Legal Regulations Investigation and Compliance Flashcards
What is the standard duration of patent protection in the United States?
A) 14 years from the application date
B) 14 years from the date the patent is granted
C) 20 years from the application date
D) 20 years from the date the patent is granted
20 years from the application date
U.S. patent law provides for an exclusivity period of 20 years beginning at the time the patent application is submitted to the Patent and Trademark Office.
Why are military and intelligence attacks among the most serious computer crimes?
A) The use of information obtained can have far-reaching detrimental strategic effects on national interests in an enemy’s hands.
B) Military information is stored on secure machines, so a successful attack can be embarrassing.
C) The long-term political use of classified information can impact a country’s leadership.
D) The military and intelligence agencies have ensured that the laws protecting their information are the most severe.
The use of information obtained can have far-reaching detrimental strategic effects on national interests in an enemy’s hands.
The purpose of a military and intelligence attack is to acquire classified information. The detrimental effect of using such information could be nearly unlimited in the hands of an enemy. Attacks of this type are launched by very sophisticated attackers. It is often very difficult to ascertain what documents were successfully obtained. So when a breach of this type occurs, you sometimes cannot know the full extent of the damage.
What type of law does not require an act of Congress to implement at the federal level but rather is enacted by the executive branch in the form of regulations, policies, and procedures? A) Criminal law B) Common law C) Civil law D) Administrative law
Administrative law
Administrative laws do not require an act of the legislative branch to implement at the federal level. Administrative laws consist of the policies, procedures, and regulations promulgated by agencies of the executive branch of government. Although they do not require an act of Congress, these laws are subject to judicial review and must comply with criminal and civil laws enacted by the legislative branch.
What law protects the right of citizens to privacy by placing restrictions on the authority granted to government agencies to search private residences and facilities? A) Privacy Act B) Fourth Amendment C) Second Amendment D) Gramm-Leach-Bliley Act
Fourth Amendment
The Fourth Amendment to the U.S. Constitution sets the “probable cause” standard that law enforcement officers must follow when conducting searches and/or seizures of private property. It also states that those officers must obtain a warrant before gaining involuntary access to such property.
What would be a valid argument for not immediately removing power from a machine when an incident is discovered?
A) All of the damage has been done. Turning the machine off would not stop additional damage.
B) There is no other system that can replace this one if it is turned off.
C) Too many users are logged in and using the system.
D) Valuable evidence in memory will be lost.
Valuable evidence in memory will be lost.
The most compelling reason for not removing power from a machine is that you will lose the contents of memory. Carefully consider the pros and cons of removing power. After all is considered, it may be the best choice.
If port scanning does no damage to a system, why is it generally considered an incident?
A) All port scans indicate adversarial behavior.
B) Port scans can precede attacks that cause damage and can indicate a future attack.
C) Scanning a port damages the port.
D) Port scanning uses system resources that could be put to better uses.
Port scans can precede attacks that cause damage and can indicate a future attack.
Some port scans are normal. An unusually high volume of port scan activity can be a reconnaissance activity preceding a more dangerous attack. When you see unusual port scanning, you should always investigate.
Which of the following would not be a primary goal of a grudge attack?
A) Disclosing embarrassing personal information
B) Launching a virus on an organization’s system
C) Sending inappropriate email with a spoofed origination address of the victim organization
D) Using automated tools to scan the organization’s systems for vulnerable ports
Using automated tools to scan the organization’s systems for vulnerable ports
Any action that can harm a person or organization, either directly or through embarrassment, would be a valid goal of a grudge attack. The purpose of such an attack is to “get back” at someone.
If you need to confiscate a PC from a suspected attacker who does not work for your organization, what legal avenue is most appropriate? A) Consent agreement signed by employees B) Search warrant C) No legal avenue is necessary. D) Voluntary consent
Search warrant
In this case, you need a search warrant to confiscate equipment without giving the suspect time to destroy evidence. If the suspect worked for your organization and you had all employees sign consent agreements, you could simply confiscate the equipment.
