Chapter 12: Law and Ethics
TRUE/FALSE
1. Ethics carry the sanction of a governing authority.
2. The current law regarding nationwide search warrants for e-mail requires the government to use a
search warrant to compel a provider to disclose unopened e-mail that is more than six months old.
3. The Secret Service is charged with the detection and arrest of any person committing a U.S. federal
offense relating to computer fraud, as well as false identification crimes.
4. An item does not become evidence until it is formally admitted to evidence by a judge or other ruling
official.
5. Using standard digital forensics methodology, the first step is to analyze the EM data without risking
modification or unauthorized access.
MULTIPLE CHOICE
1. Which type of law regulates the relationships among individuals and among individuals
and organizations?
a.
tort
c.
private
b.
criminal
d.
public
2. Which law addresses privacy and security concerns associated with the electronic transmission of
PHI?
a.
USA Patriot Act of 2001
b.
American Recovery and Reinvestment Act
c.
Health Information Technology for Economic and Clinical Health Act
d.
National Information Infrastructure Protection Act of 1996
3. The penalties for offenses related to the National Information Infrastructure Protection Act of 1996
depend on whether the offense is judged to have been committed for one of the following reasons
except which of the following?
a.
For purposes of commercial advantage
b.
For private financial gain
c.
For political advantage
d.
In furtherance of a criminal act
4. Which law requires mandatory periodic training in computer security awareness and accepted
computer security practice for all employees who are involved with the management, use, or operation
of each federal computer system?
a.
The Telecommunications Deregulation and Competition Act
b.
National Information Infrastructure Protection Act
c.
Computer Fraud and Abuse Act
d.
The Computer Security Act
5. Which act is a collection of statutes that regulates the interception of wire, electronic, and oral
communications?
a.
The Electronic Communications Privacy Act of 1986
b.
The Telecommunications Deregulation and Competition Act of 1996
c.
National Information Infrastructure Protection Act of 1996
d.
Federal Privacy Act of 1974
6. Which act requires organizations that retain health care information to use InfoSec mechanisms to
protect this information, as well as policies and procedures to maintain them?
a.
ECPA
b.
Sarbanes-Oxley
c.
HIPAA
d.
Gramm-Leach-Bliley
7. In digital forensics, all investigations follow the same basic methodology. Which of the following
should be performed first in a digital forensics investigation?
a.
Report the findings to the proper authority
b.
Acquire (seize) the evidence without alteration or damage
c.
Identify relevant items of evidentiary value (EM)
d.
Analyze the data without risking modification or unauthorized access
8. Which law extends protection to intellectual property, which includes words published in electronic
formats?
a.
Freedom of Information Act
c.
Security and Freedom through Encryption
Act
b.
U.S. Copyright Law
d.
Sarbanes-Oxley Act
9. Which of the following is the study of the rightness or wrongness of intentions and motives as opposed
to the rightness or wrongness of the consequences and is also known as duty– or obligation-based
ethics?
a.
Applied ethics
c.
Normative ethics
b.
Meta-ethics
d.
Deontological ethics
10. Which of the following is an international effort to reduce the impact of copyright, trademark,
and privacy infringement, especially via the removal of technological copyright protection measures?
a.
U.S. Copyright Law
b.
PCI DSS
c.
European Council Cybercrime Convention
d.
DMCA
11. Which of the following ethical frameworks is the study of the choices that have been made by
individuals in the past; attempting to answer the question, what do others think is right?
a.
Applied ethics
c.
Normative ethics
b.
Descriptive ethics
d.
Deontological ethics
12. Which ethical standard is based on the notion that life in community yields a positive outcome for the
individual, requiring each individual to contribute to that community?
a.
utilitarian
c.
fairness or justice
b.
virtue
d.
common good
13. There are three general categories of unethical behavior that organizations and society should seek to
eliminate. Which of the following is NOT one of them?
a.
ignorance
c.
accident
b.
malice
d.
intent
14. Which of the following is the best method for preventing an illegal or unethical activity? Examples
include laws, policies and technical controls.
a.
remediation
c.
persecution
b.
deterrence
d.
rehabilitation
15. Which of the following organizations put forth a code of ethics designed primarily for InfoSec
professionals who have earned their certifications? The code includes the canon: Provide diligent and
competent service to principals.
a.
