Legal and Privacy Issues in Information Security, 3rd Edition

Cover
Title Page
Copyright Page
Contents
Dedication
Preface
Acknowledgments
About the Author
Chapter 1 Information Security Overview
    Why Is Information Security an Issue?
    What Is Information Security?
        What Is Confidentiality?
        What Is Integrity?
        What Is Availability?
    Basic Information Security Concepts
        Vulnerabilities
        Threats
        Risks
        Safeguards
        Choosing Safeguards
    What Are Common Information Security Concerns?
        Shoulder Surfing
        Social Engineering
        Phishing and Targeted Phishing Scams
        Malware
        Spyware and Keystroke Loggers
        Logic Bombs
        Backdoors
        Denial of Service Attacks
    What Are the Mechanisms That Ensure Information Security?
        Laws and Legal Duties
        Contracts
        Organizational Governance
            Data Protection Models
    U.S. National Security Information
        Voluntary Organizations
    Do Special Kinds of Data Require Special Kinds of Protection?
    Chapter Summary
    Key Concepts and Terms
    Chapter 1 Assessment
    Endnotes
Chapter 2 Privacy Overview
    Why Is Privacy an Issue?
    What Is Privacy?
        Types of Personal Information
    How Is Privacy Different from Information Security?
    What Are the Sources of Privacy Law?
        Constitutional Law
        Federal Law
            Freedom of Information Act (1966)
            Privacy Act (1974)
            E-Government Act (2002)
            Electronic Communications Privacy Act (1986)
            The Wiretap Act (1968, amended)
            Census Confidentiality (1952)
            Mail Privacy Statute (1971)
            Cable Communications Policy Act (1984)
            Driver’s Privacy Protection Act (1994)
        State Laws
        Common Law
            Intrusion Into Seclusion
            Portrayal in a False Light
            Appropriation of Likeness or Identity
            Public Disclosure of Private Facts
        Voluntary Agreements
    What Are Threats to Personal Data Privacy in the Information Age?
        Technology-Based Privacy Concerns
            Spyware
            Cookies, Web Beacons, and Clickstreams
            Wireless Technologies
            GPS Technology
            Security Breaches
        People-Based Privacy Concerns
            Social Networking Sites
            Online Data Gathering
    What Is Workplace Privacy?
        Telephone, Voicemail, and Email Monitoring
            Telephone and Voicemail Monitoring
            Email Monitoring
        Computer Use Monitoring
            Off-Duty Computer Monitoring
        Video Surveillance Monitoring
            Special Rules for Public Employees
    What Are General Principles for Privacy Protection in Information Systems?
        Privacy Policies
        International Privacy Laws
    Chapter Summary
    Key Concepts and Terms
    Chapter 2 Assessment
    Endnotes
Chapter 3 The American Legal System
    The American Legal System
        Federal Government
            Legislative Branch
            Executive Branch
            Judicial Branch
        State Government
    Sources of American Law
        Common Law
        Code Law
        Constitutional Law
        How Does It All Fit Together?
    Types of Law
        Civil
        Criminal
        Administrative
    The Role of Precedent
    Regulatory Authorities
    What Is the Difference Between Compliance and Audit?
    How Do Security, Privacy, and Compliance Fit Together?
    Chapter Summary
    Key Concepts and Terms
    Chapter 3 Assessment
    Endnotes
Chapter 4 Security and Privacy of Consumer Financial Information
    Business Challenges Facing Financial Institutions
    The Different Types of Financial Institutions
    Consumer Financial Information
    Who Regulates Financial Institutions?
        The Federal Reserve System
        Federal Deposit Insurance Corporation
        National Credit Union Administration
        Office of the Comptroller of the Currency
        Special Role of the Federal Financial Institutions Examination Council
        Special Roles of the Consumer Financial Protection Bureau and the Federal Trade Commission
            Consumer Financial Protection Bureau
            Federal Trade Commission
    The Gramm-Leach-Bliley Act
        Purpose, Scope, and Main Requirements
        The Privacy Rule
        The Safeguards Rule
        The Pretexting Rule
        Oversight
    Federal Trade Commission Red Flags Rule
        Purpose
        Scope
        Main Requirements
        Oversight
    Payment Card Industry Standards
        Purpose
        Scope
        Main Requirements
        Oversight
    Case Studies and Examples
        FTC Privacy and Safeguards Rule Enforcement
        Credit Card Security Example
    Chapter Summary
    Key Concepts and Terms
    Chapter 4 Assessment
    Endnotes
Chapter 5 Security and Privacy of Information Belonging to Children and in Educational Records
    Challenges in Protecting Children on the Internet
        Identification of Children
        First Amendment and Censorship
        Defining Obscenity
    Children’s Online Privacy Protection Act
        Purpose of COPPA
        Scope of the Regulation
        Main Requirements
            Privacy Policy
            Privacy Policy Content
            Gaining Parental Consent
        Oversight
    Children’s Internet Protection Act
        Purpose
        Scope of the Regulation
        Main Requirements
            Content Filtering
            Internet Safety Policy
            Exceptions
        Oversight
    Family Educational Rights and Privacy Act (FERPA)
        Scope
        Main Requirements
            Annual Notification
            Access to Education Records
            Amendment of Education Records
            Disclosure of Education Records
        Disclosure Exceptions Under FERPA
        Security of Student Records Under FERPA
        Oversight
        State Laws Protecting Student Data
    Case Studies and Examples
        Children’s Privacy
        Release of Disciplinary Records
    Chapter Summary
    Key Concepts and Terms
    Chapter 5 Assessment
    Endnotes
Chapter 6 Security and Privacy of Health Information
    Business Challenges Facing the Healthcare Industry
    Why Is Healthcare Information So Sensitive?