What type of incident is characterized by obtaining an increased level of privilege? A) Compromise B) Denial of service C) Malicious code D) Scanning
Compromise
Any time an attacker exceeds their authority, the incident is classified as a system compromise. This includes valid users who exceed their authority as well as invalid users who gain access through the use of a valid user ID.
Which criminal law was the first to implement penalties for the creators of viruses, worms, and other types of malicious code that cause harm to computer system(s)?
A) Computer Security Act
B) National Infrastructure Protection Act
C) Computer Fraud and Abuse Act
D) Electronic Communications Privacy Act
Computer Fraud and Abuse Act
The Computer Fraud and Abuse Act, as amended, provides criminal and civil penalties for those individuals convicted of using viruses, worms, Trojan horses, and other types of malicious code to cause damage to computer system(s).
Matthew recently authored an innovative algorithm for solving a mathematical problem, and he wants to share it with the world. However, prior to publishing the software code in a technical journal, he wants to obtain some sort of intellectual property protection. Which type of protection is best suited to his needs? A) Copyright B) Trademark C) Patent D) Trade secret
Copyright
Copyright law is the only type of intellectual property protection available to Matthew. It covers only the specific software code that Matthew used. It does not cover the process or ideas behind the software. Trademark protection is not appropriate for this type of situation. Patent protection does not apply to mathematical algorithms. Matthew can’t seek trade secret protection because he plans to publish the algorithm in a public technical journal.
What are the primary reasons attackers engage in thrill attacks? (Choose all that apply.)
A) Bragging rights
B) Money from the sale of stolen documents
C) Pride of conquering a secure system
D) Retaliation against a person or organization
Bragging rights
Pride of conquering a secure system
Thrill attacks have no reward other than providing a boost to pride and ego. The thrill of launching the attack comes from the act of participating in the attack (and not getting caught).
What is the broadest category of computer systems protected by the Computer Fraud and Abuse Act, as amended? A) Government-owned systems B) Federal interest systems C) Systems used in interstate commerce D) Systems located in the United States
Systems used in interstate commerce
The original Computer Fraud and Abuse Act of 1984 covered only systems used by the government and financial institutions. The act was broadened in 1986 to include all federal interest systems. The Computer Abuse Amendments Act of 1994 further amended the CFAA to cover all systems that are used in interstate commerce, covering a large portion (but not all) of the computer systems in the United States.
Mary is the cofounder of Acme Widgets, a manufacturing firm. Together with her partner, Joe, she has developed a special oil that will dramatically improve the widget manufacturing process. To keep the formula secret, Mary and Joe plan to make large quantities of the oil by themselves in the plant after the other workers have left. They want to protect this formula for as long as possible. What type of intellectual property protection best suits their needs? A) Copyright B) Trademark C) Patent D) Trade secret
Trade secret
Mary and Joe should treat their oil formula as a trade secret. As long as they do not publicly disclose the formula, they can keep it a company secret indefinitely.
What type of evidence refers to written documents that are brought into court to prove a fact? A) Best evidence B) Payroll evidence C) Documentary evidence D) Testimonial evidence
Documentary evidence
Written documents brought into court to prove the facts of a case are referred to as documentary evidence.
What is the best way to recognize abnormal and suspicious behavior on your system?
A) Be aware of the newest attacks.
B) Configure your IDS to detect and report all abnormal traffic.
C) Know what your normal system activity looks like.
D) Study the activity signatures of the main types of attacks.
Know what your normal system activity looks like.
The other options are actions that can make you aware of what attacks look like and how to detect them, although you will never successfully detect most attacks until you know your system. When you know what the activity on your system looks like on a normal day, you can immediately detect any abnormal activity.
What is an incident?
A) Any active attack that causes damage to your system
B) Any violation of a code of ethics
C) Any crime (or violation of a law or regulation) that involves a computer
D) Any event that adversely affects the confidentiality, integrity, or availability of your data
Any event that adversely affects the confidentiality, integrity, or availability of your data
An incident is normally defined as any event that adversely affects the confidentiality, integrity, or availability of your data.
