2 Days Left to Save $400 on SANS Scottsdale 2015

Reading Room

Legal Issues

Featuring 39 Papers as of December 2, 2014

  • Evidence Collection From Social Media Sites by Keil Hubert - December 2, 2014 

    Original content written and posted by an individual to a social media site may identify or substantiate an employee's misconduct, whether their own or misconduct by a fellow employee. Capturing evidence from social media sites can significantly support the evidence gathered from other sources (e.g., text messages, e-mails, etc.) in the construction of an event timeline. Proper capture, handling, and presentation of evidence from social media sites will help the investigator explain what happened to upper management, to legal, and to law enforcement agencies.

  • Next Generation Firewalls and Employee Privacy in the Global Enterprise Masters
    by Ryan Firth - September 30, 2014 

    An obligation to protect company resources is something nearly every organization tries to instill in their staff.

  • A Model for Licensing IT Security Masters
    by Mason Pokladnik - August 6, 2013 

    In 2009, the United States' Senate considered legislation that would require the Department of Commerce to create a national licensing, certification and recertification program for information security professionals (Rockefeller, 2009).

  • Legal Issues within Corporate "Bring Your Own Device" Programs by Robert J. Mavretich - December 26, 2012 

    As corporate finance departments look for ways to decrease costs, their eyes and pencils invariably wander to the Information Technology department.

  • Cloud Computing - Maze in the Haze by Godha Iyengar - October 18, 2011 

    In recent days, Cloud Computing has become a great topic of debate in the IT field. Clouds, like solar panels, appear intriguingly simple at first but the details turn out to be more complex than simple pictures and schematics suggest.

  • Solution Architecture for Cyber Deterrence by Thomas Mowbray - April 29, 2010 

    The mission of cyber deterrence is to prevent an enemy from conducting future attacks by changing their minds, by attacking their technology, or by more palpable means. This definition is derived from influential policy papers including Libicki (2009), Beidleman (2009), Alexander (2007), and Kugler (2009). The goal of cyber deterrence is to deny enemies freedom of action in cyberspace (Alexander, 2007). In response to a cyber attack, retaliation is possible, but is not limited to the cyber domain. For example, in the late 90s the Russian government declared that it could respond to a cyber attack with any of its strategic weapons, including nuclear (Libicki, 2009). McAfee estimates that about 120 countries are using the Internet for state-sponsored information operations, primarily espionage (McAfee, 2009).

  • IT Guidance to the Legal Team Masters
    by Brad Ruppert - March 8, 2010 

    Technology can be a great tool to simplify a process or increase the output of existing processes. Despite this, Information Technology (IT) teams must be cautious when implementing new technology into their environment because this can also increase their liability of information retrieval if a lawsuit is filed against them. Rarely if ever is an enterprise application, such as e-discovery software, ready to go out of the box. Most enterprise applications of scale require months of planning, negotiations, architecture discussions, engineering consultation, cross-divisional resource allocation, and process redesign to accommodate the software. Information security and IT teams, knowledgeable of this fact should interface with their legal teams prior to ideation of implementing an enterprise e-discovery tool. Just having a tool and not a defined process to effectively manage, correlate, extract, and secure subpoenaed data can leave a company exposed to multiple financial and legal repercussions. An example of this was seen with the case of Morgan Stanley vs. Ronald Perelman where Morgan Stanley was hit with a $1.75 billion jury verdict, which hinged primarily on the companys lax e-discovery procedures. (Cummings, 2007)

  • Electronic Contracting In An Insecure World Masters
    by Craig Wright - February 1, 2008 

    The paper covers the legal aspects of electronic contracts and the technologies that aid in the creation and preservation of these instruments and the implications associated with online contractual dealings and the issues that have created these uncertainties. It closes by addressing the issues with digital signatures and repudiation concerning online transactions.

  • CyberLaw 101: A primer on US laws related to honeypot deployments Masters
    by Jerome Radcliffe - March 16, 2007 

    A Honeypot is defined as an Internet-attached server that acts as a decoy, luring in potential hackers in order to study their activities and monitor how they are able to break into a system.

