Unit6 - Subjective Questions

In Information Security, understanding the distinction between law and ethics is crucial for compliance and professional conduct:

1. Definition:

   • Law: Rules of conduct formally enforced by a governing authority (local, state, or federal) to maintain social order.
   • Ethics: Socially acceptable behaviors based on cultural mores, moral principles, and professional standards.

2. Enforcement:

   • Law: Enforced by police and courts. Violations result in fines, imprisonment, or other legal sanctions.
   • Ethics: Enforced by social pressure, professional bodies, or conscience. Violations result in loss of reputation, social ostracization, or revocation of professional certification.

3. Universality:

   • Law: Applies generally to everyone within a specific jurisdiction.
   • Ethics: Can be subjective and vary between cultures, organizations, or individuals.

4. Nature:

   • Law: Binary (Legal vs. Illegal). It sets the minimum standard of behavior.
   • Ethics: Nuanced (Right vs. Wrong). It represents the ideal standard of behavior.

In the context of legal liability and information security, organizations must demonstrate that they acted responsibly to prevent negligence.

1. Due Care (The Standard):

• Definition: Due care refers to the measures that a reasonable person or organization would take in a given situation to prevent harm.
• Context: It essentially asks, "Did the organization set up the correct policies and protections that a prudent entity would?"
• Example: Implementing firewalls, using antivirus software, and establishing security policies are examples of exercising due care. It implies doing the right thing.

2. Due Diligence (The Action):

• Definition: Due diligence is the continuous effort to ensure that the measures of due care are functioning effectively and are being maintained.
• Context: It asks, "Is the organization actively monitoring, updating, and verifying the security measures?"
• Example: Regularly patching software, conducting security audits, and monitoring logs for intrusions represent due diligence. It implies doing the thing right and consistently.

Legal Implication: If a security breach occurs, an organization may avoid liability if it can prove it exercised both Due Care (had safeguards) and Due Diligence (maintained them).

Comparison between Policy and Law:

• Nature: Laws are rules enforced by the state, while policies are organizational guidelines dictating acceptable behavior within a company.
• Scope: Laws apply to the general public or specific industries; policies apply only to employees and stakeholders of the organization.
• Ignorance: Ignorance of the law is not a valid defense (). However, an employee can claim ignorance of a policy if it was not communicated effectively.

Making Policies Enforceable:
To make an information security policy legally viable and enforceable within an organization, the following criteria must be met:

1. Dissemination: The policy must be distributed and accessible to all relevant employees (e.g., hard copy, intranet).
2. Review: The employees must read the policy. (Often tracked via learning management systems).
3. Comprehension: The employees must understand the policy (often verified via quizzes or training).
4. Compliance/Agreement: The employees must formally agree to the policy (e.g., signing a document or clicking "I Agree").
5. Uniform Enforcement: The policy must be enforced equally across the organization, regardless of the employee's rank.

Definition:
Cyber Crime refers to any criminal activity that involves a computer, a networked device, or a network. The computer can be either the tool used to commit the crime (e.g., hacking) or the target of the crime (e.g., DDoS attack).

Categories of Cyber Crime:

1. Crime Against Individuals:

   • Crimes targeting specific persons to cause harm or financial loss.
   • Examples: Cyberstalking, Harassment via emails, Identity Theft, Phishing, Transmission of child pornography.

2. Crime Against Property:

   • Crimes aimed at damaging or stealing property (intellectual or physical assets represented digitally).
   • Examples: Computer vandalism, Transmitting viruses/worms, Intellectual Property (IP) theft, Software piracy, Ransomware attacks.

3. Crime Against Government:

   • Crimes that threaten the sovereignty or security of a nation.
   • Examples: Cyber terrorism, Hacking government websites, Cyber espionage, Distribution of pirated software to undermine the economy.

4. Crime Against Society:

   • Crimes that affect the community at large.
   • Examples: Online gambling (where illegal), Trafficking, Financial frauds affecting large groups.

The incidence of cyber crime has grown exponentially due to several contributing factors:

1. Technological Dependency: As society becomes digitized (banking, healthcare, communication), the attack surface increases significantly.
2. Anonymity: The internet allows attackers to mask their identities using tools like proxies, VPNs, and the Dark Web, making attribution difficult.
3. Low Barrier to Entry: Tools for hacking (script kiddie tools) are easily available online. One does not need advanced programming knowledge to launch basic attacks.
4. Geographical Irrelevance: An attacker can be in one country and the victim in another, complicating legal jurisdiction and extradition.
5. High Return on Investment: Cyber crimes like Ransomware can be highly lucrative with relatively low execution costs compared to physical crimes.
6. Lack of Awareness: Many users and organizations still lack basic security hygiene (weak passwords, clicking phishing links), making them easy targets.
7. Complex Software: Modern software is complex, often containing vulnerabilities (bugs) that attackers exploit before patches are released (Zero-day exploits).

Need for Cyber Law in India:
With the boom in E-commerce and digital governance, traditional laws (like the Indian Penal Code) were insufficient to handle digital documents, electronic signatures, and virtual crimes. A specialized legal framework was required to validate digital transactions and deter cyber criminals.

Objectives of the Information Technology (IT) Act, 2000:

1. Legal Recognition of Electronic Documents: To grant electronic records the same legal status as paper-based records.
2. Digital/Electronic Signatures: To provide a legal framework for digital signatures, ensuring authentication and non-repudiation in digital transactions.
3. Offenses and Penalties: To define cyber crimes (hacking, data theft, virus dissemination) and prescribe penalties and punishments.
4. Justice Dispatch System: To establish cyber appellate tribunals for resolving disputes effectively.
5. Bankers' Books Evidence: To amend the Bankers' Books Evidence Act to accept electronic ledgers as valid evidence.
6. E-Governance: To facilitate the electronic filing of documents with government agencies.

The IT Act, 2000 (amended in 2008) acts as the primary legislation governing cyber space in India.

Project Managers (PMs) often face situations where business goals conflict with ethical standards. Common ethical dilemmas include:

1. Padding Estimations: The temptation to overestimate time or cost requirements to ensure the project stays "under budget/time," which is dishonest to the client.
2. Status Reporting: The dilemma of whether to report a project as "Green" (on track) when it is actually "Red" (failing) to avoid management scrutiny or contract termination.
3. Resourcing: Assigning unqualified personnel to a project to maximize billing rates, or overloading a top performer leading to burnout.
4. Intellectual Property: Using code or assets from a previous employer or a different client's project without permission to speed up development.
5. Hiding Defects: Releasing software with known non-critical bugs to meet a deadline without informing the stakeholders.
6. Conflict of Interest: Selecting a vendor or contractor based on personal relationships rather than merit.

Resolution: PMs should adhere to codes of ethics (like the PMI Code of Ethics) emphasizing Responsibility, Respect, Fairness, and Honesty.

Alternative Dispute Resolution (ADR):
ADR refers to a variety of processes that help disagreeing parties resolve disputes without a trial (litigation). It is generally faster, cheaper, and less adversarial than court proceedings.

Principles of Arbitration:

• Definition: Arbitration is a form of ADR where a neutral third party (the arbitrator) hears the evidence and makes a decision.
• Binding Nature: The decision (award) is usually binding on both parties and enforceable by courts.
• Privacy: Unlike court cases, arbitration is private and confidential.
• Expertise: Arbitrators are often subject matter experts (e.g., IT experts for software disputes) rather than generalist judges.

Role of Legal Counsel:
Legal counsel refers to lawyers or legal departments that advise organizations on legal rights, obligations, and liabilities.

Need for Counsel in Information Security:

1. Interpretation of Laws: InfoSec laws (like GDPR, HIPAA, IT Act) are complex. Counsel interprets how these apply to the specific technical environment.
2. Incident Response: In the event of a breach, legal counsel guides the disclosure process to ensure compliance with notification laws and to minimize liability.
3. Contract Review: They review Service Level Agreements (SLAs) and vendor contracts to ensure data protection clauses and indemnification are present.
4. Policy Formulation: They verify that internal security policies (e.g., employee monitoring) do not violate labor laws or privacy rights.
5. Litigation Defense: If the organization is sued due to a data breach, legal counsel manages the defense.
6. Intellectual Property: Protecting the organization's software patents, copyrights, and trade secrets.

1. Nmap (Network Mapper):

   • Usage: Network discovery and security auditing.
   • Function: It scans networks to identify live hosts, open ports, operating systems, and running services.

2. Wireshark:

   • Usage: Network Protocol Analysis.
   • Function: Captures and inspects data packets moving through a network in real-time. Essential for forensic analysis and troubleshooting.

3. Metasploit:

   • Usage: Penetration Testing framework.
   • Function: Allows security professionals to simulate attacks to identify vulnerabilities. It contains a large database of known exploits.

