>> We've talked about the requirements of notifying
law enforcement, notifying customers,
and essentially notifying the person designated by
DHS of these data breaches.
How's that benefit organizations?
We know how notifying
our customers benefit us because one,
it's required by law,
but two, it provides
some type of goodwill and notification
to the customers that were at least trying
to rectify the situation.
But providing that information to law enforcement
and/or providing that information
to other organizations,
one, will help us cut down on
the amount of incidents
that we're going to have to respond to.
One, because knowing is half the battle.
If I know about something,
it's going to be a lot easier for me to
make preparations to respond to it.
Number one, it aids in threat identification.
If I know of a particular piece of malware,
if I know of a particular hacker that's out there and
know how his HTTPS work,
I can essentially set
my firewalls to know what to look for.
I can make my employees aware of
how to be cognizant of
certain social engineering techniques.
Additionally, it provides threat warning.
That ties back into knowing and
understanding threat in my scale
that an organization is going to face.
But on top of that, sharing
information is going to build relationships.
If something happens to me and it's significantly bad,
and I have a buddy
that may work for another organization,
and I share that information with him,
one that's going to help his information
is going to make him better.
But conversely, if something happens to
him and he shares that with me,
then it will also improve my security posture.
Then if I'm sharing that information with
law enforcement or with the federal government,
they might actually start sharing
information back or building those relationships,
we're building our network,
and we're helping each other essentially,
keep each other secure,
so you've got your buddies back.
In summary, this covers are
legal aspects of incident response.
Essentially, we started with
defining expectations of privacy and
how that impacts organizations as they go about
collecting evidence as it relates to
responding to incidents and remediating incidents.
What we talked about in that section is that
the organizations, especially private organizations,
may not have to be cognizant or abide by
the Fourth Amendment per se
because it doesn't really apply to them,
except in certain situations.
Government employees, they're always required to
abide by the Fourth Amendment because they
are agents of the government.
However, private entities might become agents of
the government when they're acting
at the half of the hest of law enforcement.
If you've contacted
particular law enforcement agency
and they're providing you
direction and guidance on how
to investigate and gather evidence in this case,
at some point, you may actually become
an agent of law enforcement and the Fourth Amendment,
and the search warrant requirement
may actually apply to you.
That being said, as a data owner
>> and owning certain systems and information,
>> because of that virtue,
you may actually be able to provide consent yourself.
At times, it can be
a very gray area, very slippery slope.
We also talked about bringing your own device to work.
Inherently, be allowed the devices
or almost a security nightmare,
and there has to be good policies and
procedures in place to
deal with incidence when and if they might occur,
because these are privately owned devices.
Taking someone's cellphone away from them may
not be as easy as taking a company owned cellphone.
Then searching through that cellphone might
even be more of a legal nightmare and headaches,
so it's important to have
good policies and procedures in place.
Then lastly, we talked about
the data breach notification standard,
specifically as it relates to federal law
>> and how persons are supposed to be notified,
>> what constitutes PII,
and then whom organizations are supposed to notify such
as law enforcement and/or the credit bureau agencies.
That provides a basic snapshot of
the legal aspects of incident response.
I have to caption this
with anything that is contained within
this section should not be construed to be
legal advice on behalf of myself and our Cybrary.
This is a basic overview of
some legal aspects that pertain to incident response.
Anytime you're going to have
a question about legal processes or requirements,
if you take anything away
from this section of the course,
is to consult your legal counsel.
But hopefully, this provides
a good overview of some of
the laws that pertain to incident response,
and at least helps you ask
good questions or become
aware of certain laws and procedures.
Again, thank you. I hope you've enjoyed the course,
and check out more courses from Cybrary.