Transcription
Legal, Ethical, andProfessional Issues inInformation Security3In civilized life, law floats in a sea of ethics.EARL WARREN, CHIEF JUSTICE, U.S. SUPREMECOURT, 12 NOVEMBER 1962HENRY MAGRUDER MADE A MISTAKE—he left a CD at the coffee station. Later, IrisMajwubu was at the coffee station, topping off her mug with fresh tea, hoping to wrap up herwork on the current SQL code module before it was time to go home. As she turned to leave,she saw the unlabeled CD on the counter. Being the helpful sort, she picked it up, intending toreturn it to the person who’d left it behind.Expecting to find perhaps the latest device drivers, or someone’s work from the development team’s office, Iris slipped the disk into the drive of her computer and ran a virus scanagainst its contents. She then opened the file explorer program. She had been correct inassuming the CD contained data files, lots of them. She opened a file at random: names,addresses, and Social Security numbers scrolled down her screen. These were not the testrecords she expected; instead they looked more like critical payroll data. Concerned, she founda readme.txt file and opened it. It read:Jill, see files on this disc. Hope they meet your expectations. Wire money to account as arranged. Rest of data senton payment.Iris realized that someone was selling sensitive company data to an outside informationbroker. She looked back at the directory listing and saw that the files spanned the range ofevery department at Sequential Label and Supply—everything from customer lists to shippinginvoices. She saw one file that she knew contained the credit card numbers for every Web87
88CHAPTER 3customer the company supplied. She opened another file and saw that it stopped abouthalfway through the data. Whoever did this had split the data into two parts. That madesense: payment on delivery of the first half.Now, who did this belong to? She opened up the file properties option on the readme.txtfile. The file owner was listed as “hmagruder.” That must be Henry Magruder, the developertwo cubes over in the next aisle. Iris pondered her next action.LEARNING OBJECTIVES:Upon completion of this material, you should be able to do the following: Use this chapter as a guide for future reference on laws, regulations, and professionalorganizationsDifferentiate between laws and ethicsIdentify major national laws that relate to the practice of information securityUnderstand the role of culture as it applies to ethics in information securityIntroductionThe first part of this chapter focuses on the legislation and regulations that affect themanagement of information in an organization. The second part of the chapter presentsethical issues related to information security as well as a summary of professional organizations with established ethical codes. Use this chapter as both a reference to the legalaspects of information security and as an aide in planning your professional career.As a future information security professional, you must understand the scope of anorganization’s legal and ethical responsibilities. The information security professional playsan important role in an organization’s approach to controlling liability for privacy andsecurity risks. In the modern litigious societies of the world, sometimes laws are enforced incivil courts where large damages are awarded to plaintiffs who bring suits against organizations. Sometimes these damages are punitive—assessed as a deterrent. To minimize liabilityand reduce risks from electronic and physical threats, and to reduce all losses from legalaction, information security practitioners must thoroughly understand the currentlegal environment, stay current with laws and regulations, and watch for new issues as theyemerge. By educating the management and employees of an organization on their legal andethical obligations and the proper use of information technology and information security,security professionals can help keep an organization focused on its primary objectives.Law and Ethics in Information SecurityIn general people elect to trade some aspects of personal freedom for social order. As1Jean-Jacques Rousseau explains in The Social Contract Or Principles Of Political Right(1762), the rules the members of a society create to balance the right of the individual to
