CISSP Prep- Legal And Investigations

Privacy can be defi ned as “the rights and obligations of individuals
and organizations with respect to the collection, use, retention, and disclosure
of personal information.” Page 514.

Ensuring the authenticity and integrity of evidence is critical.
If the courts feel the evidence or its copies are not accurate or lack integrity, it is
doubtful that the evidence or any information derived from the evidence will be
admissible. Th e current protocol for demonstrating authenticity and integrity relies
on hash functions that create unique numerical signatures that are sensitive to any

A word of caution is necessary: although the media has tended
to portray the threat of cybercrime as existing almost exclusively from the outside,
external to a company, reality paints a much diff erent picture. Th e greatest risk of
cybercrime comes from the inside, namely, criminal insiders. Page 520.

Th e incident response and handling phase can be broken down
further into triage, investigation, containment, and analysis and tracking. Page 523.

At a more generic level, evidence should have some probative
value, be relevant to the case at hand, and meet the following criteria (often called
the fi ve rules of evidence): be authentic, be accurate, be complete, be convincing,
and be admissible. Page 531.

As a forensic discipline, this area deals with evidence and the
legal system and is really the marriage of computer science, information technology,
and engineering with law. Page 529.

Triage is a process in incident response that involves quickly assessing and prioritizing the incidents. The correct answer, "Detection, identification, notification," accurately represents the subphases of triage. Detection refers to identifying the presence of an incident, identification involves determining the nature and scope of the incident, and notification involves informing the appropriate individuals or teams about the incident. These subphases are crucial in effectively responding to and managing incidents.

Th e biggest hindrance to eff ectively dealing with computer
crime is the fact that this activity is truly international in scope, and thus requires
an international solution, as opposed to a domestic one based on archaic concepts
of borders and jurisdictions. Page 520.

Locard’s principle of exchange states that when a crime is committed,
the perpetrators leave something behind and take something with them,
hence the exchange. Th is principle allows us to identify aspects of the persons
responsible, even with a purely digital crime scene. Page 530.

A copyright covers the expression of ideas rather than the ideas
themselves; it usually protects artistic property such as writing, recordings, databases,
and computer programs. Page 512.

Civil law emphasizes the abstract concepts of law and is infl uenced
by the writings of legal scholars and academics, more so than common law
systems. Page 509

Trademark laws are designed to protect the goodwill a merchant
or vendor invests in its products. Page 511.

Like incident response, there are various computer forensics
guidelines (e.g., International Organization of Computer Evidence (IOCE),
Scientifi c Working Group on Digital Evidence (SWGDE), Association of Chief
Police Offi cers (ACPO)). Th ese guidelines formalize the computer forensic processes
by breaking them into numerous phases or steps. MOM stands for means,
opportunity, and motives. Page 529.

Th ere are four categories of software licensing: freeware, shareware,
commercial, and academic. Within these categories, there are specifi c types
of agreements. Master agreements and end-user licensing agreements (EULAs) are
the most prevalent. Page 513.

Given the importance of the evidence that is available at a
crime scene, the ability to deal with a scene in a manner that minimizes the amount
of disruption, contamination, or destruction of evidence. Once a scene has been contaminated,
there is no undo or redo button to push; the damage is done. Page 531.