Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 4 > Flashcards

Chapter 4 Flashcards

1
Q

3 Categories of Laws

A

Criminal Law
Civil Law
Administrative Law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which type of law does this describe?

preserve peace; involve police and other law enforcement agencies

A

Criminal Law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which type of law does this describe?

provide for an orderly society; settled between individuals and organizations

A

Civil Law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what type of law does this describe?

rules and procedures that should be followed in every possible situations

executive orders, policies, procedures, and regulations

A

Administrative Law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Where are administrative Laws published?

A

Code of Federal Regulations (CFR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Computer Fraud and Abuse Act (CFAA)

A

first cyber-crime-specific legislation in US
expansion of Comprehensive Crime Control Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

National Information Infrastructure Protection Act of 1996

A

covers computer systems used in international commerce and interstate commerce
extends protections beyond computer systems like railroads, pipelines, electric grids, etc.
damage to critical portions of national infrastructure as a felony

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Federal Sentencing Guidelines (1991)

A

formalized prudent person rule
three burdens of proof for negligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

prudent person rule

A

requires senior executives to take personal responsibility for ensuring due care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

3 burdens of proof for negligence

A
  1. person must have legally recognized obligation
  2. must have failed to comply with recognized standards
  3. must be a causal relationship between negligence and damages
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

FISMA - Federal Information Security Management Act

A

requires federal agencies implement an infosec profram that covers the agency’s ops - to include contractors

replaced Computer Security Act of 1987 and the Government Information Security Reform Act of 2000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which organization is responsible for developing the FISMA implementation guidelines?

A

NIST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Federal Cybersecurity Laws of 2014

A

Federal Information Systems Modernization Act
Cybersecurity Enhancement Act
National Cybersecurity Protection Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Federal Information Systems Modernization Act

A

modified 2002 FISMA by centralizing federal cybersecurity responsibility with the DHS

except:
defense-related cybersecurity remain responsibility of SecDef
intelligence-related cybersec remains responsibility of director of national intel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Cybersecurity Enhancement Act

A

NIST is responsible for coordination nationwide work on voluntary cybersec standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

National Cybersecurity Protection Act

A

DHS establishes a national cybersec and commo integration center to be the interface between federal agencies and civilian orgs to share cyber risks, incidents, analysis, and warnings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

4 types Intellectual Property

A

copyrights
trademarks
patents
trade secrets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Copyright law - primary purpose

A

guarantees the creators of “original works of authorship” protection against duplication of their work

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

8 categories of copyright protection

A

Literary
Musical
Dramatic
Pantomimes/Choreography
Pictorial, graphical, sculptural
Motion pictures
Sound recordings
Architectural

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What category of copyright does source code fall under?

A

literary works

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Digital Millennium Copyright Act (DMCA)

A

prohibits attempts to circumvent copyright protection mechanisms
limits liabilities of ISPs when circuits are used by criminals violating copyright law
streaming audio/video over the internet is “eligible nonsubscription transmissions” - not illegal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Trademarks

A

words, slogans, and logos used to identify a company and its products or services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

™ (TM)

A

shows you intend to protect works or slogans as trademarks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

® (R)

A

symbolizes a trademark registered with the USPTO - United States Patent and Trademark Office

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Patents

A

protect IP rights of inventors for 20 years - after which they become public domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

3 requirements for Patents

A
  • must be new
  • must be useful
  • must not be obvious
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

trade secrets

A

IP that is critical to business, and would cause significant damage if disclosed to competitors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Protecting Trade Secrets

A

make employees with access sign NDAs
implement adequate access controls

29
Q

what is one of the best ways to protect source code?

A

treat it as a trade secret

30
Q

Economic Espionage Act of 1996

A

stealing trade secrets to sell to foreign agent fined up to $500,000 and imprisoned for 15 yrs
stealing trade secrets for other reasons fined up to $250000 and imprisoned for up to 10 yrs

31
Q

4 types of license agreements

A
  1. contractural license agreement
  2. shrink-wrap license agreement
  3. click-through license agreements
  4. Cloud services license agreemtns
32
Q

contractual license agreements

A

written contract b/w software vendor and customer

33
Q

shrink-wrapped license agreements

A

written on the outside of the software packaging

34
Q

click-through license agreements

A

during installation process, you are required to click a button indicating you have read the terms of the agreement and to abide by them

35
Q

cloud services license agreements

A

usually a link to the legal terms and a check box to indicate user has read them

36
Q

International Traffic in Arms regulations (ITAR)

A

controls the export of items that are specifically designed as military and defense items

37
Q

Export Administration Regulations (EAR)

