CISSP Prep: Ch 2. Security and Risk Management I (part 2)
4 likes2,078 views
This document provides an overview of key concepts in information security and risk management, including major legal systems, types of laws, evidence handling procedures, intellectual property, privacy regulations, and risk analysis approaches. Major topics covered include civil vs. common law, criminal vs. civil law, administrative law, evidence admissibility, chain of custody, reasonable searches, computer crime, intellectual property, privacy laws like HIPAA and GDPR, risk calculation formulas, and risk mitigation strategies.
CISSP Prep: Ch 2. Security and Risk Management I (part 2)
- 1. CNIT 125: Information Security Professional (CISSP Preparation) Ch 2. Security and Risk Management (Part 2)
- 2. Major Legal Systems • Civil Law • Laws and statutes determine what is allowed • Precedents and particular case rulings carry less weight than under common law • Common Law • Used in the USA, Canada, the UK, and former British colonies • Significant emphasis on particular cases and precedents as determinants of laws • The major legal system in the CISSP exam
- 3. Religious and Customary Law • Religious Law • Mainly Sharia (Islamic religious law) • Customary Law • Customs or practices that are commonly accepted and treated as law • Closely related to Best Practices • Less important
- 4. Criminal and Civil Law • Criminal Law • Victim is society itself • Enforced by police • Punishment is often prison time • Proof must be beyond a reasonable doubt • Civil Law (Tort Law) • Injury resulting from failure to provide due care • Victim is an individual • Enforced by lawsuits • Result is financial damages paid to victim • Burden of proof: preponderance of the evidence (more likely than not)
- 6. Administrative Law • Also called Regulatory Law • Specify rules and punishments for regulated industries • Examples • FCC regulations • HIPAA security mandates • FDS regulations • FAA regulations
- 7. Liability • Due Care • Also called Duty of Care • Prudent Man Rule • Businesses should do what a prudent man would do • Best Practices • Due Diligence • The management of due care • Follows a formal process
- 8. Legal Aspects of Investigations
- 9. Evidence • Real evidence • Physical objects like hard drives, USB drives, etc. • Direct evidence • Witness testimony about what that person experienced directly • Circumstantial evidence • Indirect evidence of guilt • Can support other evidence, but usually inadequate for conviction alone
- 10. Evidence • Corroborative evidence • Additional support for a fact that may be called into question • Hearsay • Secondhand evidence • Normally inadmissible in court • Exceptions: • Business records and computer-generated evidence • Computer forensic hard disk and memory images are original evidence, not hearsay
- 11. Evidence • Best evidence • Original documents, not copies • The actual hard drive used • Etc. • Secondary evidence • Copies of documents • Log files may be considered secondary or original • Evidence integrity • Typically ensured by MD5 or SHA-1 hash
- 12. Chain of Custody • Evidence must be protected from tampering • A list of names of people who can testify that they protected the evidence
- 13. Reasonable Searches • Fourth amendment protects citizens from unreasonable search and seizure by the government • Illegally obtained evidence is inadmissible in court • Most searches require probable cause and a search warrant
- 14. Exceptions • These searches don't require a warrant • Objects in plain sight • At a public checkpoint • Exigent circumstances • Immediate threat to human life or of evidence being destroyed
- 15. Agents of Law Enforcement • Private citizens are not part of the government, so the fourth amendment does not apply, unless: • Private citizens who carry out investigations on behalf of law enforcement, they are acting under the color of law enforcement or agents of law enforcement • Then the fourth amendment applies
- 16. Should You Call Law Enforcement? • Companies often avoid involving law enforcement • Makes cases simpler, avoids publicity
- 17. Entrapment and Enticement • Entrapment • Law enforcement agent persuades someone to commit a crime when • The person otherwise had no intention to commit a crime • Enticement • Law enforcement agent makes conditions favorable for a crime • Person is already intent on committing a crime
- 18. Computer Crime • Computer as target • DoS, installing malware to send spam • Computer as a tool • Stealing secrets from a database • Stealing credit card numbers • Espionage • Harassment • Attribution • Difficult to prove who did a crime
- 19. Intellectual Property • Trademark • Name, logo, or symbol used for marketing • Unregistered ™ or Registered ® • Patent • Grants a monopoly for an invention • Copyright © • Restricts copying creative work • Software typically covered by copyright • Fair sale & fair use are allowed
- 20. Intellectual Property • Licenses • End-User License Agreement (EULA) • Trade secrets • Special sauce • Protected by non-disclosure agreements (NDAs) & non-compete agreements (NCAs)
- 21. Intellectual Property Attacks • Software piracy • Copyright infringement • Corporate espionage • Cybersquatting & Typosquatting • Using a domain close to a company's domain, like yahoo.net or yahooo.com
