Chapter 9: Legal, Regulations, Compliance, and Investigations - Fraud and Abuse Attack Types

Salami - bunch of small crimes in hopes a larger one will be looked over.

Data Diddling - Altering data.

Password Sniffing - Trying to catch passwords being sent from place to place.

IP Spoofing - Changing IP address so that it is harder for criminal to get caught

Dumpster Diving - Looking through trash data in hopes of finding something valuable.

Wiretapping - Any form of eavesdropping that uses tech.

Cybersquatting - Good example is purchasing a domain name that is extremely similar to the company that the person wants to take away business from. Goal is to reduce traffic to real site and carry out extortion.

Chapter 9: Legal, Regulations, Compliance, and Investigations - Investigations Continued

Just like traditional criminals, computer criminals have a reason for doing the bad things that they do. There are three terms that help better put criminal activity into perspective.

Motive-why the person is committing the crime. It could be for monetary gain, or simply because they get a rush by seeing if they can get away with it.

Opportunity-Where and when the crime happens. If a criminal sees that a companies firewall is down at a certain time, this is their time to attack.

Means-Does the criminal have what it takes to commit the crime they want to? This could include intellect and the hardware necessary to commit the crime.

Types of Evidence:
Best- primary; provides the most reliability
Secondary- unreliable evidence
Direct- fact proving evidence
Conclusive- cannot be contradicted
Circumstantial- proves intermediate facts
Corroborative- supporting that helps prove something else
Opinion- opinion rule; can only testify to the facts
Hearsay- written or oral; no firsthand proof

Chapter 9: Legal, Regulations, Compliance, and Investigations - Investigations

A lot of the time, the person that is done wrong in a computer crime is not even aware of it. There is a difference between an event and an incident concerning incident management. Events can be documented and observed. An incident is many of these negative events that hurt a company. The study guide makes a point to mention that most companies do not even have an incident management program. They just have a response process. The study guide goes even further stating that companies need to have an incident management process, because there is no sense in having a plan if you do not even know the bad things thats are going on. The definition of investigation from a computer security standpoint is pretty standard. You collect data, and analyze it to find out how bad the incident was/is and figure out how the incident happened.

Chapter 9: Legal, Regulations, Compliance, and Investigations - Liability and Its Ramifications

Not only should lawmakers refine what a computer crime is and its consequences but corporations should as well. They have to take responsibility for the crimes that they might potentially be liable for, and take precautions and measures to prevent these types of things from happening. no company wants to be hit with a fine for something they did that they were not aware was against the law. This is why it is so important to stay on top of emerging computing laws and standards. When a company has done all that it can do to to prevent bad things from happening, it is known as due care. In other words, the company did everything it was supposed to do to prevent against crime. Due diligence is kind of opposite, in that it made sure that it was not in violation of any rules and regulations. Downstream liability means that companies are not unlawfully affecting other companies.

Chapter 9: Legal, Regulations, Compliance, and Investigations - Privacy

Here I want to list what the study guide states is personally identifiable information. I did not know that there was a distinct list for this and I find it interesting.

-Full Name
-National Identification Number (SSN)
-Sometimes an IP address can be used here
- Tag number of a vehicle
- DL number
- Someone's face
-Fingerprints
-A person's handwriting
-Credit card numbers
-A digital id
-Birthdate
-place of birth
-Genetic code (DNA I'm assuming)

Privacy is always threatened these days since we are so reliant on technology. Privacy must be a main concern for three main reasons. More and more data centers are being built and maintained that include a plethora of valuable, personal info. Also, globalization is occurring at a rapid pace. All of your personal data can be transferred to foreign places in an instant! Finally, BI is big these days, and information like could be very valuable to certain individuals. Privacy laws are emerging at a rapid pace. This is why becoming a CISSP might be a great career choice as they will be needed more and more as time progresses.  

Chapter 9: Legal, Regulations, Compliance, and Investigations - Intellectual Property Laws

There are four main intellectual property laws. The first is a trade secret.  These are proprietary to a company, and are vital to the success of it. Non-disclosure agreements are common if you go to work for a company with trade secrets. An example of a trade secret is the formula used in a soft drink. Second, there is copyright law. It protects an author or maker of something. The author controls the distribution, replication, and changes to their work. Even computer programs can be copyrighted. The third type is a trademark. The trademark is essentially used to protect the identity of something. This is why you see the small c or TM next to logos. The last type of intellectual property law is a patent. They are used to protect a company's or individual's inventions. After an invention is patented, others cannot make, use, or sell the invention without permission from the original inventor, or until the patent expires.

Chapter 9: Legal, Regulations, Compliance, and Investigations - Types of Legal Systems

Civil (Code) Law System
- Used in Eurpoe
- Based on rules not precedence

Common Law System
- Based on previous interpretations of the law. Uses judges and juries - what we have in the U.S.
- Broken down into criminal and civil law.
  -Criminal law: behavior that hurts other people
  -Civil law: Here, the wrongdoer "owes" the victim restitution.

Customary Law System
- Used in countries such as China or India
- Based on the traditions of a place
- Looks at a person's behavioral pattern

Religious Law System
- Laws are not created, they are "uncovered" based on particular religions
- Morality is usually included in this type of system
- Laws and rules are from God, not made and implemented by humans.
- Is often used in Islamic countries based on the Koran.

Mixed Law System
- Two or more systems are used together
- Different types of law will often be associated with different kinds of crimes
- Countries that use this type are Canada and Holland