(ISC)2
c.
SANS
b.
ACM
d.
ISACA
16. Which of the following is compensation for a wrong committed by an employee acting with
or without authorization?
a.
liability
c.
due diligence
b.
restitution
d.
jurisdiction
17. Which of the following allows investigators to determine what happened by examining the results of
an event—criminal, natural, intentional, or accidental?
a.
root cause analysis
c.
forensics
b.
e-discovery
d.
evidentiary procedures
18. Any court can impose its authority over an individual or organization if it can establish which of the
following?
a.
jurisprudence
c.
liability
b.
jurisdiction
d.
sovereignty
19. Which two approaches are available to an organization when employing digital forensics?
a.
Protect and forget; Apprehend and prosecute
b.
Protect and defend; Apprehend and pursue
c.
Patch and proceed; Protect and forget
d.
Pursue and prosecute; Identify and apprehend
20. Which type of document grants formal permission for an investigation to occur?
a.
affidavit
c.
evidentiary report
b.
search warrant
d.
forensic concurrence
21. Which Amendment to the U.S. Constitution starts with: The right of the people to be secure in their
persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated?
a.
First
c.
Third
b.
Second
d.
Fourth
22. Which document must be changed when evidence changes hands or is stored?
a.
chain of custody
c.
affidavit
b.
search warrant
d.
evidentiary material
COMPLETION
1. ___________________ is a subset of civil law that allows individuals to seek redress in the event of
personal, physical, or financial injury.
2. Ethics,are based on ___________________, which are the relatively fixed moral attitudes or customs
of a societal group.
3. An organization increases its _____________ if it refuses to take measures—due care—to make sure
that every employee knows what is acceptable and what is not, and the consequences of illegal or
unethical actions.
4. The first component of the analysis phase is ___________, which allows the investigator to quickly
and easily search for a specific type of file.
5. In InfoSec, most operations focus on __________, which are those documents that provide managerial
guidance for ongoing implementation and operations.
MATCHING
a.
criminal law
f.
Cybersecurity Act
b.
public law
g.
normative ethics
c.
ethics
h.
applied ethics
d.
Computer Security Act (CSA)
i.
e-discovery
e.
Electronic Communications Privacy Act
j.
digital forensics
1. one of the first attempts to protect federal computer systems by establishing minimum acceptable
security practices
2. focused on enhancing the security of the critical infrastructure in the United States
3. an approach that applies moral codes to actions drawn from realistic situations
4. used prior to the initiation of legal proceedings, falls under the umbrella of incident response
5. a collection of statutes that regulates the interception of wire, electronic, and oral communications
6. regulates the structure and administration of government agencies and their relationships with citizens,
employees, and other governments
7. the identification and preservation of EM related to a specific legal action
8. the study of what makes actions right or wrong, also known as moral theory
9. addresses violations harmful to society and is actively enforced and prosecuted by the state
10. define socially acceptable behaviors
SHORT ANSWER
1. Briefly describe five different types of laws.
2. Describe the 5 stage methodology an organization should follow in an investigation.
3. Discuss the three general categories of unethical behavior that organizations should try to control.
4. Laws and policies and their associated penalties only deter if three conditions are present. What are
these conditions?
5. What is the key difference between law an ethics?
6. The penalty for violating the National Information Infrastructure Protection Act of 1996 depends on
the value of the information obtained and whether the offense is judged to have been committed for
one of three reasons. What are those reasons?
7. The CSA charges the National Bureau of Standards, in cooperation with the National Security Agency
(NSA), with the development of five standards and guidelines establishing minimum acceptable
security practices. What are three of these principles?
8. Describe the Freedom of Information Act. How does its application apply to federal vs. state
agencies?
9. A key difference between policy and law is that ignorance of policy is a viable defense. What steps
must be taken to assure that an organization has a reasonable expectation that policy violations can be
appropriately penalized without fear of legal retribution?
10. Describe three of the five foundations and frameworks of ethics.