Legal Regulations, Investigations and Compliance Flashcards
What is Common Law ?
- Common Law is known as Case Law.
* three types - Criminal, Civil and administrative.
What is Criminal Law ?
Criminal law defines those crimes committed against society, even when the actual victim is a business or individual(s). Criminal laws are enacted to protect the general public. As such, in the eyes of the court, the victim is incidental to the greater cause.
Criminal Law Purposes?
Punishment : Jail, probation, Fines or financial restitution
Deterrence: penalty is severe enough to dissuade any further criminal activity.
Criminal Law - Burden of Proof ?
To be convicted under criminal law, a judge or jury must believe beyond a reasonable doubt that the defendant is guilty. Therefore the burden of proof rests with the prosecution.
Criminal Law - CLassifications
Felony - More Serious, Jail time > 1 Year.
Misdemeanor - Less serious, Jail time < 1 Year.
What is Civil Law ?
Civil (tort) law addresses wrongful acts committed against an individual or business, either willfully or negligently, resulting in damage, loss, injury, or death.
What are Civil Law Penalties ?
Unlike criminal penalties, civil penalties don’t include jail or prison terms. Instead, civil penalties provide financial restitution to the victim:
- Compensation - payment of actual damages to victim (legal, lost profits, attorney)
- Punative - This is a cash settlement determined by a jury, intended as a punishment.
- Statutory damages - Mandatory damages determined by law and assessed for violating the law
Civil Law - Burden of Proof ?
To be convicted under civil law, a jury must believe based upon the preponderance of the evidence that the defendant is guilty. This simply means that the available evidence leads the judge or jury to a conclusion of guilt.
Civil Law - Liability and Due Care ?
The concepts of liability and due care are germane to civil law cases, but they’re also applicable under administrative law, which we discuss in the following section.
The principle of proximate causation
An action taken or not taken was part of a sequence of
events that resulted in negative consequences.
What is Due Care ?
The conduct that a reasonable person exercises in a given situation, which provides a standard for determining negligence. In the practice of information security, due care relates to the steps that individuals or organizations take to perform their duties and implement security best practices.
What is Due Diligence ?
The prudent management and execution of due care. In the context of information security, due diligence commonly refers to risk identification and risk management practices, not only in the day-to-day operations of an organization, but also in the case of technology procurement, as well as mergers and acquisitions.
What is the principle of culpable negligence.
If an organization fails to follow a standard of due care in the protection of its assets, the organization may be held culpably negligent.
What is Administrative Law ?
Administrative (regulatory) laws define standards of performance and conduct for major industries (including banking, energy, and healthcare), organizations, and officials.
* These laws are generally enforced by government agencies.
What is International Law ?
Problems with Int. Law:
- Lack of universal cooperation.
- Different interpretation of the law.
- Different rules of evidence.
- resolution priority
- Outdated laws and technology
- Extradition
Other Legal Systems around the world could include:
- Civil Law - judge interprets the law, not based on precedent. Most common type of law.
- Religious Law (Sharia)
- Pluralistic (Mixed - civil, common, religious)
What is Computer Crime ?
- Computer crime consists of any criminal activity in which computer systems or networks are used as tools.
- Also includes crimes where computers are the targets.
Difficulties with Computer Crime ?
- Lack of Understanding - technology is difficult to explain
- Inadequate Laws - Laws do not keep pace with tech.
- Multiples roles - against a computer vs using a computer vs Support using a computer (criminals use computers for crime related communications.)
Why are computer crimes difficult to prosecute ?
- Lack of tangible assets
- rules of evidence (most is hearasay)
- A lack of Evidence (lack of skills, long trail of computers)
- definition of loss - a loss of confidentiality or integrity with regards to Data in a computer crime is greater than in a civil or criminal suit.
- Location of Perpetrators - perpetrators outside of country. law enforcement is difficult.
- Criminal Profiles
- Juveniles
- Trusted Individuals
6 Classifications of Computer Crime ?
- Business attacks
- Financial attacks
- “Fun” attacks
- Grudge attacks
- Ideological attacks
- Military and intelligence attacks
- Terrorist attacks
Why Attack Businesses ?
- Lack of expertise: Despite heightened security awareness, a shortage of qualified security professionals still exists, particularly in private enterprise.
- Lack of resources: Businesses often lack the resources to prevent, or even detect, attacks against their systems.
- Lack of reporting or prosecution: Because of public relations concerns and the inability to prosecute computer criminals because of either a lack of evidence or a lack of properly handled
Why Attack Financial Institutions?
- Theft, Embezzlement.
* 99% are greed focused.
Why ‘Fun’ Attacks ?
- the realm of thrill seekers and script kiddies.
- motivated by curiosity and what ifs….
- usually easy to detect and prosecute, again script kiddies.
Why Grudge Attacks ?
- targetted at businesses or people
* attackers are usually known to the victims so a success prosecution is more likely.
Why ideological Attacks ?
- commonly known as hacktivism
- target business and people due to controversy
- Mostly DDoS style Attacks, can include data theft
Why Military Intelligence Attacks ?
- criminals, traitors, foreign state agencies / actors
Intellectual Property ?
Protected under 1 of 4 Classifications:
- Patents
- Trademarks
- Copyrights
- Trade Secrets
What is a Patent ?
- A patent, as defined by the U.S. Patent and Trademark Office (PTO) is “the grant of a property right to the inventor.”
- This allows the owner to dictate who can make, use, sell or import the invention you have patented.
- US Patents are valid for 20 years.
What are the US Patent Laws covered by ?
35 U.S.C.
37 C.F.R.
What is a TradeMark ?
A trademark, as defined by the U.S. PTO, is “any word, name, symbol, or device, or any combination, used, or intended to be used, in commerce to identify and distinguish the goods of one manufacturer or seller from goods manufactured or sold by others.”
What is Copyright ?
A copyright is a form of protection granted to the authors of “original works of authorship,” both published and unpublished. A copyright protects a tangible form of expression rather than the idea or subject matter itself.
Copyright Act of 1909 - only published work.
Copyright Act of 1976 - Any original work.
How long does a Copy Right last for ?
Lifetime of the authour + 70 years.
What is a trade secret ?
A trade secret is proprietary or business-related information that a company or individual uses and has exclusive rights to.
Trade Secret Requirements:
- Must be guinine and not obvious
- Must have value to the owner
- must provide for a competitive / economic advantage
- must be reasonably protected from disclosure.