L E G A L , E T H I C A L , A N D P R O F E S S I O N A L I S S U E S I N I N F O R M AT I O N S E C U R I T Y89self-determination with the needs of the society as a whole are called laws. Laws are rulesthat mandate or prohibit certain behavior in society; they are drawn from ethics, whichdefine socially acceptable behaviors. The key difference between laws and ethics is thatlaws carry the sanctions of a governing authority and ethics do not. Ethics in turn arebased on cultural mores: the fixed moral attitudes or customs of a particular group. Someethics are recognized as universal. For example, murder, theft, assault, and arson are commonly accepted as actions that deviate from ethical and legal codes in the civilized world.Organizational Liability and the Need for CounselWhat if an organization does not demand or even encourage strong ethical behavior fromits employees? What if an organization does not behave ethically? Even if there is nobreach of criminal law, there can still be liability. Liability is the legal obligation of an entitythat extends beyond criminal or contract law; it includes the legal obligation to makerestitution, or to compensate for wrongs committed by an organization or its employees.The bottom line is that if an employee, acting with or without the authorization of theorganization, performs an illegal or unethical act that causes some degree of harm, theorganization can be held financially liable for that action. An organization increases its liability if it refuses to take measures known as due care. Due care has been taken when anorganization makes sure that every employee knows what is acceptable or unacceptablebehavior, and knows the consequences of illegal or unethical actions. Due diligencerequires that an organization make a valid effort to protect others and continually maintain this level of effort. Given the Internet’s global reach, those who could be injured orwronged by an organization’s members could be anywhere, in any state, any countryaround the world. Under the U.S. legal system, any court can impose its authority over anindividual or organization if it can establish jurisdiction—that is, the court’s right to hear acase if the wrong was committed in its territory or involving its citizenry. This is sometimes referred to as long arm jurisdiction—the long arm of the law reaching across thecountry or around the world to pull an accused individual into its court systems. Trying a2case in the injured party’s home area is usually favorable to the injured party.Policy versus LawWithin an organization, information security professionals help maintain security via theestablishment and enforcement of policies. These policies—a body of expectations thatdescribe acceptable and unacceptable employee behaviors in the workplace—function asorganizational laws, complete with penalties, judicial practices, and sanctions to require compliance. Because these policies function as laws, they must be crafted with the same care, toensure that they are complete, appropriate, and fairly applied to everyone in the workplace.The difference between a policy and a law, however, is that ignorance of a policy is an acceptable defense. Thus, for a policy to become enforceable, it must meet the following five criteria: Dissemination (distribution) – The organization must be able to demonstrate thatthe relevant policy has been made readily available for review by the employee.Common dissemination techniques include hard copy and electronic distribution.Review (reading) – The organization must be able to demonstrate that it disseminated the document in an intelligible form, including versions for illiterate, nonEnglish reading, and reading-impaired employees. Common techniques includerecordings of the policy in English and alternate languages.
90CHAPTER 3 Comprehension (understanding) – The organization must be able to demonstratethat the employee understood the requirements and content of the policy. Commontechniques include quizzes and other assessments.Compliance (agreement) – The organization must be able to demonstrate that theemployee agrees to comply with the policy, through act or affirmation. Commontechniques include logon banners which require a specific action (mouse click orkeystroke) to acknowledge agreement, or a signed document clearly indicating theemployee has read, understood, and agreed to comply with the policy.Uniform enforcement – The organization must be able to demonstrate that the policy has been uniformly enforced, regardless of employee status or assignment.Only when all of these conditions are met can an organization penalize employeeswho violate the policy, without fear of legal retribution.Types of LawCivil law represents a wide variety of laws that govern a nation or state and deal with therelationships and conflicts between organizational entities and people. Criminal lawaddresses violations harmful to society and is actively enforced by the state. The categories of laws that affect the individual in the workplace are private law and public law.Private law regulates the relationship between the individual and the organization, andencompasses family law, commercial law, and labor law. Public law regulates the structureand administration of government agencies and their relationships with citizens, employees, and other governments. Examples of public law include criminal, administrative, andconstitutional law.Relevant U.S. LawsHistorically, the United States has been a leader in the development and implementationof information security legislation to prevent misuse and exploitation of information andinformation technology. The implementation of information security legislation contributes to a more reliable business