Legal, Regulations, Standards Flashcards
Patent
Grants ownership of an invention and provides enforcement for owner to exclude others from practicing the invention. After 20 years the idea is open source of application. 20 years from time of application. Invention must be:
Novel (no one has this idea before)
Useful (possible to use or useful to someone)
Nonobvious (inventive work)
Copyright
Granted 70 years after creators death or 95 years after creation (corporations). Automatic - no need registration
Trade Secret
Tell no one, but if discovered, not protected
Trademark (TM or (R).
Brands, logo, slogans - must be registered and renewable every 10 yrs
PCI-DSS
Payment Card Industry - Data Security Standard
requires merchants and others to meet minimum set of requirements - security policies, devices, control techniques and monitoring
SOX
Sarbanes Oxley Act of 2002. Financial Reporting of public traded companies
after ENRON and World Online debacle Independent review by external accountants.
Section 302: CEO’s CFO’s can be sent to jail when information they sign is incorrect. CEO SIGN
Section 404 is the about internal controls assessment: describing logical controls over accounting files; good auditing and information security.
GLBA
Gramm-Leach-Bliley Act - For Financial institutions
EU GDPR
The General Data Protection Regulation 2016/679 is a regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area. It also addresses the export of personal data outside the EU and EEA areas
HIPAA
Health Insurance Portability and Accountability Act
For Private Health Information by health insurers, providers
- 3 rules - Privacy rule, Security Rule and Breach notification rule
- mandates physical, admin and technical safeguards
- Risk Analysis is required
Security Breach Notification
Each US state has different laws.
ECPA
Electronic Communications Privacy Act
protect against warrantless wiretaping
PATRIOT ACT
Expands law enforcement electronic monitoring capabilities
CFAA
Computer Fraud and Abuse Act
- most commonly used law to prosecute computer crimes
OECD Privacy Guidelines
30 member guidelines for protecting privacy (including US)
Wassenaar Arrangement
Export/Import of arms and dual-use goods and technologies
- cryptology is dual use
- Iran, Iraq, China, Russia has strict import on too strong encryption
ISC2 Preamble
The safety and welfare of society and common good, duty to our principles and to each other requires that we adhere, and be seen to adhere to the highest ethical standard of behavior
Canons
- Protect society, common good, necessary public trust and confidence, and the infrastructure
- Act honorably, justly, honestly, responsibly, legally
- Provide diligent and competent service to our principles
- advance and protect the profession
OCTAVE
Operationally Critical Threat, Asset, Vulnerability Evaluation - Self Directed Risk Mgt
is a security framework for determining risk level and planning defenses against cyber assaults. The framework defines a methodology to help organizations minimize exposure to likely threats, determine the likely consequences of an attack and deal with attacks that succeed.
ITIL
Info Technology Infra Library - set of practices for IT Service Mgt
COBIT
Control Objectives for IT
- Goals for IT - stakeholder needs mapped to IT related goals
COBIT provides an implementable “set of controls over information technology and organizes them around a logical framework of IT-related processes and enablers
COSO
Committee of Sponsoring Organisations
- Goals for entire organisation
Dedicated to providing thought leadership through the development of frameworks and guidance on enterprise risk management, internal control, and fraud deterrence.
FRAP
Facilitated Risk Analysis Process
FRAP analyzes one system, application or segment of business processes at a time. FRAP assumes that additional efforts to develop precisely quantified risks are not cost effective because: such estimates are time consuming.
ISO/IEC 27000
Information security management systems — Overview and vocabulary[
ISO/IEC 27001
ISMS Requirements
