Hello, my name is David,
and welcome to Post Incident
Response, legal
concerns or something that you can't
ignore. They are going to be with
you throughout the entire process.
I hate to be the one to tell you
that. I really do.
But in today's litigious
society, you
can't afford to ignore
the legal aspects of being
an innocent human being,
part of an incident response team
with so much data
being transferred and share
exchange or
involving people's names and dates
of birth or genetic information,
health information or financial
information, you
have to be at least
somewhat aware
of the legal issues that
are in play here.
Or you could get blindsided by
a lawsuit and
left with nothing.
So our actions
do have legal consequences and
incident response
can range
across a wide variety
of things. It's it's true on many
fronts.
Criminal act, criminal acts
or
could be criminally responsible
charges could be filed against an
attack against your network.
And then you can have to testify in
court employees
internal actions against employees.
We talk about insider threats in
mourning for and
talked about some of the
liabilities, their
liability regarding customers and
that data that you're entrusted
with by your customers,
clients, whatever term you want
to use for them.
So as you can see,
the legalities come into play on
many fronts.
One quick example, working back
in my home, some days
we would seize computers from people
all the time for a variety
of criminal investigations.
And once we did that seizure,
then we were responsible for the
care and well-being,
well-being of the computer equipment
that we seized.
Sometimes we had to give it back.
Sometimes there were files on
systems that people really
desperately didn't want to have,
family picture, for example, or
family documents.
So we would have
been held liable if we would have
lost that in some criminally
negligent way.
Thankfully, that never happened to
me, but I have heard of it happening
to forensic
investigators when they were
entrusted with the hard drive and
the data on that hard drive.
And they lost it due to faulty
procedures or processes or
equipment.
They were held civilly liable.
So keep that in mind.
Now, there are three main areas of
legality that I want us to think
about.
Privacy is one,
privacy covers a wide
range of topics.
Unfortunately,
throughout the course of the
response process, ethics
is huge for
you and me and others
in this field, not only in its
response but across
the technical realm.
And of course, ethics also crosses
the line into just day to day
behavior.
And we'll look at these a little bit
closer. We get through this
together and the investigations
themselves
have legal aspects to them
that you need to keep in mind and
be aware of as you work.
So let's talk about privacy.
Quick, quick,
quick, quick, quick guest.
Actually, we shouldn't talk about
quickly, but due to the
nature of the course and
the time that we have, we're going
to be quick about it.
Privacy can be addressed from
three different ways.
Basically, the corporation or the
organization itself.
They can have trade secrets,
internal documents, information
that they want getting out.
So they want to keep that that
private.
You have the responders and the
investigators themselves who are
oftentimes entrusted with a wide
range of data,
both internal and external,
that the
sharing of could be problematic.
The results of an incident
investigation
should be considered private and
sensitive data.
And unfortunately,
a little sidetrack here that comes
into play in the information
sharing among.
The cybersecurity world, there are a
lot of people
who work in this field who
Aweil, the fact that information
sharing is.
Kind of lacking
among cybersecurity professionals,
and there are a host of reasons for
that. But privacy is probably one
of the biggest ones. Most companies
don't want it to be known if they've
suffered a breach.
And so the
responders of whatever
hat they may be, malware,
forensics, Soki
analysts, they can't really share
that information on their own.
They need the organization's
approval before they do it.
And that lends itself to
the lack of information sharing.
Unfortunately, now, customer
data should be obvious.
There are a whole host of laws
and regulations that govern the
privacy of customer
data and the legality of exposing
it. So be careful
with that.
Dealing with it, whether it is as
part of an incident or just your day
to day job and functionality
to be found in violation
of accidentally exposing customer
data through
an investigation or something.
Now, ethics comes
into play under the legal realm as
well. Basically, it's
more or less identified as corporate
rules of conduct or rules
of behavior, moral codes.
And it's been discussed for time
immemorial or even
past. Aristotle, who's the
boss there or not, just to kind
of be classy, I
guess, for our time
here together.
But ethics has been discussed
and argued about and talked about
for a long, long time and is no
different in the computer.
A lot of times the corporate rules
of conduct come into play
on a legal basis and
acceptable use policies of
users.
What's the number one use of the
Internet in the world today?
If he said research,
you're wrong.
Pornography, right,
that no one use
of the Internet is pornography.
So a lot of companies
have legal issues with that.
They don't want porn on their
company's servers and systems.
So the acceptable use policy
comes into play there as well.
And third party use of the network
and information.
A lot of companies have contractors
that come into their network.
They have vendors that come
in and use their network.
All of them have to abide
by those corporate conduct,
the ethics of the company with which
they're interacting, and that can
change from company to company.
So the legality of it could
change.
Keep that in mind.
When you're out there working,
they're usually judged by
whatever the broader society's
acceptable practices are.
So that can include corporate
accounting practices or public
information dissemination, which
we talked about in the realm of
cyber security and the lack of
information sharing.
And there are statutory regulations,
kipa, for example, or PCI
can come into play.
Or if you're in Europe, the DPR
is huge.
Several rather large
fines have been levied against
violations of GDP are
from companies doing business in
Europe. So you definitely
don't want to get caught short of
that.
Now, the Brookings Institute
has put out something that they call
the Ten Commandments of ethics and
information security.
I wanted to at least expose
you to this
link. It will be in the resources
page of this course
so you can refer to it and use
it to give
you some pretty broad legal
guidance.
Now, a lot of times the legality
of things comes down to 10
simple commandments like this
that can help protect you
from
using computer information
or data,
although most people don't follow
these kinds of commandments anymore
or they find little ways to wiggle
around the loopholes.
To do that, you are held
to a higher standard.
Remember that now
it's tricky because we live in a
global society and many companies
have a global footprint and
each nation has
their own cybersecurity
laws.
So it behooves you
as a practitioner
to research and know the laws
that are applicable to your own
country or your own location
here in the United States or federal
laws. And there are state laws
and they could be different.
So we have to know all of them
and be able to apply them.
So whether you're in Africa or Asia
or Europe or South America,
you're going to have to make sure
that you either know those laws
yourself or your legal department
is able to keep you abreast of
the laws and how they could
be applied to you in your
situation.
That's just a high level
overview of the legal issues
involved in the incident response.
So if you have any questions
on Cyber Monday, be one three five.
Be happy to talk to you.
Have a great day.