Featuring 37 Papers as of August 6, 2013
A Model for Licensing IT Security Masters
Mason Pokladnik - August 6, 2013
In 2009, the United States' Senate considered legislation that would require the Department of Commerce to create a national licensing, certification and recertification program for information security professionals (Rockefeller, 2009).
Legal Issues within Corporate "Bring Your Own Device" Programs
Robert J. Mavretich - December 26, 2012
As corporate finance departments look for ways to decrease costs, their eyes and pencils invariably wander to the Information Technology department.
Cloud Computing - Maze in the Haze
Godha Iyengar - October 18, 2011
In recent days, Cloud Computing has become a great topic of debate in the IT field. Clouds, like solar panels, appear intriguingly simple at first but the details turn out to be more complex than simple pictures and schematics suggest.
Solution Architecture for Cyber Deterrence
Thomas Mowbray - April 29, 2010
The mission of cyber deterrence is to prevent an enemy from conducting future attacks by changing their minds, by attacking their technology, or by more palpable means. This definition is derived from influential policy papers including Libicki (2009), Beidleman (2009), Alexander (2007), and Kugler (2009). The goal of cyber deterrence is to deny enemies freedom of action in cyberspace (Alexander, 2007). In response to a cyber attack, retaliation is possible, but is not limited to the cyber domain. For example, in the late 90s the Russian government declared that it could respond to a cyber attack with any of its strategic weapons, including nuclear (Libicki, 2009). McAfee estimates that about 120 countries are using the Internet for state-sponsored information operations, primarily espionage (McAfee, 2009).
IT Guidance to the Legal Team Masters
Brad Ruppert - March 8, 2010
Technology can be a great tool to simplify a process or increase the output of existing processes. Despite this, Information Technology (IT) teams must be cautious when implementing new technology into their environment because this can also increase their liability of information retrieval if a lawsuit is filed against them. Rarely if ever is an enterprise application, such as e-discovery software, ready to go out of the box. Most enterprise applications of scale require months of planning, negotiations, architecture discussions, engineering consultation, cross-divisional resource allocation, and process redesign to accommodate the software. Information security and IT teams, knowledgeable of this fact should interface with their legal teams prior to ideation of implementing an enterprise e-discovery tool. Just having a tool and not a defined process to effectively manage, correlate, extract, and secure subpoenaed data can leave a company exposed to multiple financial and legal repercussions. An example of this was seen with the case of Morgan Stanley vs. Ronald Perelman where Morgan Stanley was hit with a $1.75 billion jury verdict, which hinged primarily on the companys lax e-discovery procedures. (Cummings, 2007)
Electronic Contracting In An Insecure World Masters
Craig Wright - February 1, 2008
The paper covers the legal aspects of electronic contracts and the technologies that aid in the creation and preservation of these instruments and the implications associated with online contractual dealings and the issues that have created these uncertainties. It closes by addressing the issues with digital signatures and repudiation concerning online transactions.
CyberLaw 101: A primer on US laws related to honeypot deployments Masters
Jerome Radcliffe - March 16, 2007
A Honeypot is defined as an Internet-attached server that acts as a decoy, luring in potential hackers in order to study their activities and monitor how they are able to break into a system.
Information Security and Section 404 of the Sarbanes-Oxley Act
Reed Warner - May 5, 2005
In response to the corporate accounting scandals of 2001 the Public Company Accounting and Investor Protection Act of 2002 was passed.
The Outsourced Productivity Information Security Risk
Eric Mittler - March 9, 2005
Many of your data protection security controls will be by-passed by your vendors if they feel pressured to do so by employees at your company, unless you specifically mitigate this risk.
Hearsay and Evidence in the Computer Emergency Response Team (CERT)
Susan Sherman - January 28, 2005
The Computer Emergency Response Team (CERT) is responsible for computer related information incident handling within a specific government Agency. Part of that mission is the inherent issue to provide support to law enforcement officials. CERT must provide evidence to those that are going to complete the law enforcement effort of an incident.
Ethics in the IT Community
Anthony Bundschuh - January 22, 2005
This paper is an overview of the current state of ethics in the IT community. It describes the current state of ethics in IT, identifies the major areas of concern for the IT community, and discusses the relationships an IT professional will face, and the conflicts that may jeopardize those relationships.
The Requirements of FDA's 21 CFR Part 11 and Software Programs That Meet the Requirements
Kristine Safi - January 19, 2005
With the increased use of electronic records in the Biotechnology Industry, there became a need for requirements to address data security, data integrity and traceability of this data. In response to this need, the Food and Drug Administration (FDA) published a regulation called 21 CFR Part 11, in August of 1997.
Federal Computer Crime Laws
Maxim May - August 15, 2004
The Internet has been a boon to business, science, education and just about any field you can think of, including crime. Just like every human invention, Internet has two sides to it, on the one hand it allows businesses to be more productive and scientists to share research data almost instantaneously, on the other hand it grants criminals an additional tool to commit crimes and get away with it.
Offshore Outsourcing and Information Confidentiality
Mark Lum - July 25, 2004
While recent news headlines of the past few months have focused on the controversial topic of offshore outsourcing of jobs from the United States to countries such as India, China, and Mexico, other headlines, relating to some of the effects of this phenomenon, have exposed problematic consequences and outcomes.
An Overview of Sarbanes-Oxley for the Information Security Professional
Gregg Stults - July 25, 2004
The Sarbanes-Oxley Act of 2002 has dramatically affected overall awareness and management of internal controls in public corporations. Responsibility for accurate financial reporting has landed squarely on the shoulders of senior management, including the potential for personal criminal liability for CEOs and CFOs.
