Lecture 12 Notes Flashcards

Question

Health Insurance Portability and Accountability Act of 1996

Answer 1

Requires strict security measures for hospitals, physicians, insurance companies, and other organizations that process or store private medical information about individuals

Answer 2

Puts a number of restrictions on websites that cater to children or knowingly collect information from children

Answer 3

In the past, the only legal victims of identity theft were the creditors who were defrauded This act makes identity theft a crime against the person whose identity was stolen and provides severe criminal penalties (up to a 15-year prison term and/or a $250,000 fine) for anyone found guilty of violating this law

Answer 4

The Gramm-Leach-Bliley Act (GLBA) somewhat relaxed the regulations concerning the services financial institutions could provide and the information they could share with each other

Answer 5

Enacted in response to the September 11, 2001, terrorist attacks Greatly broadened the powers of law enforcement and intelligence agencies across a number of areas, including monitoring electronic communications Allows the government to obtain detailed information on user activity from ISPs through the use of a subpoena

Answer 6

Must be relevant to determining a fact The fact that the evidence seeks to determine must be material (that is, related) to the case Must be competent, meaning it must have been obtained legally

Answer 7

Real evidence Consists of items that may actually be brought into a court of law Documentary evidence Includes any written items brought into court to prove a fact Testimonial evidence Consists of the testimony of a witness

Answer 8

outlined 6 principles to guide technicians as they perform media, network, and software analysis in the pursuit of forensic evidence 1 All of the general forensic and procedural principles must be applied 2 Upon seizing digital evidence, actions taken should not alter that evidence 3 When it is necessary for a person to access original digital evidence, that person should be trained for the purpose 4 All activities relating to the seizure, access, storage, or transfer of digital evidence must be fully documented, preserved, and available for review 5 An individual is responsible for all actions taken with respect to digital evidence while the digital evidence is in their possession 6 Any agency that is responsible for seizing, accessing, storing, or transferring digital evidence is responsible for compliance with these principles

Answer 9

Military and Intelligence Attacks Launched to gather military information or other sensitive intelligence Business Attacks Focus on illegally obtaining an organization’s confidential information Financial Attacks Carried out to unlawfully obtain money or “free” services (phone phreaking) Terrorist Attacks Aim at disrupting entire systems Grudge Attacks Attacks carried out by disgruntled employees Thrill Attacks Attacks launched only for the fun of it (script kiddies)

Answer 10

When an incident occurs, you must handle it in a manner that is outlined in your security policy and consistent with local laws / regulations The most common reason incidents are not reported is that they are never identified

Answer 11

When an incident occurs, the response team has four primary responsibilities - Determine the amount and scope of damage - Determine whether any confidential information was compromised - Implement any necessary recovery procedures - Supervise the implementation of additional security measures necessary to improve security and prevent recurrence of the incident

Answer 12

Step 1: Incident Detection and Identification Identifying incidents and notifying appropriate personnel To successfully detect and identify incidents, a security team must monitor any relevant events and recognize abnormal or suspicious activity Step 2: Response and Reporting The next step is to choose an appropriate response Your security policy should specify steps to take for various types of incidents Isolation and containment: limit further damage Gather evidence: collect/confiscate equipment/data for investigations Analysis and reporting: determine the most likely course of events Step 3: Recovery and Remediation Restoration: remediate any damage and prevent future damage Lessons learned

Answer 13

Your security policy should contain guidelines to define - when an incident should be reported - to whom to report an incident - the timeline for reporting

Answer 14

Security professionals hold themselves and each other to a high standard of conduct because of the sensitive positions of trust they occupy Codes of ethics are not laws

Answer 15

The safety and welfare of society and the common good, duty to our principals, and to each other, requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior. Therefore, strict adherence to this Code is a condition of certification.

Answer 16

- Protect society, the commonwealth, and the infrastructure - Act honorably, honestly, justly, responsibly, and legally - Provide diligent and competent services to principals - Advance and protect the profession

Answer 17

any activity with the following purposes is unacceptable and unethical - Seeking to gain unauthorized access to the resources of the Internet - Disrupting the intended use of the Internet - Wasting resources (people, capacity, computer) through such actions - Destroying the integrity of computer-based information - Compromising the privacy of users