environment, which, in turn, enables a stable economy. In its global leadership capacity, the U.S. has demonstrated a clear understanding ofthe problems facing the information security field and has specified penalties for individuals and organizations that fail to follow the requirements set forth in the U.S. civilstatutes. The sections that follow present the most important U.S. laws that apply toinformation security.General Computer Crime LawsThere are several key laws relevant to the field of information security and of particularinterest to those who live and/or work in the USA. The Computer Fraud and Abuse Act of1986 (CFA Act) is the cornerstone of many computer-related federal laws and enforcementefforts. It was amended in October 1996 by the National Information InfrastructureProtection Act of 1996, which modified several sections of the previous act and increasedthe penalties for selected crimes. The punishment for offenses prosecuted under thisstatute varies from fines to imprisonment up to 20 years, or both. The severity of the
L E G A L , E T H I C A L , A N D P R O F E S S I O N A L I S S U E S I N I N F O R M AT I O N S E C U R I T Y91penalty depends on the value of the information obtained and whether the offense isjudged to have been committed:1. For purposes of commercial advantage2. For private financial gain3. In furtherance of a criminal actThe previous law was further changed when the USA PATRIOT Act of 2001 modified awide range of existing laws to provide law enforcement agencies with broader latitude inorder to combat terrorism-related activities. The laws modified by the Patriot Act includesome of the earliest laws created to deal with electronic technology. In 2006, this act wasamended further with the USA PATRIOT Improvement and Reauthorization Act, which madepermanent 14 of the 16 expanded powers of the Department of Homeland Security, andthe FBI in investigating terrorist activity. The act also reset the date of expiration writteninto the law as a so called sunset clause for certain wiretaps under the Foreign IntelligenceSurveillance Act of 1978 (FISA), and revised many of the criminal penalties and procedures associated with criminal and terrorist activities.3Another key law is the Computer Security Act of 1987. It was one of the first attemptsto protect federal computer systems by establishing minimum acceptable security practices. The National Bureau of Standards, in cooperation with the National SecurityAgency, became responsible for developing these security standards and guidelines.PrivacyThe issue of privacy has become one of the hottest topics in information security at thebeginning of the 21st century. Many organizations are collecting, swapping, and sellingpersonal information as a commodity, and many people are looking to governments forprotection of their privacy. The ability to collect information, combine facts from separate sources, and merge it all with other information has resulted in databases of information that were previously impossible to set up. One technology that could be used byothers to monitor or track private communications is the Clipper Chip. The Clipper Chipuses an algorithm with a two-part key that was to be managed by two separate government agencies, and it was reportedly designed to protect individual communications4while allowing the government to decrypt suspect transmissions. This technology wasthe focus of discussion between advocates for personal privacy and those seeking toenable more effective law enforcement. Consequently, this technology was never implemented by the U.S. government.In response to the pressure for privacy protection, the number of statutes addressingan individual’s right to privacy has grown. It must be understood, however, that privacyin this context is not absolute freedom from observation, but rather is a more precise5“state of being free from unsanctioned intrusion.” To help you better understand thisrapidly evolving issue, some of the more relevant privacy laws are presented here.Privacy of Customer InformationSome regulations in the U.S. legal code stipulate the responsibilities of common carriers(organizations that process or move data for hire) to protect the confidentiality of customerinformation, including that of other carriers. The Privacy of Customer Information Sectionof the common carrier regulation states that any proprietary information shall be usedexplicitly for providing services, and not for any marketing purposes, and that carriers
