| Preface |
|
xix | |
| Acknowledgments |
|
xxi | |
| About the Author |
|
xxiii | |
|
PART I Fundamental Concepts |
|
|
1 | (84) |
|
Chapter 1 Information Security Overview |
|
|
3 | (28) |
|
Why Is Information Security an Issue? |
|
|
4 | (1) |
|
What Is Information Security? |
|
|
5 | (1) |
|
|
|
6 | (1) |
|
|
|
7 | (1) |
|
|
|
8 | (2) |
|
Basic Information Security Concepts |
|
|
10 | (1) |
|
|
|
10 | (2) |
|
|
|
12 | (2) |
|
|
|
14 | (1) |
|
|
|
15 | (3) |
|
|
|
18 | (1) |
|
What Are Common Information Security Concerns? |
|
|
18 | (1) |
|
|
|
18 | (1) |
|
|
|
19 | (1) |
|
Phishing and Targeted Phishing Scams |
|
|
19 | (1) |
|
|
|
20 | (1) |
|
Spyware and Keystroke Loggers |
|
|
21 | (1) |
|
|
|
21 | (1) |
|
|
|
22 | (1) |
|
Denial of Service Attacks |
|
|
22 | (1) |
|
What Are the Mechanisms That Ensure Information Security? |
|
|
23 | (1) |
|
|
|
23 | (1) |
|
|
|
23 | (1) |
|
Organizational Governance |
|
|
24 | (1) |
|
|
|
24 | (1) |
|
U.S. National Security Information |
|
|
25 | (1) |
|
|
|
26 | (1) |
|
Do Special Kinds of Data Require Special Kinds of Protection? |
|
|
26 | (1) |
|
|
|
27 | (1) |
|
|
|
28 | (1) |
|
|
|
28 | (1) |
|
|
|
29 | (2) |
|
Chapter 2 Privacy Overview |
|
|
31 | (32) |
|
|
|
32 | (1) |
|
|
|
33 | (1) |
|
Types of Personal Information |
|
|
34 | (1) |
|
How Is Privacy Different from Information Security? |
|
|
35 | (1) |
|
What Are the Sources of Privacy Law? |
|
|
36 | (1) |
|
|
|
36 | (2) |
|
|
|
38 | (2) |
|
Freedom of Information Act (1966) |
|
|
38 | (1) |
|
|
|
39 | (1) |
|
|
|
39 | (1) |
|
Electronic Communications Privacy Act (1986) |
|
|
39 | (1) |
|
The Wiretap Act (1968, amended) |
|
|
39 | (1) |
|
Census Confidentiality (1952) |
|
|
39 | (1) |
|
Mail Privacy Statute (1971) |
|
|
40 | (1) |
|
Cable Communications Policy Act (1984) |
|
|
40 | (1) |
|
Driver's Privacy Protection Act (1994) |
|
|
40 | (1) |
|
|
|
40 | (1) |
|
|
|
41 | (2) |
|
|
|
41 | (1) |
|
Portrayal in a False Light |
|
|
42 | (1) |
|
Appropriation of Likeness or Identity |
|
|
42 | (1) |
|
Public Disclosure of Private Facts |
|
|
42 | (1) |
|
|
|
43 | (1) |
|
What Are Threats to Personal Data Privacy in the Information Age? |
|
|
44 | (1) |
|
Technology-Based Privacy Concerns |
|
|
44 | (5) |
|
|
|
44 | (1) |
|
Cookies, Web Beacons, and Clickstreams |
|
|
45 | (2) |
|
|
|
47 | (1) |
|
|
|
48 | (1) |
|
|
|
48 | (1) |
|
People-Based Privacy Concerns |
|
|
49 | (2) |
|
|
|
50 | (1) |
|
|
|
51 | (1) |
|
What Is Workplace Privacy? |
|
|
51 | (1) |
|
Telephone, Voicemail, and Email Monitoring |
|
|
52 | (2) |
|
Telephone and Voicemail Monitoring |
|
|
52 | (1) |
|
|
|
53 | (1) |
|
|
|
54 | (1) |
|
Off-Duty Computer Monitoring |
|
|
55 | (1) |
|
Video Surveillance Monitoring |
|
|
55 | (2) |
|
Special Rules for Public Employees |
|
|
56 | (1) |
|
Whet Are General Principles for Privacy Protection in Information Systems? |
|
|
57 | (1) |
|
|
|
58 | (1) |
