0
Computer Security Law
Computer security means protecting the confidentiality, integrity, and availability of information stored on, processed by, and transmitted by computers. In order to achieve this, various governments and organizations have established laws, regulations, and standards for securing computers and the data stored, processed, and transmitted by them. This category is for questions about existing and proposed laws and standards specifically related to computer security including the contents of the laws & regulations, who is legally responsible, who/what the laws/regulations/standards apply to, how the security is evaluated, and how it is documented.
310 Questions
Contact your security manager or IAM to report the possible spillage.
where?
This question is now outdated since the DoD has moved to RMF as their accreditation mechanism. Under RMF the team members should include the AO (authorizing official), CA (certification authority), system owner, and user representative.
How many years does your DIACAP requires you to review your IA posture?
DIACAP requires you to review your IA posture at least annually for as long as the system is in operation (or every 6 months if it is a MAC I system).
What is an acceptable list of the DIACAP team members responsible for implementing DIACAP?
Yes, it's just an extraction software like WinRar.
It's legal and safe as long as you download it from the official website.
When registering with a software company what is the purpose and benefits or registering?
Benefits:
- When registering you may get additional functionality of the product. Some companies use this as a means to enforce licensing of their products.
- Many software companies use the registration to create push lists for patches, updates, and important notifications.
- Registered users often recieve notifications of special offers and promotions that may be of interest to them.
- Sometimes software companies will provide free gifts to those who register as an incentive. The free gift might be addional software or some cheap swag like a thumb drive, mug, or t-shirt.
Additional purposes:
- The software company is able to compile a database of current users who are then potential future customers for additional products.
- Some companies will share or sell the information with other companies for financial gain (Remember to read the privacy policy statement of the company before you register!)
What is the name of the career that deals with cyber crime?
Quite a few activities could qualify for this.
On the negative side:
Spammer
Phisher
Cyberespionage
Child pornographer
Con artist (which is what all phishers and nearly all spammers would qualify as)
Blackhat hacker
Cyberthief
Cyberextortionist
Virus author
Malware author
Worm author
Jackass
Jerk
Scum of the earth
(ok, now I'm getting carried away)
Any criminal that uses a computer to commit crime is involved in cyber crime
On the positive side:
Computer forensic professional
FBI cyber division
All the military branches have groups within their criminal investigative services that specialize in cyber crime
Computer law specialist
Intellectual property specialist
Incident response
...
realize that usually careers involved with fighting cyber crime cross over several disciplines - law, forensics, network defense, etc.
What is the maximum jail sentence penalty for knowingly setting up a buffer overflow attack?
Under 18 U.S.C 1030, subsection (a)(5)(A) it is a criminal offense to:"knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer". Knowingly setting up a buffer overflow attack would fall under this description.
Under 18 U.S.C (c)(4), the penalty would be: "a fine under this title, imprisonment for not more than 5 years, or both"
What list of the DIACAP is the most acceptable for team members implementing DIACAP?
At a minimum the DIACAP Team includes the DAA, the CA, the DoD IS program manager (PM) or system manager (SM), the DoD IS IA manager (IAM), IA officer (IAO), and a user representative (UR) or their representatives.
___
DAA, CA, SIAO, PM, IAM, and IAO (or IASO)
____
From the sections below it would appear the list of individuals responsible for implementing DIACAP would be:
SIAO
DAA (aka PAA)
PM
IAM
IAO (as assigned by the IAM ) - note that the Army calls the IAO the IASO
UR - depending on how you interpret paragraph 5,17.
According to DoDI 8510.01 (DIACAP), paragraph 1.3, the DIACAP instruction:
Establishes or continues the following positions, panels, and working groups to implement the DIACAP: the Senior Information Assurance Officer (SIAO), the Principal Accrediting Authority (PAA), the Defense Information Systems Network (DISN)/Global Information Grid (GIG) Flag Panel, the IA Senior Leadership (IASL), the Defense (previously DISN) IA Security Accreditation Working Group (DSAWG), and the DIACAP Technical Advisory Group (TAG).
From this it can be inferred that individuals responsible for implementing DIACAP include:
the SIAO
the PAA - which can be the DAA
Besides the SIAO and DAA - the sections of DoDI quoted below identify the other team members with responsibility to implement DIACAP:
5.16. The Program Manager (PM) or System Manager (SM) for DoD ISs shall:
5.16.1. Ensure that each assigned DoD IS has a designated IA manager (IAM) with the support, authority, and resources to satisfy the responsibilities established in Reference (d) and this Instruction.
5.16.2. Implement the DIACAP for assigned DoD ISs.
5.16.3. Plan and budget for IA controls implementation, validation, and sustainment throughout the system life cycle, including timely and effective configuration and vulnerability management.
5.16.4. Ensure that information system security engineering is employed to implement or modify the IA component of the system architecture in compliance with the IA component of the GIG Architecture (Reference (c)) and to make maximum use of enterprise IA capabilities and services.