Cyber Risk Insurance
Denis Drouin - June 9, 2004
Technology has continued to astound the world's electronic culture by reacting with the use of mechanisms to defend and protect against the unknown. Cyber insurance has been one of those phenomenons that has experienced many challenges and at the same time mutated into a more complex tool to protect companies.
The Role of IT Security in Sarbanes-Oxley Compliance
Mary Fleming - April 8, 2004
This document will summarize the requirements of Sarbanes-Oxley as they apply to IT and define the controls IT must be concerned with in the certification process. This document pertains only to the role of IT and IT security in Sarbanes-Oxley controls compliance; other company departments - accounting, finance, human resources, etc., may be subject to controls not covered herein.
U.S. Government IT Security Laws
Trevor Burke - January 11, 2004
This document will serve as a guide to those new to federal IT law and address the above four issues, outline the guidelines and steps to ensure successful C&A as designed by NIST, and subsequently address lessons learned from trying to comply with FISMA.
E-mail Communication with Patients in the Wake of the HIPAA Final Security Rule
Dennis Schmidt - October 31, 2003
This paper will explore the issues that the HIPAA regulations raise with doctor/patient e-mail communications and will discuss some possible solutions.
Big Brother at the Office: Friend or Foe?
Clint Satterwhite - October 31, 2003
This paper outlines most of the issues regarding monitoring of employee workplace computer use and attempts to present an objective presentation of the information from both the employee and employer's perspectives.
A Context-Based Access Control Model for HIPAA Privacy and Security Compliance
Harry Smith - October 31, 2003
This paper proposes a new approach to meeting much of the burden imposed by the HIPAA privacy and security requirements
System Security and Your Responsibilities: Minimizing Your Liability
Gary Holtz - October 31, 2003
A discussion of security policy and procedures, with attention to minimizing liability in the event of computer or network security incidents.
The Art of Enforcement
Jeff Neithercutt - October 31, 2003
The careful planning, integration, training, and support of a multi-disciplined group of Incident Responders will continue to be, for most corporations, the last line of defense against computer crimes; and, the better their relationship with the Local, State, and Federal Agencies they work with, the better the success of both their proactive and reactive activities.
HIPAA Compliance: Cost-Effective Solutions for the Technical Security Regulations
Tautra Romig - October 31, 2003
While HIPAA is comprised of many different regulations, the objective of this document is to suggest cost-effective solutions to the proposed Technical Security Mechanisms regulation.
The 2001 Patriot Act and Its Implications for the IT Security Professional
Oscar Peterson - October 31, 2003
This paper will focus on IT related issues encompassed by the USAPA in general as well as possible actions that could be expected of the IT Security Professional.
Dangerous Technology: Management Beware
Brent McKinley - October 31, 2003
The purpose of this paper is to inform management and upper level administration of the legal liabilities and loss of productivity due to the inappropriate use of the Internet, email, interconnected computer systems and pirated software.
The Legal System and Ethics in Information Security
Amit Philip - October 31, 2003
A discussion of the issues faced by the legal system in keeping up with the fast paced development of technology and the ways in which the current laws can help, as well as the role that ethics have to play in the world of computer security.
An Uneven Playing Field: The Advantages of the Cyber Criminal vs. Law Enforcement-and Some Practical
Torri Piper - October 31, 2003
This paper offers some observations of the disparities between the criminals manipulating digital data and law enforcement chasing after them; and tenders some suggestions in an effort to even the playing field.
Running an IT Investigation in the Corporate Environment
Carl Endorf - October 31, 2003
This paper describes the issues that are involved in conducting an IT investigation of an incident in a corporate environment.
Preparing for HIPAA: Privacy and Security Issues to be Considered
Sherry Fischer - October 31, 2003
The Health Insurance Portability and Accountability Act (HIPAA) is imposing privacy and security regulations on health plans, health care clearinghouses, and health care providers.
Financial Institutions Required To Do Their Part To Fight Crime
Terry Ritter - October 31, 2003
This paper will briefly explain how the U.S. Patriot Act legislation came into existence, but its main focus will be to outline the requirements of the recently proposed Section 326 "Customer Identification Program.
Issues in Protecting Our Critical Infrastructure
William Nance - June 2, 2003
The Internet has brought many important changes to the way we do business, both in the public and private sectors. We can use it to instantly communicate with others across the country, conduct business meetings, or control equipment in remote locations.
What is the Federal Government Doing to Improve the State of Information Security?
Jason Hiney - April 4, 2003
The objective of this paper is to take a broad look at recent Government actions improve the state of information security in the United States and prevent such problems.
Laws of Canada as they Pertain to Computer Crime
Donna Simmons - May 2, 2002
This paper examines the existing laws in the Criminal Code of Canada as they pertain to computer crime.
The Ethics and Legality of Port Scanning
Shaun Jamieson - October 8, 2001
This paper will define and outline the process of port scanning, discuss ethical and legal issues surrounding port scanning, and assert the importance of strictly defining scanning in an organization's policy.
Malaysian Law and Computer Crime
Wong Yew - August 8, 2001
This paper attempts to describe the Malaysian Computer Crimes Act 1997 (CCA 1997) and provide important guidelines for a successful computer crime investigation.
South Africa - Computer Misuse Act, Proposed
Michael Masters - June 14, 2001
This paper looks at this proposed act as well as its application in today's computer environment.
Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact email@example.com.
All papers are copyrighted. No re-posting or distribution of papers is permitted.