  • Information Security and Section 404 of the Sarbanes-Oxley Act by Reed Warner - May 5, 2005 

    In response to the corporate accounting scandals of 2001 the Public Company Accounting and Investor Protection Act of 2002 was passed.

  • The Outsourced Productivity Information Security Risk by Eric Mittler - March 9, 2005 

    Many of your data protection security controls will be by-passed by your vendors if they feel pressured to do so by employees at your company, unless you specifically mitigate this risk.

  • Hearsay and Evidence in the Computer Emergency Response Team (CERT) by Susan Sherman - January 28, 2005 

    The Computer Emergency Response Team (CERT) is responsible for computer related information incident handling within a specific government Agency. Part of that mission is the inherent issue to provide support to law enforcement officials. CERT must provide evidence to those that are going to complete the law enforcement effort of an incident.

  • Ethics in the IT Community by Anthony Bundschuh - January 22, 2005 

    This paper is an overview of the current state of ethics in the IT community. It describes the current state of ethics in IT, identifies the major areas of concern for the IT community, and discusses the relationships an IT professional will face, and the conflicts that may jeopardize those relationships.

  • The Requirements of FDA's 21 CFR Part 11 and Software Programs That Meet the Requirements by Kristine Safi - January 19, 2005 

    With the increased use of electronic records in the Biotechnology Industry, there became a need for requirements to address data security, data integrity and traceability of this data. In response to this need, the Food and Drug Administration (FDA) published a regulation called 21 CFR Part 11, in August of 1997.

  • Federal Computer Crime Laws by Maxim May - August 15, 2004 

    The Internet has been a boon to business, science, education and just about any field you can think of, including crime. Just like every human invention, Internet has two sides to it, on the one hand it allows businesses to be more productive and scientists to share research data almost instantaneously, on the other hand it grants criminals an additional tool to commit crimes and get away with it.

  • An Overview of Sarbanes-Oxley for the Information Security Professional by Gregg Stults - July 25, 2004 

    The Sarbanes-Oxley Act of 2002 has dramatically affected overall awareness and management of internal controls in public corporations. Responsibility for accurate financial reporting has landed squarely on the shoulders of senior management, including the potential for personal criminal liability for CEOs and CFOs.

  • Offshore Outsourcing and Information Confidentiality by Mark Lum - July 25, 2004 

    While recent news headlines of the past few months have focused on the controversial topic of offshore outsourcing of jobs from the United States to countries such as India, China, and Mexico, other headlines, relating to some of the effects of this phenomenon, have exposed problematic consequences and outcomes.

  • Cyber Risk Insurance by Denis Drouin - June 9, 2004 

    Technology has continued to astound the world's electronic culture by reacting with the use of mechanisms to defend and protect against the unknown. Cyber insurance has been one of those phenomenons that has experienced many challenges and at the same time mutated into a more complex tool to protect companies.

  • The Role of IT Security in Sarbanes-Oxley Compliance by Mary Fleming - April 8, 2004 

    This document will summarize the requirements of Sarbanes-Oxley as they apply to IT and define the controls IT must be concerned with in the certification process. This document pertains only to the role of IT and IT security in Sarbanes-Oxley controls compliance; other company departments - accounting, finance, human resources, etc., may be subject to controls not covered herein.

  • U.S. Government IT Security Laws by Trevor Burke - January 11, 2004 

    This document will serve as a guide to those new to federal IT law and address the above four issues, outline the guidelines and steps to ensure successful C&A as designed by NIST, and subsequently address lessons learned from trying to comply with FISMA.

  • Issues in Protecting Our Critical Infrastructure by William Nance - June 2, 2003 

    The Internet has brought many important changes to the way we do business, both in the public and private sectors. We can use it to instantly communicate with others across the country, conduct business meetings, or control equipment in remote locations.

  • E-mail Communication with Patients in the Wake of the HIPAA Final Security Rule by Dennis Schmidt - May 30, 2003 

    This paper will explore the issues that the HIPAA regulations raise with doctor/patient e-mail communications and will discuss some possible solutions.

  • What is the Federal Government Doing to Improve the State of Information Security? by Jason Hiney - April 4, 2003 

    The objective of this paper is to take a broad look at recent Government actions improve the state of information security in the United States and prevent such problems.