|
International Privacy Laws |
|
|
59 | (1) |
|
|
|
59 | (1) |
|
|
|
60 | (1) |
|
|
|
60 | (1) |
|
|
|
61 | (2) |
|
Chapter 3 The American Legal System |
|
|
63 | (22) |
|
The American Legal System |
|
|
64 | (1) |
|
|
|
64 | (6) |
|
|
|
65 | (2) |
|
|
|
67 | (1) |
|
|
|
67 | (3) |
|
|
|
70 | (3) |
|
|
|
73 | (1) |
|
|
|
73 | (1) |
|
|
|
74 | (1) |
|
|
|
74 | (1) |
|
How Does It All Fit Together? |
|
|
74 | (1) |
|
|
|
75 | (1) |
|
|
|
75 | (1) |
|
|
|
76 | (1) |
|
|
|
77 | (1) |
|
|
|
78 | (1) |
|
|
|
79 | (1) |
|
What Is the Difference Between Compliance and Audit? |
|
|
80 | (1) |
|
How Do Security, Privacy, and Compliance Fit Together? |
|
|
81 | (1) |
|
|
|
82 | (1) |
|
|
|
82 | (1) |
|
|
|
83 | (1) |
|
|
|
84 | (1) |
|
PART II Laws Influencing Information Security |
|
|
85 | (266) |
|
Chapter 4 Security and Privacy of Consumer Financial Information |
|
|
87 | (28) |
|
Business Challenges Facing Financial Institutions |
|
|
88 | (1) |
|
The Different Types of Financial Institutions |
|
|
89 | (1) |
|
Consumer Financial Information |
|
|
90 | (1) |
|
Who Regulates Financial Institutions? |
|
|
90 | (1) |
|
The Federal Reserve System |
|
|
91 | (1) |
|
Federal Deposit Insurance Corporation |
|
|
92 | (1) |
|
National Credit Union Administration |
|
|
93 | (1) |
|
Office of the Comptroller of the Currency |
|
|
94 | (1) |
|
Special Role of the Federal Financial Institutions Examination Council |
|
|
95 | (1) |
|
Special Roles of the Consumer Financial Protection Bureau and the Federal Trade Commission |
|
|
96 | (1) |
|
Consumer Financial Protection Bureau |
|
|
96 | (1) |
|
|
|
96 | (1) |
|
The Gramm-Leach-Bliley Act |
|
|
97 | (1) |
|
Purpose, Scope, and Main Requirements |
|
|
97 | (1) |
|
|
|
98 | (1) |
|
|
|
99 | (3) |
|
|
|
102 | (1) |
|
|
|
103 | (1) |
|
Federal Trade Commission Red Flags Rule |
|
|
103 | (1) |
|
|
|
103 | (1) |
|
|
|
103 | (1) |
|
|
|
104 | (1) |
|
|
|
105 | (1) |
|
Payment Card Industry Standards |
|
|
106 | (1) |
|
|
|
107 | (1) |
|
|
|
107 | (1) |
|
|
|
108 | (1) |
|
|
|
108 | (1) |
|
Case Studies and Examples |
|
|
109 | (1) |
|
FTC Privacy and Safeguards Rule Enforcement |
|
|
109 | (1) |
|
Credit Card Security Example |
|
|
110 | (1) |
|
|
|
111 | (1) |
|
|
|
111 | (1) |
|
|
|
111 | (1) |
|
|
|
112 | (3) |
|
Chapter 5 Security and Privacy of Information Belonging to Children and in Educational Records |
|
|
115 | (24) |
|
Challenges in Protecting Children on the Internet |
|
|
116 | (1) |
|
Identification of Children |
|
|
117 | (1) |
|
First Amendment and Censorship |
|
|
118 | (1) |
|
|
|
118 | (1) |
|
Children's Online Privacy Protection Act |
|
|
119 | (1) |
|
|
|
119 | (1) |
|
|
|
120 | (1) |
|
|
|
121 | (3) |
|
|
|
121 | (1) |
|
|
|
121 | (1) |
|
|
|
122 | (2) |
|
|
|
124 | (1) |
|
Children's Internet Protection Act |
|
|
124 | (1) |
|
|
|
124 | (1) |
|
|
|
125 | (1) |
|
|
|
125 | (3) |
|
|
|
125 | (2) |
|
|
|
127 | (1) |
