Law and Ethics in Information Security.pptx

Information security

1. Law and Ethics in Information Security

2. Law and Ethics Laws are rules that mandate or prohibit certain behavior in society; they are drawn from ethics, which define socially acceptable behaviors. The key difference between laws and ethics is that laws carry the sanctions of a governing authority and ethics do not. Ethics in turn are based on cultural mores : the fixed moral attitudes or customs of a particular group. Some ethics are recognized as universal. For example, murder, theft, assault, and arson are commonly accepted as actions that deviate from ethical and legal codes in the civilized world.

3. Organizational Liability and the Need for Counsel What if an organization does not demand or even encourage strong ethical behavior from its employees? What if an organization does not behave ethically? Even if there is no breach of criminal law, there can still be liability.

4. Organizational Liability and the Need for Counsel Liability is the legal obligation of an entity that extends beyond criminal or contract law; it includes the legal obligation to make restitution, or to compensate for wrongs committed by an organization or its employees. Due care has been taken when an organization makes sure that every employee knows what is acceptable or unacceptable behavior, and knows the consequences of illegal or unethical actions

5. Organizational Liability and the Need for Counsel Due diligence requires that an organization make a valid effort to protect others and continually maintain this level of effort. Given the Internet’s global reach, those who could be injured or wronged by an organization’s members could be anywhere, in any state, any country around the world.

6. Organizational Liability and the Need for Counsel Under the U.S. legal system, any court can impose its authority over an individual or organization if it can establish jurisdiction —that is, the court’s right to hear a case if the wrong was committed in its territory or involving its citizenry. This is sometimes referred to as long arm jurisdiction —the long arm of the law reaching across the country or around the world to pull an accused individual into its court systems. Trying a case in the injured party’s home area is usually favorable to the injured party.

7. Policy versus Law These policies —a body of expectations that describe acceptable and unacceptable employee behaviors in the workplace—function as organizational laws, complete with penalties, judicial practices, and sanctions to require compliance. policies function as laws , they must be crafted with the same care, to ensure that they are complete, appropriate, and fairly applied to everyone in the workplace

8. Policy versus Law Thus, for a policy to become enforceable, it must meet the following five criteria: Dissemination (distribution) Review (reading) Comprehension (understanding. Compliance (agreement) Uniform enforcement Only when all of these conditions are met can an organization penalize employees who violate the policy, without fear of legal retribution.

9. Types of Law Civil law represents a wide variety of laws that govern a nation or state and deal with the relationships and conflicts between organizational entities and people Criminal law addresses violations harmful to society and is actively enforced by the state. The categories of laws that affect the individual in the workplace are private law and public law Private law regulates the relationship between the individual and the organization, and encompasses family law, commercial law, and labor law. Public law regulates the structure and administration of government agencies and their relationships with citizens, employees, and other governments. Examples of public law include criminal, administrative, and constitutional law.

10. General Computer Crime Laws The Computer Fraud and Abuse Act of 1986 (CFA Act ) is the cornerstone of many computer-related federal laws and enforcement efforts. It was amended in October 1996 by the National Information Infrastructure Protection Act of 1996 , which modified several sections of the previous act and increased the penalties for selected crimes

11. General Computer Crime Laws The Computer Fraud and Abuse Act of 1986 (CFA Act ) is the cornerstone of many computer-related federal laws and enforcement efforts. It was amended in October 1996 by the National Information Infrastructure Protection Act of 1996 , which modified several sections of the previous act and increased the penalties for selected crimes

12. General Computer Crime Laws USA PATRIOT Act of 2001 modified a wide range of existing laws to provide law enforcement agencies with broader latitude in order to combat terrorism-related activities. In 2006, this act was amended further with the USA PATRIOT Improvement and Reauthorization Act , which made permanent 14 of the 16 expanded powers of the Department of Homeland Security, and the FBI in investigating terrorist activity. The act also reset the date of expiration written into the law as a so called sunset clause for certain wiretaps under the Foreign Intelligence Surveillance Act of 1978 (FISA)

13. General Computer Crime Laws Another key law is the Computer Security Act of 1987 . It was one of the first attempts to protect federal computer systems by establishing minimum acceptable security practices. The National Bureau of Standards, in cooperation with the National Security Agency, became responsible for developing these security standards and guidelines.