92CHAPTER 3cannot disclose this information except when necessary to provide their services. The onlyother exception is when a customer requests the disclosure of information, and then thedisclosure is restricted to that customer’s information only. This law does allow for the useof aggregate information, as long as the same information is provided to all common carriers and all carriers possessing the information engage in fair competitive business practices.Aggregate information is created by combining pieces of nonprivate data—often collectedduring software updates, and via cookies—that when combined may violate privacy.While common carrier regulation regulates public carriers in order to protect individual privacy, The Federal Privacy Act of 1974 regulates government agencies and holdsthem accountable if they release private information about individuals or businesseswithout permission. The following agencies, regulated businesses, and individuals areexempt from some of the regulations so that they can perform their duties: Bureau of the CensusNational Archives and Records AdministrationCongressComptroller GeneralFederal courts with regard to specific issues using appropriate court ordersCredit reporting agenciesIndividuals or organizations that demonstrate that information is necessary to protect the health or safety of that individualThe Electronic Communications Privacy Act of 1986 is a collection of statutes thatregulate the interception of wire, electronic, and oral communications. These statuteswork in conjunction with the Fourth Amendment of the U.S. Constitution, which protectsindividuals from unlawful search and seizure.The Health Insurance Portability and Accountability Act Of 1996 (HIPAA), also known asthe Kennedy-Kassebaum Act, protects the confidentiality and security of health-care data byestablishing and enforcing standards and by standardizing electronic data interchange.HIPAA affects all health-care organizations, including doctors’ practices, health clinics, lifeinsurers, and universities, as well as some organizations that have self-insured employeehealth programs. HIPAA specifies stiff penalties for organizations that fail to comply withthe law, with fines up to 250,000 and/or 10 years imprisonment for knowingly misusing6client information. Organizations were required to comply with the act by April 14, 2003.How does HIPAA affect the field of information security? Beyond the basic privacyguidelines, the act requires organizations that retain health-care information to use information security mechanisms to protect this information, as well as policies and procedures tomaintain this security. It also requires a comprehensive assessment of the organization’s information security systems, policies, and procedures. Electronic signatures have become morecommon, and HIPAA provides guidelines for the use of these signatures based on securitystandards that ensure message integrity, user authentication, and nonrepudiation. There is nospecification of particular security technologies for each of the security requirements, onlythat security must be implemented to ensure the privacy of the health-care information.The privacy standards of HIPAA severely restrict the dissemination and distributionof private health information without documented consent. The standards providepatients with the right to know who has access to their information and who has accessedit. The standards also restrict the use of health information to the minimum necessary forthe health-care services required.
L E G A L , E T H I C A L , A N D P R O F E S S I O N A L I S S U E S I N I N F O R M AT I O N S E C U R I T Y93HIPAA has five fundamental principles:1.2.3.4.Consumer control of medical informationBoundaries on the use of medical informationAccountability for the privacy of private informationBalance of public responsibility for the use of medical information for the greatergood measured against impact to the individual5. Security of health informationThe Financial Services Modernization Act or Gramm-Leach-Bliley Act of 1999 contains a number of provisions focusing on facilitating affiliation among banks, securitiesfirms, and insurance companies. Specifically, this act requires all financial institutions todisclose their privacy policies on the sharing of nonpublic personal information. It alsorequires due notice to customers, so that they can request that their information not beshared with third parties. In addition, the act ensures that the privacy policies in effect inan organization are both fully disclosed when a customer initiates a business relationship,and distributed at least annually for the duration of the professional association.This discussion of information security-related laws is supplemented in Table 3-1.TABLE 3-1Key U.S. Laws of Interest to Information Security ProfessionalsActSubjectDateWeb Resource Location DescriptionCommunications Actof 1934, updated byTelecommunicationsDeregulation andCompetition Actof 1996Telecommunications1934(amended1996 and2001)www.fcc.gov/Reports/1934new.pdfRegulates interstate and foreigntelecommunicationsComputer Fraud andAbuse Act (also knownas Fraud and RelatedActivity in Connectionwith Computers(18 U.S.C. 1030)Threats tocomputers1986(amended1994, 1996,and 2001)www.usdoj.gov/criminal/cybercrime/1030 new.htmlDefines andformalizes laws tocounter threatsfrom computerrelated acts andoffensesComputer Security Actof 1987Federal AgencyInformation Security1987www.cio.gov/Documents/computer securityact Jan 1998.htmlRequires all federalcomputer systemsthat contain classified information tohave surety plans inplace, and requiresperiodic securitytraining for allindividuals whooperate, design, ormanage such systems