|
|
|
127 | (1) |
|
|
|
128 | (1) |
|
Family Educational Rights and Privacy Act (FERPA) |
|
|
128 | (1) |
|
|
|
128 | (1) |
|
|
|
129 | (3) |
|
|
|
130 | (1) |
|
Access to Education Records |
|
|
130 | (1) |
|
Amendment of Education Records |
|
|
131 | (1) |
|
Disclosure of Education Records |
|
|
131 | (1) |
|
Disclosure Exceptions Under FERPA |
|
|
132 | (1) |
|
Security of Student Records Under FERPA |
|
|
133 | (1) |
|
|
|
133 | (1) |
|
State Laws Protecting Student Data |
|
|
134 | (1) |
|
Case Studies and Examples |
|
|
134 | (1) |
|
|
|
135 | (1) |
|
Release of Disciplinary Records |
|
|
135 | (1) |
|
|
|
136 | (1) |
|
|
|
136 | (1) |
|
|
|
137 | (1) |
|
|
|
138 | (1) |
|
Chapter 6 Security and Privacy of Health Information |
|
|
139 | (36) |
|
Business Challenges Facing the Healthcare Industry |
|
|
140 | (1) |
|
Why Is Healthcare Information So Sensitive? |
|
|
141 | (2) |
|
The Health Insurance Portability and Accountability Act |
|
|
143 | (1) |
|
|
|
143 | (2) |
|
|
|
145 | (2) |
|
Main Requirements of the Privacy Rule |
|
|
147 | (14) |
|
|
|
148 | (1) |
|
Permitted Uses and Disclosures |
|
|
149 | (5) |
|
Uses and Disclosures That Require Authorization |
|
|
154 | (1) |
|
|
|
155 | (1) |
|
Other Individual Rights Under the Privacy Rule |
|
|
155 | (2) |
|
|
|
157 | (2) |
|
Administrative Requirements |
|
|
159 | (1) |
|
Breach Notification Provisions |
|
|
160 | (1) |
|
Main Requirements of the Security Rule |
|
|
161 | (7) |
|
Safeguards and Implementation Specifications |
|
|
162 | (6) |
|
|
|
168 | (1) |
|
The Role of State Laws Protecting Medical Records |
|
|
169 | (1) |
|
Case Studies and Examples |
|
|
169 | (1) |
|
OCR Enforcement Information |
|
|
169 | (1) |
|
HIPAA and Federal Trade Communications Act |
|
|
169 | (2) |
|
|
|
171 | (1) |
|
|
|
171 | (1) |
|
|
|
171 | (1) |
|
|
|
172 | (3) |
|
Chapter 7 Corporate Information Security and Privacy Regulation |
|
|
175 | (26) |
|
The Enron Scandal and Securities-Law Reform |
|
|
176 | (1) |
|
|
|
176 | (3) |
|
Why Is Accurate Financial Reporting Important? |
|
|
179 | (2) |
|
The Sarbanes-Oxley Act of 2002 |
|
|
181 | (1) |
|
|
|
182 | (1) |
|
|
|
183 | (8) |
|
Public Company Accounting Oversight Board |
|
|
183 | (2) |
|
|
|
185 | (2) |
|
|
|
187 | (4) |
|
|
|
191 | (1) |
|
Compliance and Security Controls |
|
|
192 | (1) |
|
|
|
192 | (1) |
|
|
|
192 | (1) |
|
|
|
193 | (1) |
|
NIST Computer Security Guidance |
|
|
194 | (1) |
|
SOX Influence in Other Types of Companies |
|
|
194 | (1) |
|
|
|
195 | (1) |
|
Case Studies and Examples |
|
|
196 | (1) |
|
|
|
197 | (1) |
|
|
|
197 | (1) |
|
|
|
197 | (1) |
|
|
|
198 | (3) |
|
Chapter 8 Federal Government Information Security and Privacy Regulations |
|
|
201 | (24) |
|
Information Security Challenges Facing the Federal Government |
|
|
202 | (2) |
|
The Federal Information Security Modernization Act |
|
|
204 | (1) |
|
|
|
204 | (1) |
