Information Security: A Legal, Business, and Technical Handbook

by Kiefer, Kimberly; Wu, Stephen; Wilson, Ben; Sabett, Randy

• ISBN13: 9781590313008
• ISBN10: 1590313003
• Format: Paperback
• Copyright: 2004-03-01
• Publisher: Natl Book Network

Summary

The handbook will give clear and comprehensive guidance to anyone who wants a basic understanding of information security threats and the legal issues related to them. them.

Table of Contents

Foreword	vii
Contributors	ix
Acknowledgments	xi
CHAPTER 1 Introduction	1	(10)
I. Why Is Information Security Important?	2	(2)
II. What Is "Information Security"?	4	(5)
III. Anatomy of a Hacking Attack	9	(2)
CHAPTER 2 Threats to Information Security	11	(6)
I. Threats Based on Intentional Conduct	11	(4)
II. Threats Based on Accidental, Inadvertent, or Natural Events	15	(2)
CHAPTER 3 Compliance Issues	17	(14)
I. Sources of Statutory and Regulatory Requirements	17	(12)
A. Gramm-Leach-Bliley Act	17	(3)
B. Health Insurance Portability and Accountability Act	20	(1)
C. Sarbanes-Oxley Act	20	(2)
D. GISRA/FISMA	22	(1)
E. Federal Trade Commission Oversight	22	(3)
F. Children's Online Privacy Protection Act	25	(1)
G. Federal Privacy Act	26	(1)
H. State Laws	26	(3)
II. Non-Regulatory Sources of Security Obligations	29	(2)
A. Operating Rules	29	(1)
B. An Attorney's Obligation to Secure Attorney-Client Communications	30	(1)
CHAPTER 4 Information Security Liability	31	(14)
I. Cybercrime Laws	31	(4)
II. Civil Actions	35	(10)
A. Contract Claims	36	(2)
B. Negligence Claims	38	(2)
C. Statutory Claims	40	(1)
D. Shareholder Actions	41	(4)
CHAPTER 5 Information Security Best Practices	45	(6)
I. Security Management Practices	46	(1)
II. Authentication	46	(1)
III. Physical Security and Physical Access Controls	47	(1)
IV. Personnel Controls	47	(1)
V. Network and Computer Security	48	(1)
VI. The Role of Lawyers	48	(3)
CHAPTER 6 Responding to Security Incidents	51	(4)
CHAPTER 7 The Need for Risk Management	55	(8)
I. Total Cost of Ownership and Return on Investment Issues	56	(2)
II. Self-Insurance and Risk Assumption	58	(2)
III. Insurance	60	(3)
CHAPTER 8 Conclusion	63	(2)
APPENDIX A Standards, Guidelines, Best Practices, and Other Resources	65	(4)
I. Standards for Enterprise Security	65	(1)
II. Standards for Software Development and Operational Benchmarks	66	(1)
III. Standards for Systems Security	66	(1)
IV. Standards for Products Security	67	(1)
V. Best Practices and Guidelines in Information Security	67	(1)
VI. Standards for Disclosing Security Vulnerabilities	68	(1)
VII. Electronic Signature Standards	68	(1)
APPENDIX B Examples of Information Security Best Practices	69
I. Security Management Practices	69	(4)
II. Authentication	73	(4)
III. Physical Security and Physical Access Controls	77	(1)
IV. Personnel Controls	78	(1)
V. Network and Computer Security	79