I will be honest with you.
Whenever we cyber security instructors hit the section on information security laws and standards,
we have some trepidation.
That is because the typical student immediately wants to check out and not listen.
Yes, this tends to be kind of dry, boring content.
But one of the things that we need to do is we need to make flashcards typically if we don't know these
laws and standards like the back of our hand.
Well, flashcards can really help drill these in, and we know that you probably won't make them on
your own.
So we took the liberty of making them for you.
We told you this would be the ultimate guide, and there will be an assignment coming up on flashcards.
But let's just get some of this out of the way.
This is going to be very quick.
I'm not going to expound on these much at all.
It's just straightforward information.
The biggest thing I want you to get, though, is that laws are rules that are enforced by some entity
like government and standards.
They're more geared towards accepted best practices.
Now, where this can get a little tricky is when there are standards that are then enacted as law.
And we'll see one of those coming up where the United States federal government said, okay, we're
going to take this standard and we're going to make it the law that federal government employees must
follow it.
So, yeah, it gets a little tricky because sometimes those standards do actually become the law.
And you know, in all fairness, I just realized I think another reason students tend to glaze over
on this stuff is that maybe they're already in an enterprise or organization that is dealing with this
stuff all the time.
So they are so sick of hearing about something like the payment card industry, data security standard,
PCI, DSS, s.
So these are standards that we are expected to follow if we are working with credit cards.
So one of the things about this that is interesting is you might think, well, wait a minute, it's
a standard.
I wouldn't have to do any of this stuff by law.
And well, that is true, kind of.
So what will happen is these credit card companies, if you're not doing this stuff, they will refuse
to do business with you.
So as you might guess, it is a big time problem.
If you are doing business and then all of a sudden you can't accept credit cards as payment, for instance.
So it is kind of like the law.
Well, the PCI idiocy standards say, look, that if you're dealing with this credit card info, you
better be building and maintaining a secure network.
That's music to our ears.
As cybersecurity professionals.
They want to make sure you protect that cardholder data, of course, at all times, have a vulnerability
management program so that you can be shoring up those vulnerabilities as they become made available
or made known.
And then implement strong access control measures, of course, and regularly monitor and test networks.
These are all great ideas and standard excellent ideas for networks today.
But the PCI, DSS has to go right out and step by step educate organizations about what they're supposed
to do here.
And of course, it all comes together with a comprehensive information security policy.
Boy, oh, boy.
If all organizations would just do that, we'd be so much better off.
Well, when we got started here and we're kind of on the trickiest topic, and that is what's the difference
between a law and a standard.
They seem interchangeable.
We're talking about a set of standards that might be enacted by law.
And this is the FBI's MA.
It's the Federal Information Security Management Act.
And again, this is for U.S. federal operations and assets to protect them.
They're standards that help with categorization.
There's minimum security requirements that government assets must have.
There's appropriate security control selection guidance that's given, and even information on accessing
the security controls and setting up secure authorization.
So lots of great guidelines for those in the United States federal government.
And it's not just a nice to do thing.
They have to follow them by law.
Now, one of the most famous laws about cybersecurity is, of course, the general data protection regulation,
GDPR.
And when you first learn about this, you say, Well, wait a minute, this was developed by the EU
for the EU.
So here I am sitting here in the United States where we do our business.
Why do I care about this?
Well, here's the thing.
While it was developed by the EU for the EU, if you work with the EU, you got to follow it.
So, of course, all of the world, right?
Most of the world is going to want to work with the EU and trade and do all kinds of fun stuff with
the EU.
So transactions, business transactions, that would be.
And so we need to know about the general data protection regulations.
This is seeking lawfulness, fairness, transparency in transactions, making sure someone doesn't get
your information and then do more with it than they're supposed to.
Also get the minimal amount of information from you, make sure it's kept accurate and made sure that
they store it exactly where they tell you they are going to store it and not start having copies of
your information all over the place.
And of course, remember integrity.
That means that the data is not altered.
We can really say that the data is genuine and altered.
And of course, confidentiality states that no one can read it.
Encryption is typically how we achieve that, of course.
The GDPR also spells out accountability.
That's right.
We need to be able to audit and track the actions of these organisations when they are dealing with
this important data.
How about the Data Protection Act or DPA of 2018?
This was a framework for data protection that was developed in the UK and it updated and replaced,
thank goodness, a 1998 act.
Do you think anything's changed in the world of data from 98 to 2018?
I would say so.
This again, is going to make sure things are processed lawfully and it is going to confer certain rights
on whoever has the data.
And it's also going to confer functions on who's maybe storing the data.
So it's really going to spell out the exact requirements for both parties.
What about other countries?
If we didn't mention your country of origin, I feel like I'm leaving you out.
So what we did was we went ahead and put together an assignment that follows this video so you can check
out some of the laws in other countries.
And by the way, the crux of any questions that you might see in these laws, of course, are going
to come from what we just covered in this video.
Thanks so much for watching.