|
|
|
204 | (9) |
|
Agency Information Security Programs |
|
|
204 | (3) |
|
|
|
207 | (4) |
|
Central Incident Response Center |
|
|
211 | (1) |
|
National Security Systems |
|
|
212 | (1) |
|
|
|
213 | (1) |
|
Protecting Privacy in Federal Information Systems |
|
|
214 | (1) |
|
|
|
214 | (1) |
|
The E-Government Act of 2002 |
|
|
215 | (2) |
|
0MB Breach Notification Policy |
|
|
217 | (1) |
|
Import and Export Control Laws |
|
|
218 | (1) |
|
Case Studies and Examples |
|
|
219 | (1) |
|
|
|
220 | (1) |
|
|
|
221 | (1) |
|
|
|
221 | (1) |
|
|
|
222 | (3) |
|
Chapter 9 State Laws Protecting Citizen Information and Breach Notification Laws |
|
|
225 | (24) |
|
History of State Actions to Protect Personal Information |
|
|
226 | (1) |
|
|
|
226 | (1) |
|
Breach Notification Regulations |
|
|
227 | (1) |
|
California Breach Notification Act |
|
|
228 | (2) |
|
Other Breach Notification Laws |
|
|
230 | (4) |
|
Activities That Constitute a Breach |
|
|
230 | (1) |
|
|
|
230 | (1) |
|
|
|
231 | (1) |
|
|
|
232 | (1) |
|
Penalties for Failure to Notify |
|
|
232 | (1) |
|
|
|
233 | (1) |
|
Data-Specific Security and Privacy Regulations |
|
|
234 | (1) |
|
Minnesota and Nevada: Requiring Businesses to Comply With Payment Card Industry Standards |
|
|
234 | (2) |
|
Indiana: Limiting SSN Use and Disclosure |
|
|
236 | (2) |
|
California: Protecting Consumer Privacy |
|
|
238 | (1) |
|
|
|
239 | (1) |
|
Massachusetts: Protecting Personal Information |
|
|
239 | (2) |
|
Nevada Law: Standards-Based Encryption |
|
|
241 | (1) |
|
Data Disposal Regulations |
|
|
242 | (1) |
|
Washington: Everyone Has an Obligation |
|
|
242 | (1) |
|
New York: Any Physical Record |
|
|
243 | (1) |
|
Case Studies and Examples |
|
|
244 | (1) |
|
|
|
245 | (1) |
|
|
|
245 | (1) |
|
|
|
246 | (1) |
|
|
|
247 | (2) |
|
Chapter 10 Intellectual Property Law |
|
|
249 | (36) |
|
The Digital Wild West and the Importance of Intellectual Property Law |
|
|
250 | (1) |
|
Legal Ownership and the Importance of Protecting Intellectual Property |
|
|
250 | (2) |
|
|
|
252 | (1) |
|
|
|
253 | (3) |
|
|
|
253 | (3) |
|
The Patent Application Process |
|
|
256 | (1) |
|
Infringement and Remedies |
|
|
257 | (1) |
|
What Is the Difference Between Patents and Trade Secrets? |
|
|
258 | (1) |
|
|
|
259 | (2) |
|
|
|
261 | (2) |
|
|
|
262 | (1) |
|
|
|
262 | (1) |
|
|
|
263 | (2) |
|
Infringement and Remedies |
|
|
265 | (1) |
|
Relationship of Trademarks on Domain Names |
|
|
266 | (2) |
|
|
|
268 | (1) |
|
|
|
268 | (2) |
|
|
|
270 | (1) |
|
Infringement and Remedies |
|
|
271 | (3) |
|
|
|
272 | (2) |
|
Protecting Copyrights Online--The Digital Millennium Copyright Act (DMCA) |
|
|
274 | (1) |
|
|
|
274 | (3) |
|
Technology Protection Measures |
|
|
274 | (2) |
|
Online Copyright Infringement |
|
|
276 | (1) |
|
|
|
277 | (1) |
|
DMCA Unintended Consequences |
|
|
277 | (1) |
|
|
|
278 | (1) |
|
|
|
278 | (1) |
|
Case Studies and Examples |
|
|
278 | (1) |
|
|
|
278 | (1) |
|
Service Provider Liability for Copyright Infringement |
|
|
279 | (1) |
|
|
|
280 | (1) |
|
|
|
280 | (1) |
|
|
|
281 | (1) |
|
|
|
281 | (1) |
|
|
|
282 | (3) |
|
Chapter 11 The Role of Contracts |
|
|
285 | (32) |
|
General Contracting Principles |
|
|
286 | (1) |
|
|
|
286 | (1) |
|
|
|
287 | (1) |
|
|
|
288 | (1) |
|
|
|
288 | (1) |
|
|
|
289 | (2) |
|
|
|
291 | (1) |
|
|
|
291 | (1) |
|
Performance and Breach of Contract |
|
|
292 | (2) |
|
|
|
294 | (1) |
|
|
|
295 | (2) |
|
|
|
297 | (1) |
|
Form of Offer and Acceptance |
|
|
297 | (3) |
|
|
|
298 | (1) |
|
Text and Instant Messages |
|
|
298 | (1) |
|
Twitter and Other Social Networking Sites |
|
|
299 | (1) |
|
Existence and Enforcement |
|
|
300 | (1) |
|
Authenticity and Nonrepudiation |
|
|
300 | (1) |
|
Special Types of Contracts in Cyberspace |
|
|
301 | (2) |
|
|
|
303 | (1) |
|
|
|
303 | (2) |
|
|
|
305 | (1) |
|
How Do These Contracts Regulate Behavior? |
|
|
306 | (1) |
|
Emerging Contract Law Issues |
|
|
307 | (1) |
|
|
|
308 | (1) |
|
Information Security Terms in Contracts |
|
|
309 | (3) |
|
|
|
310 | (1) |
|
General Data Protection Terms |
|
|
310 | (1) |
|
Compliance With Legal and Regulatory Requirements |
|
|
311 | (1) |
|
Case Studies and Examples |
|
|
312 | (1) |
|
Contract Formation via Email |
|
|
312 | (1) |
|
|
|
313 | (1) |
|
|
|
313 | (1) |
|
|
|
314 | (1) |
|
|
|
315 | (2) |
|
Chapter 12 Criminal Law and Tort Law Issues in Cyberspace |
|
|
317 | (34) |
|
General Criminal Law Concepts |
|
|
318 | (1) |
|
Main Principles of Criminal Law |
|
|
319 | (4) |
|
|
|
319 | (1) |
|
|
|
319 | (2) |
|
|
|
321 | (2) |
|
|
|
323 | (3) |
|
Common Criminal Laws Used in Cyberspace |
|
|
326 | (1) |
|
The Computer Fraud and Abuse Act (1984) |
|
|
326 | (3) |
|
Computer Trespass or Intrusion |
|
|
329 | (1) |
|
|
|
329 | (1) |
|
Interception of Communications Laws |
|
|
330 | (1) |
|
|
|
330 | (2) |
|
|
|
332 | (1) |
|
|
|
332 | (1) |
|
|
|
333 | (1) |
|
General Tort Law Concepts |
|
|
334 | (1) |
|
|
|
334 | (1) |
|
|
|
335 | (2) |
|
|
|
337 | (1) |
|
|
|
338 | (3) |
|
Common Tort Law Actions in Cyberspace |
|
|
341 | (1) |
|
|
|
341 | (2) |
|
Intentional Infliction of Emotional Distress |
|
|
343 | (1) |
|
|
|
344 | (1) |
|
|
|
345 | (1) |
|
Case Studies and Examples |
|
|
346 | (1) |
|
|
|
346 | (1) |
|
Defamation on College Campuses |
|
|
346 | (1) |
|
|
|
347 | (1) |
|
|
|
347 | (1) |
|
|
|
348 | (1) |
|
|
|
349 | (2) |
|
PART III Security and Privacy in Organizations |
|
|
351 | (96) |
|
Chapter 13 Information Security Governance |
|
|
353 | (34) |
|
What Is Information Security Governance? |
|
|
354 | (1) |
|
Information Security Governance Planning |
|
|
355 | (1) |
|
Common Information Security Governance Roles |
|
|
356 | (1) |
|
Information Security Governance and Management |
|
|
357 | (1) |
|