A

items appear on the commerce control list (CCL)
includes entire category covering info sec products
controls export of commercial items that may have a military application

38
Q

Fourth Amendment

A

basis for privacy rights; protection against unreasonable search and seizure of persons, houses, papers, and effects

expanded to include protection against wiretapping

39
Q

Privacy Act of 1974

A

applies to government agencies regarding records maintenance and access to your records

40
Q

Electronic Communications Privacy Act of 1986 (ECPA)

A

makes it a crime to invade the electronic privacy of an individual

41
Q

Communications Assistance for Law Enforcement Act (CALEA) of 1994

A

requires all communications carriers to make wiretaps possible for law enforcement

42
Q

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

A

privacy and security regulations for organizations that process or store private medical information about individuals

43
Q

Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH)

A

updated HIPAA privacy and security requirements

44
Q

Children’s Online Privacy Protection Act (COPPA)

A

websites that cater to children:
have a notice that indicates the type of information they collect and what its use for
parents must have ability to review and delete information permanently from the site
parents must give consent to the collection of information

45
Q

Gramm-Leach_Bliley Act of 1999 (GLBA)

A

limits types of info that could be exchanged amongst financial institutions

46
Q

USA PATRIOT Act

A

broadens powers of law enforcement and intelligence agencies
wiretapping authorizations are easier to obtain

47
Q

Family Educational Rights and Privacy Act (FERPA)

A

grants privacy rights to students older than 18
right to inspect educational records
right to request corrections
schools may not release person information from student records

48
Q

Identity Theft and Assumption Deterrence Act

A

the person whose identify was stolen is the victim

49
Q

“reasonable expectation to privacy”

A

if you are using corporate or government equipment, you should not expect privacy so be careful what you do

50
Q

European Union Data Protection Directive (DPD)

A

outlines privacy measures that must be in place for protecting personal data

51
Q

European Union General Data Protection Regulation (GDPR)

A

widened scope of personal data protections to all organizations that collect data from EU residents - even if they are not based in the EU

52
Q

7 key provisions of GDPR

A
  1. Lawfulness, fairness, transparency
  2. Purpose limitation
  3. Data minimizaiton
  4. Accuracy
  5. Storage Limitation
  6. Security
  7. Accountability
53
Q

which key provision of GDPR does this describe?

must have a legal basis for processing personal information

A

lawfullness, fairness, transparency

54
Q

which key provision of GDPR does this describe?

must clearly document and disclose the purposes for which you collect data

A

purpose limitation

55
Q

which key provision of GDPR does this describe?

must ensure that the data processed is adequate for your stated purpose and limited to what is necessary

A

Data minimization

56
Q

which key provision of GDPR does this describe?

data you collect or maintain is correct and not misleading; correct or erase inaccurate data

A

Accuracy

57
Q

which key provision of GDPR does this describe?

keep data only for as long as it is needed

A

storage limitation

58
Q

which key provision of GDPR does this describe?

must have appropriate integrity and confidentiality controls in place

A

security

59
Q

which key provision of GDPR does this describe?

must take responsibility for your actions with protected data

A

accountability

60
Q

Personal Information Protection and Electronic Documents Act (PIPEDA)

A

Canadian law that restricts how commercial entities may collect, use, and disclose PI

61
Q

Payment Card Industry Data Security Standard (PCI DSS)

A

compliance requirement dictated by contractual obligation - not by law

62
Q

12 requirements of PCI DSS

A
  1. firewalls
  2. change default passwords
  3. protect cardholder data
  4. encrypt transmission across public networks
  5. protect against malware
  6. maintain secure systems and apps
  7. restrict access to cardholder data
  8. identity and authentication access control
  9. restrict physical access to cardholder data
  10. track and monitor access to network resources and data
  11. test security systems and processes
  12. maintain info sec policy for all personnel
63
Q

Sarbanes-Oxley Act (SOX)

A

protects investors from fraudulent financial reporting by corporations

64
Q

BIS - Bureau of Industry and Security

A

sets regs on the export of encryption products

65
Q

GLBA - Gramm-Leach-Bliley Act

A

requires financial institutions protect customer records

66
Q

If an organization wants to transfer data from EU residents with other agencies, what is the best way to ensure compliance with GDRP?

A

standard contractual clauses provided by the EU

67
Q

If an organization wants to internally transfer data collected from EU residents, how can they remain compliant with GDRP?

A

binding corporate rules

68
Q

How can organizations remain HIPAA compliant and enter a relationship with a service provider that gives them access to the PHI?

A

Enter a BAA - Business Associate Agreement.
It makes the service provider liable under HIPAA.

CISSP (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions