyze what’s there rather than what the investigators want to find
  • storage
    • evidence needs to be properly protected and stored right until the day it’s returned to its rightful owner or destroyed
53
Q

What is addressed by the Civil Law?

A
  • contract disputes, real estate transactions, employment, estate and probate
  • monetary disputes
54
Q

Federal Sentencing Guidelines outlined three burdens of proof for negligence. What are they?

A
  1. person accused of negligence must have a legally recognized obligation
  2. person must have failed to comply with recognized standards
  3. there must be a causal relationship between the act of negligence and the subsequent damages
55
Q

What’s Economic Espionage Act of 1996?

A
  • changed the legal definition of theft so that it was no longer restricted by physical constraints
  • made theft of proprietary economic information an act of espionage
  • defines the term “economic espionage” as the theft or misappropriation of a trade secret with the intent or knowledge that the offense will benefit any foreign government, foreign instrumentality or foreign agent
56
Q

What does ITAR stand for?

A

International Traffic in Arms Regulations (ITAR)

57
Q

What’s International Traffic in Arms Regulations (ITAR)?

A
  • controls the export of items that are specifically designed as military and defense items
  • govern export of sensitive hardware and software products to other nations
58
Q

What does EAR stand for?

A

Export Administration Regulations

59
Q

What’s Export Administration Regulations (EAR)?

A
  • covers a broader set of items that are designed for commercial use, but may have military applications
  • govern export of sensitive hardware and software products to other nations
60
Q

What’s Payment Card Industry Data Security Standard?

A
  • widely accepted set of policies and procedures intended to optimize the security of credit, debit and cash card transactions
  • created jointly in 2004 by 4 major credit-card companies - Visa, MasterCard, Discover and American Express
61
Q

What are the 6 major objectives Payment Card Industry Data Security Standard is based on?

A
  1. a secure network must be maintained in which transactions can be conducted
  2. cardholder information must be protected wherever it is stored
  3. systems should be protected against the activities of malicious hackers
  4. cardholder data should be protected physically as well as electronically
  5. networks must be constantly monitored and regularly tested
  6. a formal information security policy must be defined, maintained and followed
62
Q

What’s European Union Privacy Law?

A
  • directive outlining privacy measures required for protecting personal data processed by information systems
  • organizations based outside Europe must consider the applicability of these rules
63
Q

What is Privacy Shield?

A
  • agreement between the EU and US outlining seven requirements for the processing of personal information
  • allows the Department of Commerce and Federal Trade Commission (FTC) to certify businesses that comply with regulations
64
Q

Who does FISMA apply to?

A

government agencies and contractors

65
Q

What does the Code of Federal Regulations (CFR) contain?

A

text of all administrative laws promulgated by federal agencies

66
Q

When are non-compete or non-disclosure agreements usually signed?

A

in the beginning of a contract

67
Q

Who does Federal Code of Ethics apply to?

A

only to federal employees

68
Q

What’s RFC 1087?

A

provide code of ethics for the internet - not binding

69
Q

What are some of the methods associated
with the DRM solutions?

A
  • DRM License
    • grants access to a product and defines the terms of use
    • typically a small file that includes the terms of use and decryption key that unlocks the access to the product
  • Persistent Online Authentication (Always-On DRM)
    • requires system to be connected to the internet to be able to use it
    • if connection to the authentication server fails or authentication fails, user is prevented from using the product
  • Continuous Audit Trail
    • tracks all use of copyrighted product
    • can detect abuse, such as concurrent use
  • Automatic Expiration
    • automatic expiration block access to content if the paid period expires
69
Q

If there’s a need to exchange customer information between a company located in the US with a company located in EU, what’s the best method to ensure GDPR compliance for such transfer?

A
  • standard contractual clauses
  • if data shared internally within company, binding corporate rules would be appropriate
70
Q

Management believes that employee engaged in unauthorized use of computing resources for a side business. What is the burden of proof that must be met in this investigation?

A

there is no standard

71
Q

What is the standard of proof for a criminal investigation?

A

beyond a reasonable doubt

72
Q

What’s Best Evidence?

A
  • form of documentary evidence
  • original document rather than a copy or description
73
Q

Francine is a security specialist for an online service provider in the United States. She recently received a claim from a copyright holder that a user is storing information on her service that violates the third party’s copyright. What law governs the actions that Francine must take?

A

Digital Millenium Copyright Act

74
Q

What’s the hearsay rule?

A

witness cannot testify about what someone else told them, except under very specific exceptions

75
Q

What’s sworn affidavit?

A

written statement or declaration made by an individual under oath or affirmation, confirming that the information provided in the statement is true and accurate to the best of their knowledge and belief

76
Q

What’s the best evidence rule?

A

copies of documents may not be submitted into evidence if the originals are available

77
Q

Is there a testimonial evidence rule?

A

no

78
Q

What evidentiary standard is required for civil cases?

A

preponderance of evidence

79
Q

Which one of the intellectual property protection mechanisms has the shortest duration in the United States?

A

patent

80
Q

What are operational investigations?

A

performed by internal teams to troubleshoot performance or other technical issues

81
Q

Which one of the investigation types has the loosest standards for the collection and preservation of information?

A

operational investigation

82
Q

What’s required by California Online Privacy Protection Act if commercial web service collects personal information from California residents?

A

requires that commercial websites that collect personal information from users in California conspicuously post a privacy policy

83
Q

What symbol is used to represent copyright?

A

©

84
Q

Once trademark application is approved, it becomes a registered trademark. What is the symbol used for registered trademarks?

A

®

85
Q

Until trademark registration is granted, what symbol is used for the protected asset?

A

™

86
Q

If there are 2 people holding the same copyright, when does it cease to exist, if one of them dies?

A

copyright protection generally lasts for 70 years after the death of the last surviving author of the work

87
Q

Does patent protection apply to mathematical algorithms?

A

no

88
Q

When does patent protection kick in and for how long?

A

U.S. patent law provides for an exclusivity period of 20 years beginning at the time a utility patent application is submitted to the Patent and Trademark Office

89
Q

What step of the Electronic Discovery Reference Model ensures that information that may be subject to discovery is not altered?

A

Preservation

90
Q

What type of evidence are the server logs?

A

documentary evidence

91
Q

When conducting an internal investigation, what is the most common source of evidence?

A

voluntary surrender

92
Q

What’s Interconnection Security Agreement (ISA)?

A

formal declaration of the security stance, risks, and technical requirements of a link between two organizations’ IT infrastructures

93
Q

What’s the goal of Interconnection Security Agreement (ISA)?

A

define the expectations and responsibilities of maintaining security over a communications path between two networks

94
Q

What’s memorandum of understanding (MOU) or memorandum of agreement (MOA) ?

A
  • expression of agreement or aligned intent, will, or purpose between two entities
  • not typically a legal agreement or commitment but rather a more formal form of a reciprocal agreement or handshake
95
Q

What concept from the Federal Rules of Civil Procedure (FCRP) helps to ensure that additional time and expense are not incurred as part of electronic discovery when the benefits do not outweigh the costs?

A

proportionality

IT Management (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions