0
Computer Security Law
Computer security means protecting the confidentiality, integrity, and availability of information stored on, processed by, and transmitted by computers. In order to achieve this, various governments and organizations have established laws, regulations, and standards for securing computers and the data stored, processed, and transmitted by them. This category is for questions about existing and proposed laws and standards specifically related to computer security including the contents of the laws & regulations, who is legally responsible, who/what the laws/regulations/standards apply to, how the security is evaluated, and how it is documented.
500 Questions
Documents requires the IASO?
Asked by Wiki User
The IASO (Information Assurance Security Officer) is responsible for ensuring the implementation and maintenance of security controls within an organization. Therefore, any document that involves sensitive or classified information, such as security policies, procedures, or incident reports, would require the involvement and approval of the IASO. This is to ensure that proper security measures are in place to protect the information from unauthorized access or disclosure.
What is AR-25-2?
Asked by Wiki User
AR-25-2 refers to Army Regulation 25-2, which outlines the procedures for preparing and managing records and information within the United States Army. It provides guidance on recordkeeping, electronic records, and information management. The regulation ensures that Army personnel follow standardized practices for creating, maintaining, and disposing of records and information in a consistent and efficient manner.
What circumstances can the DAA waive the certification requirements?
Asked by Wiki User
The DAA (Designated Approving Authority) can waive the certification requirements in exceptional cases, such as during emergency situations where the immediate use of a system is necessary to protect national security or during time-sensitive operations. The DAA may also waive the certification requirements if an alternative method of assurance is utilized to adequately address the risk associated with the system. However, such waivers are typically granted on a case-by-case basis and are subject to specific conditions.
What is the answers for iaso certification course final exam management level 1?
Asked by Wiki User
b
d
d
b
b
c
b
b
a
b
a
c
c
d
d
b
c
b
a
d
c
a
b
c
d
a
b
c
c
a
a
d
b
d
d
b
a
a
d
b
c
a
c
d
d
c
b
b
a
Minimum password length required by AR 25-2?
Asked by Wiki User
10 characters minimum
15 or more is recommended
According to AR 25-2, Section IV, paragraph 4-12 b:
The IAM or designee will manage the password generation, issuance, and control process. If used, generate passwords in accordance with the BBP for Army Password Standards.
BBP for Army password standards are contained in 04-IA-O-0001, paragraph 5A:
(1) All system or system-level passwords and privileged-level accounts (e.g., root, enable, admin, administration accounts, etc.) will be a minimum of 15-character case-sensitive password changed every 60 days (IAW JTF-GNO CTO).
(2) All user-level, user-generated passwords (e.g., email, web, desktop computer, etc.) will change to a 14-character (or greater) case-sensitive password changed every 60 days.
From these two documents it would appear that the 10 character minimum is an outdated recommendation.
From this it would appear that the frequently repeated "8 character minimum" is outdated. Note that the only conditions where an 8 character password is allowed is:
(8) The use of eight character passwords are authorized when:
(I) The password generated is a purely random-generated authenticator from the complete alpha/numeric and special character sets and no user-configured passwords can replace, be generated, or accepted in lieu of the generated password. (For example: Credentialing system issues randomly generated authenticator AND enforce use of that authenticator to network resources.)
Or:
(II) Access to private applications is conducted over an approved 128-bit encrypted session between systems, and the application does not enforce local user access credentialing to a local network resources. (For example: User accesses local LAN connected system through traditional access procedures then accesses a web portal application over an SSL connection; the web portal password may be 8 characters.)
--- from 04-IA-O-0001, paragraph 5A
What could be the consequences for computer hacking?
Asked by Wiki User
- Up to thirty years in jail
- Up to a $100,000 fine
- Loss of electronic privileges
- A felony record.
Another consequence which is also the key motivation for hackers to do what they do is understanding of new technology. Hacking allows hackers to learn about technology, security, and safety. In a way, hacking improves security instead of the commonly held view of the opposite. Please note: Hackers in this perspective should not be confused with "crackers" who attack systems for their own personal gain or to "just cause havoc".
Does IA BBP requires the IASO to ensure personnel receive system-specific and annual IA awareness training?
Asked by Wiki User
8510.01M was signed in 2000 was written to go with DITSCAP (DoDI 5200.40 - signed in 1997), which has since been superseded by DIACAP (DODI 8510.01 - signed in 2007)
Ultimately, responsibility for ensuring the training rests with the IAM, but the IAM can, and often does, delegate the responsibility to the IAO.