Economic EspionageAct of 1996Trade e/eea.htmlDesigned to preventabuse of information gained by anindividual working inone company andemployed by anotherFederal Privacy ActOf ns federalagency use of personal informationGramm-Leach-BlileyAct of 1999 (GLB) orFinancial ServicesModernization es on facilitating affiliationamong banks,insurance, and securities firms; it has significant impact on theprivacy of personalinformation used bythese industriesHealth InsurancePortability andAccountability Act(HIPAA)Health care privacy1996www.hhs.gov/ocr/hipaa/Regulates collection,storage, and transmission of sensitivepersonal health careinformationSarbanes-Oxley Actof 2002Financial s how publicorganizations andaccounting firmsdeal with corporategovernance, financialdisclosure, and thepractice of publicaccountingSecurity and FreedomThrough EncryptionAct of 1999Use and sale of1999software that usesor enables 06:H.R.850.IHClarifies use ofencryption forpeople in the USA andpermits all persons inthe U.S. to buy or sellany encryption product and states that thegovernment cannotrequire the use of anykind of key escrowsystem for encryptionproducts.USA PATRIOTImprovement andReauthorization 32.pdfMade permanent 14of the 16 expandedpowers of theDepartment ofHomeland Securityand the FBI ininvestigatingterrorist activity.2006
L E G A L , E T H I C A L , A N D P R O F E S S I O N A L I S S U E S I N I N F O R M AT I O N S E C U R I T Y95Identity TheftRelated to the legislation on privacy is the increasing body of law on identity theft. TheFederal Trade Commission defines identity theft as “occurring when someone uses yourpersonally identifying information, like your name, Social Security number, or creditcard number, without your permission, to commit fraud or other crimes”. 7 The FTC estimates that perhaps as many as 9 million Americans are faced with identity theft eachyear. Many people, among them perhaps someone you know or even you, have beenaffected by some form of identity theft.8 Organizations can also be victims of identitytheft, as described in the sections in Chapter 2 on URL Manipulation and DNS redirection. This type of crime has caught the attention of the president of the United States: InMay of 2006, President Bush signed an Executive Order creating the Identity Theft TaskForce. The goals of this group are to create a strategic plan to improve efforts of the government and private organizations and individuals in combating identity theft. Thegroup is seeking better coordination among groups, more effective prosecution of criminals engaged in these activities, and methods to increase restitution made to victims.9While numerous states have passed identity theft laws, at the federal level the primarylegislation is the Fraud And Related Activity In Connection With Identification Documents,Authentication Features, And Information (Title 18, U.S.C. § 1028) which criminalizes creation, reproduction, transfer, possession or use of unauthorized or false identification documents or document-making equipment. The penalties for such offenses range from oneto 25 years in prison and fines as determined by the courts.The Federal Trade Commission recommends the following four steps people cantake when they suspect a theft of identity has occurred:1. Report to the three dominant consumer reporting companies that your identity isthreatened so that they may place a fraud alert on your record. This informs currentand potential creditors to follow certain procedures before taking credit-relatedactions.2. If you know which accounts have been compromised, close them. If new accounts areopenind using your identity without your permission, the U.S. FTC has provided adocument template online that may be used to dispute these new accounts. The IDTheft Affidavit can be downloaded as a 56 KB PDF file from 3. Register your concern with the US FTC. If you use the FTC provided complaint format https://rn.ftc.gov/pls/dod/widtpubl .startup?Z ORG CODE PU03.4. Report the incident to either your local police or police in the location where theidentity theft occurred. Use your copy of the FTC ID Theft complaint form to makethe report. Once your police report has been filed, be sure to get a copy of it or elseacquire the police report number.10Export and Espionage LawsThe need for national security, and to protect trade secrets and a variety of other stateand private assets, has led to several laws restricting what information and informationmanagement and security resources may be exported from the United States. These lawsattempt to stem the theft of information by establishing strong penalties for these crimes.In an attempt to protect American ingenuity, intellectual property, and competitiveadvantage, Congress passed the Economic Espionage Act in 1996. This law attempts toprevent trade secrets from being illegally shared.