    The Health Insurance Portability and Accountability Act
        Purpose
        Scope
        Main Requirements of the Privacy Rule
            Required Disclosures
            Permitted Uses and Disclosures
            Uses and Disclosures That Require Authorization
            Minimum Necessary Rule
            Other Individual Rights Under the Privacy Rule
            Privacy Notices
            Administrative Requirements
            Breach Notification Provisions
        Main Requirements of the Security Rule
            Safeguards and Implementation Specifications
        Oversight
    The Role of State Laws Protecting Medical Records
    Case Studies and Examples
        OCR Enforcement Information
        HIPAA and Federal Trade Communications Act
    Chapter Summary
    Key Concepts and Terms
    Chapter 6 Assessment
    Endnotes
Chapter 7 Corporate Information Security and Privacy Regulation
    The Enron Scandal and Securities-Law Reform
        Corporate Fraud at Enron
    Why Is Accurate Financial Reporting Important?
    The Sarbanes-Oxley Act of 2002
        Purpose and Scope
        Main Requirements
            Public Company Accounting Oversight Board
            Document Retention
            Certification
        Oversight
    Compliance and Security Controls
        COBIT
        GAIT
        ISO/IEC Standards
        NIST Computer Security Guidance
    SOX Influence in Other Types of Companies
    Corporate Privacy Issues
    Case Studies and Examples
    Chapter Summary
    Key Concepts and Terms
    Chapter 7 Assessment
    Endnotes
Chapter 8 Federal Government Information Security and Privacy Regulations
    Information Security Challenges Facing the Federal Government
    The Federal Information Security Modernization Act
        Purpose and Scope
        Main Requirements
            Agency Information Security Programs
            The Role of NIST
            Central Incident Response Center
            National Security Systems
        Oversight
    Protecting Privacy in Federal Information Systems
        The Privacy Act of 1974
        The E-Government Act of 2002
        OMB Breach Notification Policy
        Import and Export Control Laws
    Case Studies and Examples
    Chapter Summary
    Key Concepts and Terms
    Chapter 8 Assessment
    Endnotes
Chapter 9 State Laws Protecting Citizen Information and Breach Notification Laws
    History of State Actions to Protect Personal Information
        ChoicePoint Data Breach
    Breach Notification Regulations
        California Breach Notification Act
        Other Breach Notification Laws
            Activities That Constitute a Breach
            Time for Notification
            Contents of Notification
            Encryption Requirements
            Penalties for Failure to Notify
            Private Cause of Action
    Data-Specific Security and Privacy Regulations
        Minnesota and Nevada: Requiring Businesses to Comply With Payment Card Industry Standards
        Indiana: Limiting SSN Use and Disclosure
        California: Protecting Consumer Privacy
    Encryption Regulations
        Massachusetts: Protecting Personal Information
        Nevada Law: Standards-Based Encryption
    Data Disposal Regulations
        Washington: Everyone Has an Obligation
        New York: Any Physical Record
    Case Studies and Examples
    Chapter Summary
    Key Concepts and Terms
    Chapter 9 Assessment
    Endnotes
Chapter 10 Intellectual Property Law
    The Digital Wild West and the Importance of Intellectual Property Law
    Legal Ownership and the Importance of Protecting Intellectual Property
    Patents
        Patent Basics
            Patent Requirements
        The Patent Application Process
        Infringement and Remedies
        What Is the Difference Between Patents and Trade Secrets?