C3.4.4 requires preparation of the Environment and Threat Description, which, in turn requires:
C3.4.4.2.1.8. Training. Identify the training for individuals associated with the system's operation and determine if the training is appropriate to their level and area of responsibility. This training should provide information about the security policy governing the information being processed as well as potential threats and the nature of the appropriate countermeasures.
C3.4.7 requires identifying C&A Organizations and the Resources Required, which includes:
C3.4.7.2.3. Resources and Training Requirements. Describe the training requirements, types of training, who is responsible for preparing and conducting the training, what equipment is required, and what training devices must be developed to conduct the training, if training is required. Funding for the training must be identified.
C5.1.2 discusses certifying, among other things, "security education, training, and awareness requirements".
C5.2.4.3 requires: The program manager, user representative, and ISSO should ensure that the proper security operating procedures, configuration guidance, and training is delivered with the system. Note that the term ISSO has since been replaced by IASO in current IA terminology.
C5.3.9.2 requires: "that security Rules of Behavior, a Security Awareness and Training Program, and an Incident Response Program are in place and are current."
Appendix 2, the "MINIMAL SECURITY ACTIVITY CHECKLIST" includes the questions:
Table AP2.T11.
10.(h) Do the ISSO duties include the following:
Implementing or overseeing the implementation of the Security and Training
and Awareness Program?
Table AP2.T12.
3.(o) Do employees receive periodic training in the following areas:
(1) Power shut down and start up procedures?
(2) Operation of emergency power?
(3) Operation of fire detection and alarm systems?
(4) Operation of fire suppression equipment?
(5) Building evacuation procedures?
If you examine DoDI 8500.2, you will find requirements dealing with training including:
5.9 Each IA Manager, in addition to satisfying all responsibilities of an Authorized User, shall: (5.9.2) Ensure that all IAOs and privileged users receive the necessary technical and IA training, education, and certification to carry out their IA duties.
E3.3.7. Requires that:
All DoD employees and IT users shall maintain a degree of understanding
of IA policies and doctrine commensurate with their responsibilities. They shall be capable of appropriately responding to and reporting suspicious activities and conditions, and they shall know how to protect the information and IT they access. To achieve this understanding, all DoD employees and IT users shall receive both initial and periodic refresher IA training. Required versus actual IA awareness training shall be a management review item.
E3.4.6. Information Assurance Managers (IAMs) are responsible for establishing,
implementing and maintaining the DoD information system IA program, and for
documenting the IA program through the DoD IA C&A process. The program shall include procedures for:
E3.4.6.6. Tracking compliance with the IA Controls applicable to the DoD information system and reporting IA management review items, such as C&A status, compliance with personnel security requirements, compliance with training and education requirements, and compliance with CTOs, IAVAs, and other directed solutions.
Within the controls of 8500.2, you will find the following controls:
VIIR-1 Incident Response Planning
An incident response plan exists that identifies the responsible CND Service Provider in accordance with DoD Instruction O-8530.2, defines reportable incidents, outlines a standard operating procedure for incident response to include INFOCON, provides for user training, and establishes an incident response team. The plan is exercised at least annually.
VIIR-2 Incident Response Planning
An incident response plan exists that identifies the responsible CND Service Provider in accordance with DoD Instruction O-8530.2, defines reportable incidents, outlines a standard operating procedure for incident response to include INFOCON, provides for user training, and establishes an incident response team. The plan is exercised at least every 6 months.
PETN-1 Environmental Control Training
Employees receive initial and periodic training in the operation of environmental controls.
PRTN-1 Information Assurance Training
A program is implemented to ensure that upon arrival and periodically thereafter, all personnel receive training and familiarization to perform their assigned IA responsibilities, to include familiarization with their prescribed roles in all IA- related plans such as incident response, configuration management and COOP or disaster recovery.
Templates for validation of the controls by system validators include the following instructions:
For PRRB-1:
1. A set of rules that describe the IA operations of the DoD information system and clearly delineate IA responsibilities and expected behavior of all personnel shall be in place.
2. The rules shall include the consequences of inconsistent behavior or non-compliance.
3. Signed acknowledgement of the rules shall be a condition of access.
4. Training or reminder of the IA operations rules and code of conduct shall be performed on an annual basis, or as frequently as in accordance with DoD policy.