  • Running an IT Investigation in the Corporate Environment by Carl Endorf - February 17, 2003 

    This paper describes the issues that are involved in conducting an IT investigation of an incident in a corporate environment.

  • Preparing for HIPAA: Privacy and Security Issues to be Considered by Sherry Fischer - February 9, 2003 

    The Health Insurance Portability and Accountability Act (HIPAA) is imposing privacy and security regulations on health plans, health care clearinghouses, and health care providers.

  • Financial Institutions Required To Do Their Part To Fight Crime by Terry Ritter - February 9, 2003 

    This paper will briefly explain how the U.S. Patriot Act legislation came into existence, but its main focus will be to outline the requirements of the recently proposed Section 326 "Customer Identification Program.

  • An Uneven Playing Field: The Advantages of the Cyber Criminal vs. Law Enforcement-and Some Practical by Torri Piper - September 10, 2002 

    This paper offers some observations of the disparities between the criminals manipulating digital data and law enforcement chasing after them; and tenders some suggestions in an effort to even the playing field.

  • The Legal System and Ethics in Information Security by Amit Philip - July 15, 2002 

    A discussion of the issues faced by the legal system in keeping up with the fast paced development of technology and the ways in which the current laws can help, as well as the role that ethics have to play in the world of computer security.

  • Laws of Canada as they Pertain to Computer Crime by Donna Simmons - May 2, 2002 

    This paper examines the existing laws in the Criminal Code of Canada as they pertain to computer crime.

  • Dangerous Technology: Management Beware by Brent McKinley - March 27, 2002 

    The purpose of this paper is to inform management and upper level administration of the legal liabilities and loss of productivity due to the inappropriate use of the Internet, email, interconnected computer systems and pirated software.

  • The 2001 Patriot Act and Its Implications for the IT Security Professional by Oscar Peterson - February 16, 2002 

    This paper will focus on IT related issues encompassed by the USAPA in general as well as possible actions that could be expected of the IT Security Professional.

  • HIPAA Compliance: Cost-Effective Solutions for the Technical Security Regulations by Tautra Romig - November 21, 2001 

    While HIPAA is comprised of many different regulations, the objective of this document is to suggest cost-effective solutions to the proposed Technical Security Mechanisms regulation.

  • The Ethics and Legality of Port Scanning by Shaun Jamieson - October 8, 2001 

    This paper will define and outline the process of port scanning, discuss ethical and legal issues surrounding port scanning, and assert the importance of strictly defining scanning in an organization's policy.

  • The Art of Enforcement by Jeff Neithercutt - September 28, 2001 

    The careful planning, integration, training, and support of a multi-disciplined group of Incident Responders will continue to be, for most corporations, the last line of defense against computer crimes; and, the better their relationship with the Local, State, and Federal Agencies they work with, the better the success of both their proactive and reactive activities.

  • Malaysian Law and Computer Crime by Wong Yew - August 8, 2001 

    This paper attempts to describe the Malaysian Computer Crimes Act 1997 (CCA 1997) and provide important guidelines for a successful computer crime investigation.

  • System Security and Your Responsibilities: Minimizing Your Liability by Gary Holtz - July 23, 2001 

    A discussion of security policy and procedures, with attention to minimizing liability in the event of computer or network security incidents.

  • A Context-Based Access Control Model for HIPAA Privacy and Security Compliance by Harry Smith - July 18, 2001 

    This paper proposes a new approach to meeting much of the burden imposed by the HIPAA privacy and security requirements

  • Big Brother at the Office: Friend or Foe? by Clint Satterwhite - July 13, 2001 

    This paper outlines most of the issues regarding monitoring of employee workplace computer use and attempts to present an objective presentation of the information from both the employee and employer's perspectives.

  • South Africa - Computer Misuse Act, Proposed by Michael Masters - June 14, 2001 

    This paper looks at this proposed act as well as its application in today's computer environment.

Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact webmaster@sans.org.

All papers are copyrighted. No re-posting or distribution of papers is permitted.

Masters - This paper was created by a SANS Technology Institute student as part of their Master's curriculum.