Information Security Governance in the Federal Government |
|
|
358 | (1) |
|
Information Security Governance Documents |
|
|
359 | (1) |
|
|
|
360 | (1) |
|
|
|
361 | (1) |
|
|
|
361 | (1) |
|
|
|
362 | (1) |
|
Creating Information Security Policies |
|
|
363 | (4) |
|
Policy Development Process |
|
|
363 | (4) |
|
Recommended Information Security Policies |
|
|
367 | (1) |
|
|
|
368 | (4) |
|
|
|
370 | (1) |
|
|
|
371 | (1) |
|
|
|
372 | (1) |
|
Workplace Privacy and Monitoring Policies |
|
|
373 | (1) |
|
Data Retention and Destruction Policies |
|
|
374 | (3) |
|
|
|
375 | (1) |
|
Data Destruction Policies |
|
|
376 | (1) |
|
Intellectual Property Policies |
|
|
377 | (1) |
|
Authentication and Password Policies |
|
|
377 | (2) |
|
Security Awareness and Training |
|
|
379 | (1) |
|
Case Studies and Examples |
|
|
380 | (1) |
|
Acceptable Use Case Study |
|
|
380 | (2) |
|
|
|
382 | (1) |
|
|
|
382 | (1) |
|
|
|
383 | (1) |
|
|
|
384 | (3) |
|
Chapter 14 Risk Analysis, Incident Response, and Contingency Planning |
|
|
387 | (32) |
|
|
|
388 | (1) |
|
|
|
389 | (1) |
|
|
|
390 | (10) |
|
|
|
391 | (1) |
|
Identifying Assets, Vulnerabilities, and Threats |
|
|
392 | (2) |
|
Likelihood and Potential Loss |
|
|
394 | (4) |
|
|
|
398 | (2) |
|
|
|
400 | (1) |
|
|
|
401 | (1) |
|
|
|
401 | (1) |
|
Three Types of Contingency Planning |
|
|
401 | (1) |
|
Incident Response Planning |
|
|
402 | (5) |
|
|
|
403 | (1) |
|
|
|
404 | (3) |
|
Disaster Recovery and Business Continuity Planning |
|
|
407 | (5) |
|
|
|
408 | (1) |
|
|
|
409 | (3) |
|
|
|
412 | (2) |
|
|
|
414 | (1) |
|
Addressing Compliance Requirements |
|
|
414 | (1) |
|
|
|
415 | (1) |
|
|
|
415 | (1) |
|
|
|
416 | (1) |
|
|
|
416 | (1) |
|
|
|
417 | (1) |
|
|
|
418 | (1) |
|
Chapter 15 Computer Forensics and Investigations |
|
|
419 | (28) |
|
What Is Computer Forensics? |
|
|
420 | (3) |
|
What Is the Role of a Computer Forensic Examiner? |
|
|
423 | (2) |
|
Collecting, Handling, and Using Digital Evidence |
|
|
425 | (1) |
|
The Investigative Process |
|
|
426 | (5) |
|
|
|
426 | (1) |
|
|
|
426 | (1) |
|
|
|
427 | (2) |
|
|
|
429 | (1) |
|
|
|
430 | (1) |
|
Ethical Principles for Forensic Examination |
|
|
431 | (1) |
|
Legal Issues Involving Digital Evidence |
|
|
432 | (1) |
|
Authority to Collect Evidence |
|
|
432 | (7) |
|
The Fourth Amendment and Search Warrants |
|
|
432 | (3) |
|
Federal Laws Regarding Electronic Data Collection |
|
|
435 | (4) |
|
Admissibility of Evidence |
|
|
439 | (3) |
|
|
|
441 | (1) |
|
|
|
442 | (1) |
|
|
|
442 | (1) |
|
|
|
442 | (1) |
|
|
|
443 | (1) |
|
|
|
444 | (3) |
| Appendix A Answer Key |
|
447 | (4) |
| Appendix B Standard Acronyms |
|
451 | (4) |
| Appendix C Law and Case Citations |
|
455 | (10) |
| Appendix D The Constitution of the United States of America |
|
465 | (18) |
| Glossary of Key Terms |
|
483 | (12) |
| References |
|
495 | (18) |
| Index |
|
513 | |