4. John the Ripper:

   • Usage: Password Cracking.
   • Function: A fast password cracker used to detect weak passwords. It supports dictionary attacks and brute-force attacks.

5. Burp Suite:

   • Usage: Web Application Security.
   • Function: An integrated platform for performing security testing of web applications, including intercepting proxies and vulnerability scanning.

Concept:
Intellectual Property (IP) theft involves robbing people or companies of their ideas, inventions, and creative expressions—known as "intellectual property"—which can include trade secrets, proprietary software, movies, music, and patents.

In the Cyber Context:

• Software Piracy: Illegal copying, distribution, or use of software.
• Corporate Espionage: Unauthorized access to a competitor's network to steal product designs, algorithms, or client lists.
• Copyright Infringement: Hosting pirated movies or music on torrent sites.

Case Example Concept:
An employee leaves Company A to join a competitor, Company B. Before leaving, they copy proprietary source code and customer databases to a USB drive. This is IP theft. The legal implications involve civil lawsuits for damages and criminal charges under acts like the IT Act (Section 66 in India - computer-related offences) or the Economic Espionage Act (in the US).

Impact: Loss of competitive advantage, revenue loss, and reputational damage.

Intermediary Liability:
An intermediary (like an ISP, Facebook, Google, or a Cyber Cafe) acts as a bridge between data creators and consumers. Section 79 of the IT Act, 2000 provides "Safe Harbor" protection to intermediaries.

Key Provisions:

1. Exemption from Liability: An intermediary is generally not liable for any third-party information, data, or communication link made available or hosted by them.
2. Conditions for Exemption: To claim this immunity, the intermediary must:
   • Act only as a facilitator (not initiate the transmission).
   • Not modify the information contained in the transmission.
   • Observe "Due Diligence" as prescribed by the government guidelines.
3. Takedown Notice: If the intermediary receives actual knowledge or a government order regarding unlawful content, they must remove or disable access to that material immediately. Failure to do so reinstates their liability.

This ensures that platforms aren't sued for every user's bad post, provided they remain neutral and responsive to legal orders.

Definition:
A Conflict of Interest occurs when an individual's personal interests (financial, family, friendship) clash with their professional duties or the interests of their employer/client. It compromises the impartiality required in professional decision-making.

Example in IT Project Management:

• Scenario: A Project Manager (PM) is responsible for selecting a software vendor to supply a new CRM system for their company.
• Conflict: The PM's spouse owns a software development firm that is bidding for the contract.
• Ethical Breach: If the PM selects their spouse's company, it may be due to personal financial gain rather than the vendor's merit. Even if the spouse's company is the best choice, the appearance of bias damages trust.

Proper Handling: The PM must disclose this relationship to the stakeholders immediately and recuse themselves from the selection process to ensure fairness and transparency.

Denial of Service (DoS):

• Goal: To shut down a machine or network, making it inaccessible to its intended users.
• Mechanism: The attacker floods the target with traffic or sends information that triggers a crash. It is a one-to-one attack (one attacker machine vs. one target).
• Impact: Temporary suspension of services.

Distributed Denial of Service (DDoS):

• Goal: Same as DoS, but much more powerful and harder to stop.
• Mechanism: The attacker uses a Botnet—a network of infected computers (zombies) controlled remotely.
• Process:
  1. Attacker infects computers globally with malware.
  2. Attacker sends a command to the botnet.
  3. All infected computers simultaneously send requests to the target server.
• Result: The massive volume of traffic overwhelms the target's bandwidth or processing power (CPU/RAM), causing a total outage.

Legal Aspect: Both are illegal under Section 66F (Cyber Terrorism - if critical infra) or Section 43 (Damage to computer systems) of the IT Act.

The PMI Code of Ethics and Professional Conduct is vital for Information Security projects because these projects often deal with sensitive data and high risks. The code focuses on four values:

1. Responsibility:

   • Application: Taking ownership of decisions. If a security flaw is found, the PM must report it rather than ignoring it to meet a deadline. It involves acknowledging errors and correcting them.

2. Respect:

   • Application: Treating team members and resources with dignity. In global security projects, this means respecting diverse cultural views on privacy and authority.

3. Fairness:

   • Application: Making decisions impartially. When hiring security consultants or selecting vendors, decisions must be free from bribery or favoritism.

4. Honesty:

   • Application: Understanding the truth and acting in a truthful manner. A PM must not mislead stakeholders about the security posture of the project. If the system is not secure, the PM must say so, even if it delays the launch.