For PRTN-1
1. A set of rules that describe the IA operations of the DoD information system and clearly delineate IA responsibilities and expected behavior of all personnel shall be in place.
2. The rules shall include the consequences of inconsistent behavior or non-compliance.
3. Signed acknowledgment of the rules shall be a condition of access.
4. Training or reminder of the IA operations rules and code of conduct shall be performed on an annual basis, or as frequently as in accordance with DoD policy.
Where should DoD employees look for guidance on safeguarding controlled unclassified information?
Asked by Wiki User
DodM 5200.1 vol 4
WHERE DOES OUR SOURCE FOR DIACAP RESOURCES AND KNOWLEDGE SERVICES BE DISCOVERED THROUGH OUR RELATIONSHIP AND SUPPORT?
Asked by Wiki User
What is the most acceptable list of diacap team members responsible for implenemting diacap?
Asked by Wiki User
When someone has viewed archived copyright protected data and sent it to someone else what has occurred?
Asked by Wiki User
If the data is copyright protected, the copyright holder has the right to control how the data is distributed. If the person who originally viewed the archived data went to a source that was authorized to share the data there is no problem. If the source was not not granted permission to share it, the person viewing it is probably not guilty of much (unless it can be shown that they did something illegal in order to access he source). Being granted permission to view the data does not grant the right to send it to someone else. That permission must be sought from the copyright holder. Think of it like buying and reading a book. If you buy the book, you have permission to read it. You can even give the book to someone else - but if you copy the book and send it to someone you have now violated the copyright.
How can police find out if you stole a computer?
Asked by Wiki User
Every computer should have a unique MAC identifier. When the computer is connected to the internet it is possible to query the computer remotely and get that MAC identifier. If you stole the computer and the legal owner has a record of that identifier, it provides proof that the computer you are using is the one they had stolen - and it can be traced back to you. Obviously all the other ways of detecting theft apply - confession, someone seeing you stealing it, leaving evidence behind, trying to pawn it, etc.
Is responsible for ensuring that the IA incorporate life cycle each of DoD information system?
Asked by Wiki User
What is the most acceptable list of diacap team members responsible for implementing diacao?
Asked by Wiki User
Where is information that is generated within the DOD and are declared permanently valuable provided to?
Asked by Wiki User
Information that is generated within DOD and are declared permanently valuable is provided to the?
Asked by Wiki User
In accordance with AR 25-2 whose responsibililty is it to ensure all users receive initial and annual IA awareness training?
Asked by Wiki User
What security classification do you apply to information when the unauthorized disclosure of its content could reasonably be expected to cause serious damage to the national security?
Asked by Wiki User
In the US, according to Executive Order 13526 of December 29, 2009 - Part 1, Sec 1.2 (a)(2):
"Secret" shall be applied to information, the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security that the original classification authority is able to identify or describe.
==========
In the United States and Britain, data is classified as "Secret" if:
"Such material would cause "serious damage" to national security if it were publicly available."
Other nations have roughly equivalent classifications for data based on the same criteria. For a more complete list, see the attached related link.
Why does Google and the NSA want to spy on everybody without any cause?
Asked by Tonyparkerhawk
For the same reason as you when you look over the fence towards your neighbour, they want to know what others are up to, what other would like to eat, what cars they would like to drive Etc. so that they can maybe build more factories to supply more of those cars or more of that food or maybe to stop them from making bombs .
This is a very short version of the reasons.
What type of job does a commissioner do?
Asked by Wiki User
A commissioner is a senior official that is responsible for administering policies as defined by a law. For example, the Information Commissioner's office is responsible for implementing the provisions of the Data Protection Act of 1998.
Can Google look at your Quicken files?
Asked by Wiki User
Unless you configure your machine to be publicly accessible - i.e. allow others to connect to it remotely, Google will not see any of your files. If you use a Google service like Google Docs or a Google cloud service to store your Quicken files and do not encrypt them, Google CAN look at them but it's not in their business model to invest the resources to do so.
Is it illegal to print information from someone's computer without given permission?
Asked by Wiki User
It depends on the nature of the information. It is certainly only common courtesy to ask permission.
If you are printing contents of files from the computer without permission it falls into the realm of theft of information if the information you print is not already in the public domain.