    Trademarks
        Trademark Basics
            Use in Commerce
            Distinctive
        Trademark Registration
        Infringement and Remedies
        Relationship of Trademarks on Domain Names
    Copyright
        Copyright Basics
        Copyright Registration
        Infringement and Remedies
            Fair Use
    Protecting Copyrights Online—The Digital Millennium Copyright Act (DMCA)
        DMCA Basics
            Technology Protection Measures
            Online Copyright Infringement
            Computer Maintenance
        DMCA Unintended Consequences
            Title 1 Concerns
            Title II Concerns
    Case Studies and Examples
        Trade Secrets
        Service Provider Liability for Copyright Infringement
        Digital Collections
    Chapter Summary
    Key Concepts and Terms
    Chapter 10 Assessment
    Endnotes
Chapter 11 The Role of Contracts
    General Contracting Principles
        Contract Form
        Capacity to Contract
        Contract Legality
        Form of Offer
        Form of Acceptance
        Meeting of the Minds
        Consideration
        Performance and Breach of Contract
        Contract Repudiation
    Contracting Online
        Legal Capacity Online
        Form of Offer and Acceptance
            Email Communications
            Text and Instant Messages
            Twitter and Other Social Networking Sites
        Existence and Enforcement
        Authenticity and Nonrepudiation
    Special Types of Contracts in Cyberspace
        Shrinkwrap Contracts
        Clickwrap Contracts
        Browsewrap Contracts
    How Do These Contracts Regulate Behavior?
    Emerging Contract Law Issues
        Cloud Computing
        Information Security Terms in Contracts
            Data Definition and Use
            General Data Protection Terms
            Compliance With Legal and Regulatory Requirements
    Case Studies and Examples
        Contract Formation via Email
    Chapter Summary
    Key Concepts and Terms
    Chapter 11 Assessment
    Endnotes
Chapter 12 Criminal Law and Tort Law Issues in Cyberspace
    General Criminal Law Concepts
        Main Principles of Criminal Law
            Type of Wrongful Conduct
            Elements of a Crime
            Jurisdiction
        Criminal Procedure
    Common Criminal Laws Used in Cyberspace
        The Computer Fraud and Abuse Act (1984)
        Computer Trespass or Intrusion
        Theft of Information
        Interception of Communications Laws
        Spam and Phishing Laws
        Cybersquatting
        Malicious Acts
        Well-Known Cybercrimes
    General Tort Law Concepts
        Strict Liability Torts
        Negligence Torts
        Intentional Torts
        Civil Procedure
    Common Tort Law Actions in Cyberspace
        Defamation
        Intentional Infliction of Emotional Distress
        Trespass Torts
        Privacy Violations
    Case Studies and Examples
        CAN-SPAM Act
        Defamation on College Campuses
    Chapter Summary
    Key Concepts and Terms
    Chapter 12 Assessment
    Endnotes
Chapter 13 Information Security Governance
    What Is Information Security Governance?
        Information Security Governance Planning
        Common Information Security Governance Roles
        Information Security Governance and Management
        Information Security Governance in the Federal Government
    Information Security Governance Documents
        Policies
        Standards
        Procedures
        Guidelines
        Creating Information Security Policies
            Policy Development Process
    Recommended Information Security Policies
        Acceptable Use Policies
            AUP Terms
            Enforcement
        Anti-Harassment Policies
        Workplace Privacy and Monitoring Policies
        Data Retention and Destruction Policies
            Data Retention Policies
            Data Destruction Policies
        Intellectual Property Policies
        Authentication and Password Policies
        Security Awareness and Training
    Case Studies and Examples
        Acceptable Use Case Study
    Chapter Summary
    Key Concepts and Terms
    Chapter 13 Assessment
    Endnotes
Chapter 14 Risk Analysis, Incident Response, and Contingency Planning
    Contingency Planning
    Risk Management
        Risk Assessment Process
            Risk Assessment Team
            Identifying Assets, Vulnerabilities, and Threats
            Likelihood and Potential Loss
            Document Needed Controls
        Risk Response
        Training Employees
        Continuous Monitoring
    Three Types of Contingency Planning
        Incident Response Planning
            Incident Response Team
            IR Plan Process
        Disaster Recovery and Business Continuity Planning
            DR/BC Team
            DR/BC Plan Development
        Testing the Plan
    Special Considerations
        Addressing Compliance Requirements
        When to Call the Police
        Public Relations
    Chapter Summary
    Key Concepts and Terms
    Chapter 14 Assessment
    Endnotes
Chapter 15 Computer Forensics and Investigations
    What Is Computer Forensics?
    What Is the Role of a Computer Forensic Examiner?
    Collecting, Handling, and Using Digital Evidence
        The Investigative Process
            Identification
            Preservation
            Collection
            Examination
            Presentation
        Ethical Principles for Forensic Examination
    Legal Issues Involving Digital Evidence
        Authority to Collect Evidence
            The Fourth Amendment and Search Warrants
            Federal Laws Regarding Electronic Data Collection
        Admissibility of Evidence
            The Hearsay Rule
            The Best Evidence Rule
    Chapter Summary
    Key Concepts and Terms
    Chapter 15 Assessment
    Endnotes
Appendix A Answer Key
Appendix B Standard Acronyms
Appendix C Law and Case Citations
Appendix D The Constitution of the United States of America
Glossary of Key Terms
References
Index