96CHAPTER 3The Security And Freedom Through Encryption Act of 1999 provides guidance on theuse of encryption, and provides measures of protection from government intervention.The acts include provisions that: Reinforce an individual’s right to use or sell encryption algorithms, without concernfor regulations requiring some form of key registration. Key registration is the storage of a cryptographic key (or its text equivalent) with another party to be used tobreak the encryption of data. This is often called “key escrow.”Prohibit the federal government from requiring the use of encryption for contracts,grants, and other official documents, and correspondence.State that the use of encryption is not probable cause to suspect criminal activity.Relax export restrictions by amending the Export Administration Act of 1979.Provide additional penalties for the use of encryption in the commission of a criminal act.As illustrated in Figure 3-1, the distribution of many software packages is restrictedto approved organizations, governments, and countries.For distributionin the U.S. andCanada onlyFIGURE 3-1 Export and EspionageU.S. Copyright LawIntellectual property is recognized as a protected asset in the United States. The U.S.copyright laws extend this privilege to the published word, including electronic formats.Fair use of copyrighted materials includes their use to support news reporting, teaching,
L E G A L , E T H I C A L , A N D P R O F E S S I O N A L I S S U E S I N I N F O R M AT I O N S E C U R I T Y97scholarship, and a number of other related activities, so long as the use is for educationalor library purposes, not for profit, and is not excessive. As long as proper acknowledgement is provided to the original author of such works, including a proper description ofthe location of source materials (citation), and the work is not represented as one’s own,it is entirely permissible to include portions of someone else’s work as reference. Formore detailed information on copyright regulations, visit the U.S. Copyright Office Website at http://www.copyright.gov.Financial ReportingThe Sarbanes-Oxley Act of 2002 is a critical piece of legislation that affects the executivemanagement of publicly traded corporations and public accounting firms. This law seeksto improve the reliability and accuracy of financial reporting, as well as increase theaccountability of corporate governance, in publicly traded companies. Penalties for noncompliance range from fines to jail terms. Executives working in firms covered by this lawwill seek assurance on the reliability and quality of information systems from seniorinformation technology managers. In turn, IT managers will likely ask information security managers to verify the confidentiality and integrity of those same information systems in a process known in the industry as sub-certification.Freedom of Information Act of 1966 (FOIA)The Freedom of Information Act allows any person to request access to federal agencyrecords or information not determined to be a matter of national security. Agencies ofthe federal government are required to disclose any requested information on receipt of awritten request. This requirement is enforceable in court. Some information is, however,protected from disclosure, and the act does not apply to state or local government agencies or to private businesses or individuals, although many states have their own versionof the FOIA.State and Local RegulationsIn addition to the national and international restrictions placed on organizational use ofcomputer technology, each state or locality may have a number of its own applicable lawsand regulations. Information security professionals must, therefore, understand statelaws and regulations and ensure that the organization’s security policies and procedurescomply with those laws and regulations.For example, in 1991 the state of Georgia passed the Georgia Computer SystemsProtection Act, which seeks to protect information, and which establishes penalties forthe use of information technology to attack or exploit information systems.International Laws and Legal BodiesIt is important for IT professionals and information security practitioners to realize thatwhen their organizations do business on the Internet, they do business globally. As a res
Legal,Ethical,and Professional Issues in Information Security 3 In civilized life, law floats in a sea of ethics. EARL WARREN, CHIEF JUSTICE, U.S. SUPREME COURT, 12 NOVEMBER 1962 HENRY MAGRUDER MADE A MISTAKE—he left a CD at the coffee station. Later, Iris Majwubu was at the coffee station, topping off her mug with fresh tea, hoping to wrap .
