Title: Class Outline 28
Course: KVCC BUS118 > Section: Class Outlines

1.      IS Challenges facing the Federal Government

a.      Computer Security Act – 1987 – every federal agency inventory systems and create security plans which were reviewed early. Ends up being replaces by FISMA.

b.      Cyberspace Policy review – 2009 lead to the creation of the Cybersecurity czar.

c.      Executive order on cybersecurity – 2013 – creation of NIST cybersecurity framework.

d.      Cyberwar

2.      FISMA – Federal Information Security Management Act - 2002

a.      Purpose and scope

i.           Six main provisions – pg 222

b.      Main Requirements

i.           Agency wide information security program including:

I.           Risk assessments

II.           Annual Inventory

III.           Policies and procedures

IV.           Subordinate Plans

V.           Security awareness training

VI.           Testing and evaluation

VII.           Remedial Actions

VIII.           Incident Response

IX.           Continuity of operations

ii.           Testing and review – at least once a year

I.           Cyberscope

II.           Places to send yearly report – pg 224

III.           Inspector General

c.      Role of NIST

i.           FISMA Requirement pg 226

ii.           Federal Information Processing Standards FIPS

I.           Mandatory

II.           Have 1 year to comply with new standards

III.           Do not apply to National Security

IV.           Public Review for 30-90 days

V.           Department of Commerce has to approve things before being finalized

I.           Special Publications SP

II.           Works with Industry to develop

III.           Not as formal of a process

IV.           Provide guidance are not mandatory

iii.           Risk management Framework

I.           6 steps to protect federal information systems –pg 227 Diagram on pg 228

II.           3 Security Categories

1.      Low – low impact minor damage

2.      Moderate – moderate impact significant damage

3.      High – high impact major damage

III.           FIPS 200

1.      17 areas pg 229

2.      SP 800-53

3.      Supporting Documents table pg 231

1. Central incident response center

1. Responsibilities

a.      Give technical supports

b.      Share information

c.      Inform about current and potential threats

d.      Consult with NIST

1. Incident categories

e.      Pg 232

f.       Time frame chart pg 233

II.           National Security systems

1.            Types of systems – pg 233

2.            Except from classified information

3.            Committee on National Security Systems

a.         21 voting members

b.         CNSS.GOV

III.              Access Control Models

1.      Discretionary access control DAC – identity of subject seeking access

2.      Mandatory access control MAC – based on security labels

3.      Role Based access control RBAC – users are assigned roles

IV.           Oversight

1.      OMB

2.      DHS

V.           Privacy in Federal Information Systems

1.      Two Acts

a.      The Privacy Act of 1974

i.           Records

ii.           12 Exceptions pg 236

iii.           Access to records

iv.           Systems of records notice SORN

v.           Suing

b.      The E-Government Act 0f 2002

i.           Requirements

1.      Review IT systems for privacy risks

2.      Post privacy notices on website

3.      Post machine readable privacy polices

4.      Report privacy activities to the OMB

ii.           Privacy Impact Assessment

1.      Necessary information pg 238

c.      OMB Breach Notification Policy

i.           Considerations pg 239

ii.           Other requirements pg 240

VI.           Import and Export Control laws

1.      3 Types

a.      ITAR

i.           Department of State

ii.           Military or Defense Applications

iii.           Sever Penalties

b.      EAR

i.           U.S. Department of Commerce

ii.           Bureau of Industry and Security

iii.           Dual use both military and commercial use

iv.           Criminal and civil penalties

c.      OFAC

i.           Treasury Department

ii.           Trade sanctions and embargoes

VII.                 Case Studies

Chapter 9

i.           Relationship between States and Federal Government

ii.           Choicepoint data breach summary

iii.           California Breach notification act -2003

a.           Who does it apply to – anyone who has unencrypted data on California resident

b.           Definition of Personal Information – pg 252

c.           Notification

i.           2 possible reasons for delay

1.To assess extent

2.To provide time for investigation

ii.           Written notice requirements – pg 253

iii.           Other types of notice

iv.           Other breach notification laws

a.           Activities that constitute a breach

i.           California – access to data

ii.           Arizona 2 part test – must cause economic harm

iii.           Ohio – risk of identity theft

b.           Entities covered by law

i.           California – anyone that stores personal info

ii.           Georgia – Information brokers – no state

iii.           Maine – like Georgia but then added the state

c.           Time for notification

i.           California – as fast as possible

ii.           Ohio/Florida – soon as possible no later than 45 days

iii.           Maine – delay if requested from law enforcement

d.           Contents of notification

i.           California – contents of notice previously discussed

ii.           North Carolina – pg 256

e.           Encryption requirements

i.           Encryption safe harbor

ii.           Some states get specific as to what style of encryption

f.           Penalties for failure to notify

i.           Different states have different penalties

g.           Private cause of action’

i.           Some states allow for suing others do not

ii.           Many states have different laws and this makes the actions of a business confusing if they extend beyond multiple states

iii.           Decision tree on pg 259

h.           Federal Legislation

i.           Data Specific Security and Privacy regulations

i.           Minnesota and Nevada PCIDSS

ii.           Indiana limiting SSN

iii.           Encryption regulations

1.Massachusetts – law requirements

2.Nevada encryption standards

j.           Data Disposal

i.           Washington State – any person or entity

ii.           New York State – protections on any record

k.           Case Studies

Attached Files: | - KVCC BUS118_LegalAspectsBusInfoSys_Class Outlline 28(1).pdf