5.16.5. Enforce DAA accreditation decisions for hosted or interconnected DoD ISs.
5.16.6. Develop, track, resolve, and maintain the DIACAP Implementation Plan (DIP) for assigned DoD ISs.
5.16.7. Ensure IT Security POA&M development, tracking, and resolution.
5.16.8. Ensure annual reviews of assigned ISs required by FISMA are conducted.
5.17. The DoD IS URs shall:
5.17.1. Represent the operational interests of the user community in the DIACAP.
5.17.2. Support the IA controls assignment and validation process to ensure user community needs are met.
5.18. The IAMs, in addition to the responsibilities established in Reference (d), shall:
5.18.1. Support the PM or SM in implementing the DIACAP.
5.18.2. Advise and inform the governing DoD Component IA program on DoD ISs C&A status and issues.
5.18.3. Comply with the governing DoD Component IA program information and process requirements.
5.18.4. Provide direction to the IA Officer (IAO) in accordance with Reference (d).
5.18.5. Coordinate with the organization's Security Manager
Can the DAA accept non-compliance of an IA control?
Yes - the DAA can accept non-compliance of an IA control. In doing so however, they accept the risk that comes with the non-compliance. Risk acceptance by the DAA is not just a matter of them deciding the risk is something the network should accept. They are held legally responsible for their decisions and can be prosecuted (with the potential for both fines and incarceration) for accepting risk that they should not have. As a consequence, the DAA will usually want to see the residual risk reduced to Low for the system or application. Any non-compliant controls should be mitigated and included in a Plan of Actions and Milestones for correction.
Who should assist in implementing the diacap the iam or the iao or iaso?
The short answer is - YES.
Both the IAM and the IAO have responsibilities in implementing DIACAP. Table E3.A1.T1 of DoDI 8500.2 states that the System Identification Profile must list the members of the DIACAP team, to wit:
Identify the DIACAP Team (e.g., DAA, the CA, the DoD IS PM or SM, the DoD IS IAM, IAO, and UR.
Note that BOTH the IAM and IAO are listed. The acronym IASO is synonymous with IAO.
Program or System Managers
OMB M-08-16 explicitly requires Federal organizations to implement policies for handling lost PII. The second paragraph states:
As part of the work of the Identity Theft Task Force, this memorandum requires agencies to develop and implement a breach notification policy with 120 days
FISMA doe not explicitly require organizations to implement such policies, but it does require Federal organizations to comply with other policies, laws, regulations, directives, memoranda, etc. related to computer security. It thus, indirectly, requires organizations to implement such policies.
According to DODI 8510.01:
5.16. The Program Manager (PM) or System Manager (SM) for DoD ISs shall:
5.16.1. Ensure that each assigned DoD IS has a designated IA manager (IAM) with the support, authority, and resources to satisfy the responsibilities established in Reference (d) and this Instruction.
Who are the diacap team members responsible for implementing diacap?
According to DODI 8500.2, the "DIACAP team members" are defined as:
E2.25. DIACAP Team. Comprised of the individuals responsible for implementing the DIACAP for a specific DoD IS. At a minimum the DIACAP Team includes the DAA, the CA, the DoD IS program manager (PM) or system manager (SM), the DoD IS IA manager (IAM), IA officer (IAO), and a user representative (UR) or their representatives.
What is the difference between AR 25-2 and AR 380-5?
AR 25-2 establishes information assurance (IA) policy, roles, and responsibilities. It assigns responsibilities for all Headquarters, Department of the Army (HQDA) staff, commanders, directors, IA personnel, users, and developers for achieving acceptable levels of IA in the engineering, implementation, operation, and maintenance (EIO&M) for all information systems (ISs) across the U.S. Army Enterprise Infostructure (AEI). In short, it deals with responsibilities for securing Army computer systems.
AR 380-5 establishes the policy for the classification, downgrading, declassification, transmission, transportation, and safeguarding of information requiring protection in the interests of national security. In short, it focuses on requirements for protecting information.
When classified information is stored on or processed by computer systems, both documents have to be applied.
How often should you use a non-privileged account per AR 25-2?
The best answer is probably to flip the question around to ask when it is acceptable to NOT use a non-privileged account.
A non-privileged account should always be used except when it is absolutely necessary (and authorized) to use the permissions assigned to a privileged account. Only those acting as system administrators or system auditors should ever have privileged accounts and they should only use those accounts when the actions they are performing required the elevated privileges assigned to the privileged account. They should be assigned and use non-privileged accounts for all other actions.
Section 3-3 a.(13) states that privileged users must:
(13) Maintain and use at least 2 separate accounts for access to network resources, 1 for their privileged level access and a separate general user, non-privileged level account for routine procedures.
Section 4.5 c. states:
c. Access control. IA personnel will implement system and device access controls using the principle of least privilege (POLP) via automated or manual means to actively protect the IS from compromise, unauthorized use or access, and manipulation.
One consequence of this is that they are required to always implement non-privileged accounts except where elevated privileges are required.
No - DIACAP (DoDI 8510.01) superseded DITSCAP (DoDI 5200.40) in 2006.
How often does DIACAP require you to review the IA posture of your system?
According to DODI 8510.01 (DIACAP), paragraph 4.9:
"All DoD ISs with an authorization to operate (ATO) shall be reviewed annually to confirm that the IA posture of the IS remains acceptable. Reviews will include validation of IA controls and be documented in writing."
Note that in the case of a MAC I system, the reviews should occur semi-annually, i.e. every six months.
What is the follow on to ditscap?
DODI 8510.01 (DIACAP) is the current DoD process for IA Certification and Accreditation of DoD systems. It replaced DITSCAP.