Adhering to these values builds trust, which is the currency of the security industry.

Definition:
Mediation is a voluntary, non-binding process where a neutral third party (the Mediator) helps disputing parties communicate and negotiate a mutually acceptable settlement.

Key Characteristics:

1. Facilitative: The mediator does not decide the outcome (unlike an arbitrator or judge). They facilitate the conversation.
2. Voluntary: Both parties must agree to participate and can withdraw at any time.
3. Confidential: Discussions in mediation cannot usually be used as evidence in court later.
4. Creative Solutions: Parties can agree to solutions that a court might not be able to order (e.g., a public apology, a joint press release, or restructuring a business relationship).

Process:

• Opening Statement by Mediator.
• Statements by Parties.
• Joint Discussion.
• Private Caucuses (Mediator meets parties individually).
• Closure (Agreement or termination).

Relevance in IT: Useful for resolving software contract disputes where maintaining a continuing business relationship is important.

Definition:
Computer Vandalism refers to the act of physically or virtually damaging computer systems or data. Unlike theft, the primary motive is destruction or defacement rather than financial gain.

Types:

1. Physical Vandalism: Smashing hardware, cutting cables, or destroying storage media.
2. Virtual Vandalism: Deleting files, formatting hard drives, website defacement (changing the homepage of a site to a political message), or releasing malware designed to corrupt data.

Legal Treatment (India - IT Act 2000):

• Section 43: Deals with penalty and compensation for damage to computer, computer system, etc. If a person damages or disrupts any computer system without permission, they are liable to pay damages.
• Section 66: If the act described in Section 43 is done dishonestly or fraudulently, it becomes a criminal offense punishable with imprisonment up to 3 years or a fine up to ₹5 Lakhs, or both.

It is treated as a serious offense against property.

Definition:
Computer Forensics (or Digital Forensics) is the application of investigation and analysis techniques to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law.

Significance in Cyber Crimes:

1. Evidence Recovery: It allows investigators to recover deleted, encrypted, or hidden files that criminals thought were destroyed.
2. Attribution: Analysis of logs (IP addresses, timestamps) helps trace the attack back to a specific device or location.
3. Timeline Reconstruction: Forensics helps establish the "Who, What, Where, When, and How" of a crime by creating a chronological timeline of events.
4. Legal Admissibility: Proper chain of custody procedures ensures the evidence is not tampered with, making it admissible in court.
5. Scope: It covers disk forensics (hard drives), network forensics (traffic analysis), and mobile forensics.

Without forensics, digital evidence would be easily dismissed as unreliable.

1. Civil Law:

• Focus: Disputes between individuals or organizations (e.g., contract disputes, torts).
• Objective: To compensate the victim (Plaintiff) for loss or harm.
• Burden of Proof: "Preponderance of evidence" (more likely than not).
• InfoSec Context: Breach of contract (SLA violations), negligence in protecting data (suing for damages due to a leak), theft of trade secrets.
• Outcome: Financial compensation (Damages) or Injunctions.

2. Criminal Law:

• Focus: Offenses against society or the state.
• Objective: To punish the offender and deter others.
• Burden of Proof: "Beyond a reasonable doubt" (very high standard).
• InfoSec Context: Hacking, cyber terrorism, child pornography, identity theft, willful destruction of data.
• Outcome: Imprisonment, probation, or fines paid to the government.

Note: A single incident (e.g., hacking) can result in both criminal charges (jail) and a civil lawsuit (paying the victim).

Concept of Jurisdiction:
Jurisdiction refers to the official power of a court or government to make legal decisions and judgments over a person or subject matter.

Challenges in Cyber Law:
Traditional jurisdiction is based on geography (physical location). The internet is borderless, leading to complex issues:

1. Location Discrepancy: The attacker may be in Country A, the server in Country B, and the victim in Country C. Which country's laws apply?
2. Cross-Border Evidence: Collecting evidence (servers/logs) located in another country requires Mutual Legal Assistance Treaties (MLATs), which are slow and bureaucratic.
3. Dual Criminality: An act may be a crime in one country (e.g., online gambling or free speech restrictions) but legal in the country where the server is hosted.
4. Extradition: Even if identified, extraditing a cyber criminal from a non-friendly nation is extremely difficult.

Solution Mechanisms: Laws like the IT Act, 2000 claim Extra-territorial Jurisdiction (Section 75), stating the law applies to offenses committed outside India if they involve a computer resource located in India.