- 22. Privacy • Confidentiality of personal information • EU Data Protection Directive • Individuals must be notified how their data is used & allowed to opt out • OECD Privacy Guidelines • Organization for Economic Cooperation and Development • Includes EU, USA, Mexico, AU & more
- 23. EU-US Safe Harbor • Part of EU Data Protection Directive • Sending personal data from EU to other countries is forbidden • Unless the receiving country adequately protects its data • The USA lost this privilege in Oct. 2015 because of the Snowden leaks • Replacement agreement should be reached next week (Link Ch 1d, Jan. 25, 2016)
- 24. International Cooperation • Council of Europe Convention on Cybercrime • Includes most EU countries and the USA • Promotes cooperation
- 25. Import / Export Restrictions • USA restricted exports of cryptographic technology in the 1990s • Restrictions have been relaxed since then
- 26. Important Laws and Regulations
- 27. HIPAA • Health Insurance Portability and Accountability Act • Guidance on Administrative, Physical, and Technical safeguards • For Protected Health Information (PHI)
- 28. CFAA • Computer Fraud and Abuse Act • Protects government and financial computers • Including every computer on the Internet (probably not the law's original intent) • It's a crime to exceed your authorization to use such a computer
- 29. ECPA & The PATRIOT Act • Electronic Communications Privacy Act • Protected electronic communications from warrantless wiretapping • Weakened by the PATRIOT Act • The PATRIOT Act • A response to 9/11 attacks • Greatly expanded law enforcement's electronic monitoring capabilities
- 30. GLAB & SOX • Gramm-Leach-Bailey Act • Forces financial institutions to protect customer financial information • Sarbanes-Ox;ey Act • Response to ENRON scandal • Regulatory compliance mandates for publicly traded companies • Ensures financial disclosure and auditor independence
- 31. PCI-DSS • Payment Card Industry Data Security Standard • Self-regulation by major vendors • Mandates security policy, devices, controls, and monitoring to protect cardholder data
- 32. US Breach Notification Laws • 47 states require notification • No federal law yet • Safe harbor for data that was encrypted at time of compromise
- 33. Security and 3rd Parties • Service Provider Contractual Security • Service Level Agreements (SLA) • Identify key expectations vendor must meet • Attestation • Third party review of the service provider to determine security posture • Includes SAS 70 (old), ISO 27001, and PCI-DSS
- 34. Security and 3rd Parties • Right to Penetration Test / Audit • Allows the originating organization to perform these security tests on a vendor • Procurement • Purchasing products or services • Considering security before purchase is best
- 35. Security and 3rd Parties • Vendor Governance • Ensure that vendor provides sufficient quality • Acquisitions • Purchasing a company to add to an existing company • Can disrupt security • Divestitures • Splitting a company into parts • May result in duplicate accounts and other risks
- 36. (ISC)^2 Code of Ethics • Four Canons • Protect society, the commonwealth, and the infrastructure • Act honorably, honestly, justly, responsibly, and legally • Provide diligent and competent service to principals • Advance and protect the profession
- 37. x
- 38. Personnel Security • Security Awareness and Training • Background Checks • Employee Termination • Must use fair process • Vendor, Consultant and Contractor Security • Outsourcing and Offshoring • Can lower Total Cost of Ownership • May improve security • Privacy and regulatory issues • Must perform risk analysis first
- 39. Access Control Types • Preventive • Detective • Corrective • Recovery • Deterrent • Compensating
- 40. Access Control Categories • Administrative • Technical • Physical
- 41. Risk Analysis • Assets • Valuable resources to protect • Threat • A potentially harmful occurrence • Vulnerability • A weakness
- 42. Risk = Threat x Vulnerability • Earthquake risk is the same in Boston and San Francisco • Boston • Earthquakes are rare, but buildings are old and vulnerable • San Francisco • Earthquakes are common, but buildings are new erand safer
- 43. Impact • Severity of the damage in dollars • Risk = Threat x Vulnerability x Impact • Human life is considered near-infinite impact
- 46. Total Cost of Ownership (TCO) • Of a mitigating safeguard includes • Upfront costs • Annual cost of maintenance • Staff hours • Maintenance fees • Software subscriptions
- 47. Return on Investment (ROI) • Amount of money saved by implementing a safeguard • If Total Cost of Ownership is less than Annualized Loss Expectancy, you have a positive ROI
- 48. Risk Choices • Accept the risk • Mitigate the risk • Transfer the risk • Risk avoidance
- 49. Quantitative and Qualitative Risk Analysis • Quantitative • Uses hard metrics, like dollars • Qualitative • Use simple approximate values • Or categories like High, Medium, Low
- 50. NIST 9-Step Risk Analysis Process
- 51. Types of Attackers • Hackers • Black hat, white hat, gray hat • Script kiddies • Outsiders • Outside the company • Insiders • Hacktivists • Bots • Phishing