14. Privacy privacy in this context is not absolute freedom from observation, but rather is a more precise “state of being free from unsanctioned intrusion.” the state or condition of being free from being observed or disturbed by other people. the state of being free from public attention.

15. Privacy of Customer Information The Privacy of Customer Information Section of the common carrier regulation states that any proprietary information shall be used explicitly for providing services, and not for any marketing purposes, and that carriers cannot disclose this information except when necessary to provide their services.

16. Privacy of Customer Information The Federal Privacy Act of 1974 regulates government agencies and holds them accountable if they release private information about individuals or businesses without permission. Electronic Communications Privacy Act of 1986 is a collection of statutes that regulate the interception of wire, electronic, and oral communications. These statutes work in conjunction with the Fourth Amendment of the U.S. Constitution, which protects individuals from unlawful search and seizure

17. Privacy of Customer Information The Financial Services Modernization Act or Gramm-Leach-Bliley Act of 1999 contains a number of provisions focusing on facilitating affiliation among banks, securities firms, and insurance companies

18. Identity Theft “occurring when someone uses your personally identifying information, like your name, Social Security number , or credit card number , without your permission, to commit fraud or other crimes”

19. Export and Espionage Laws This law attempts to prevent trade secrets from being illegally shared. The Security And Freedom Through Encryption Act of 1999 provides guidance on the use of encryption, and provides measures of protection from government intervention

20. U.S. Copyright Law The U.S. copyright laws extend this privilege to the published word, including electronic formats. Fair use of copyrighted materials includes their use to support news reporting, teaching, scholarship, and a number of other related activities, so long as the use is for educational or library purposes, not for profit, and is not excessive.

21. Codes of Ethics and Professional Organizations A code of ethics is  a guide of principles designed to help professionals conduct business honestly and with integrity . ... A code of ethics, also referred to as an "ethical code," may encompass areas such as business ethics, a code of professional practice, and an employee code of conduct

22. Ethics and Information Security Ethics can be defined as a moral code by which a person lives. For corporations, ethics can also include the framework you develop for what is or isn’t acceptable behavior within your organization.  In computer security, cyber-ethics is what separates security personnel from the hackers. It’s the knowledge of right and wrong, and the ability to adhere to ethical principles while on the job. 

23. Why is ethics significant to information security? The data targeted in cyber attacks is often personal and sensitive. Loss of that sensitive data can be potentially devastating for your customers, and it’s crucial that you have the full trust of the individuals you’ve hired to protect it. Cybersecurity professionals have access to the sensitive personal data they were hired to protect. So it’s imperative that employees in these fields have a strong sense of ethics and respect for the privacy of your customers.   

24. Questions Is it okay to read campus users’ email? What if you believe that university policies are being violated? Would you tell the users that their email is being read? Is it okay to look through files on a user's laptop when you're troubleshooting a problem? What if the user is someone you think might be storing illegal content on the laptop?

25. What would you do? You’re a system administrator with broad access to enterprise systems. Your supervisor has asked you to begin archiving all of the emails and web activity logs of one of your coworkers. Typically requests of this nature are initiated through a formal communication from your campus’s legal office. You feel that this request is inappropriate and possibly at odds with standard campus procedure and processes. You raise your concerns with your supervisor, but are told that this is a sensitive matter, and details cannot be shared with you. After thinking more about the conversation you had with your supervisor, you are under the impression that you might lose your job if you persist in discussing the matter further or if you refuse to carry out the task.

26. As IT professionals, what should we do when we encounter potentially unclear situations like the ones described? Sometimes existing laws or institutional policy will guide ethical behavior; sometimes they won't. What many people often do not understand is that what is  legal  is not always  ethical . I believe it is our responsibility as IT professionals to act in an ethical manner in the performance of our work duties. To inadvertently do otherwise risks losing the trust of our students, faculty, staff, communities, and the general public. Without such trust I have difficulty imagining how IT professionals can continue to perform their duties effectively.