Module 2.1: Legal, Ethical, and Professional Issues in Information Security

prelim topic

Laws

• Are rules that mandate or prohibit certain behavior and are enforced by the state

Ethics

• These regulate and define socially acceptable behavior

Cultural mores

• Are fixed moral attitudes or customs of a particular group

Liability

• The legal obligation of an entity extending beyond criminal or contract law; includes the legal obligation to make resitution

Restitution

• The legal obligation to compensate an injured party for wrongs committed

Jurisdiction

• The court’s right to hear a case if the wrong was committed in its territory or involved its citizenry

Long-arm jurisdiction

• The application of laws to those residing outside a court’s normal jurisdiction; usually granted when a person acts illegally within the jurisdiction and leaves

Policies

• These are managerial directives that specify acceptable and unacceptable employee behavior in the workplace

• These function as organizational laws; must be crafted and implemented with care to ensure they are complete, appropriate, and fairly applied to everyone.

Privacy

• The rights of individuals or groups to protect themselves and personal information from unauthorized access.

Identity Theft

• It can occur when someone steals victim’s personally identifiable information (PII) and poses as victim to conduct actions/make purchases.

(ACM) Association of Computing Machinery

• Code of 24 imperatives of personal and ethical responsibilities for security professionals

• Code of ethics that contains references to protecting information confidentiality, causing no harm, protecting other’s privacy, and respecting others’ intellectual property and copyrights

(ISACA) Information Systems Audit and Control Association

• Professional association with focus on auditing, control, and security

• Concentrates on providing IT control practices and standards

(ISSA) Information Systems Security Association

• Nonprofit society of information security professionals

• Professional association of information security professionals; provides education forums, publications, and peer networking for members

(ISC2) International Information Systems Security Certification Consortium

• International consortium dedicated to improving the quality of security professionals through SSCP and CISSP certifications

SANS (System Administration, Networking, and Security Insitute)

• Offers a set of certs called Global Information Assurance Certification (GIAC)

• GIAC certifications focus on security administration, security management, IT audits, and software security

Data Privacy Act of 2012

(Philippine Laws)

• Regulates how personal and sensitive information is collected, processed, stored, and shared

Cybercrime Prevention Act of 2012

(Philippine Laws)

• Criminalizing offenses committed in cyberspace: hacking, illegal access, data interference, identity theft, cyber libel, etc.

Electronic Commerce Act of 2000

(Philippine Laws)

• This law provides legal recognition to electronic documents, electronic signatures, and electronic transactions

• The country’s foundational IT law

Internet Transactions Act of 2023

(Philippine Laws)

• A new law designed to build trust in the digital economy and protect online consumers

• Regulates e-commerce marketplaces, digital platforms, and online merchants

SIM Registration Act (2022)

(Philippine Laws)

• Mandates all end-users to register their SIM cards with their respective public telecommunications entities using valid government IDs

• Passed to combat the massive surge in mobile-based cybercrimes and text scams

Intellectual Property Code of the Philippines

(Philippine Laws)

• This law safeguards various creations of the mind by offering automatic protection for copyrights, renewable ten-year terms for trademarks, and 20-year monopolies for patented inventions