A definitive guide to cybersecurity law Expanding on the author’s experience as a cybersecurity lawyer and law professor, Cybersecurity Law is the definitive guide to cybersecurity law, with an in-depth analysis of U.S. and international laws that apply to data security, data breaches, sensitive information safeguarding, law enforcement surveillance, cybercriminal combat, privacy, and many other cybersecurity issues. Written in an accessible manner, the book provides real-world examples and case studies to help readers understand the practical applications of the presented material. The book begins by outlining the legal requirements for data security, which synthesizes the Federal Trade Commission’s cybersecurity cases in order to provide the background of the FTC’s views on data security. The book also examines data security requirements imposed by a growing number of state legislatures and private litigation arising from data breaches. Anti-hacking laws, such as the federal Computer Fraud and Abuse Act, Economic Espionage Act, and the Digital Millennium Copyright Act, and how companies are able to fight cybercriminals while ensuring compliance with the U.S. Constitution and statutes are discussed thoroughly. Featuring an overview of the laws that allow coordination between the public and private sectors as well as the tools that regulators have developed to allow a limited amount of collaboration, this book also: • Addresses current U.S. and international laws, regulations, and court opinions that define the field of cybersecurity including the security of sensitive information, such as financial data and health information • Discusses the cybersecurity requirements of the largest U.S. trading partners in Europe, Asia, and Latin America, and specifically addresses how these requirements are similar to (and differ from) those in the U.S. • Provides a compilation of many of the most important cybersecurity statutes and regulations • Emphasizes the compliance obligations of companies with in-depth analysis of crucial U.S. and international laws that apply to cybersecurity issues • Examines government surveillance laws and privacy laws that affect cybersecurity as well as each of the data breach notification laws in 47 states and the District of Columbia • Includes numerous case studies and examples throughout to aid in classroom use and to help readers better understand the presented material • Supplemented with a companion website that features in-class discussion questions and timely and recent updates on recent legislative developments as well as information on interesting cases on relevant and significant topics Cybersecurity Law is appropriate as a textbook for undergraduate and graduate-level courses in cybersecurity, cybersecurity law, cyber operations, management-oriented information technology (IT), and computer science. This book is also an ideal reference for lawyers, IT professionals, government personnel, business managers, IT management personnel, auditors, and cybersecurity insurance providers. JEFF KOSSEFF is Assistant Professor of Cybersecurity Law at the United States Naval Academy in Annapolis, Maryland. He frequently speaks and writes about cybersecurity and was a journalist covering technology and politics at The Oregonian, a finalist for the Pulitzer Prize, and a recipient of the George Polk Award for national reporting.
Author: Tari Schreider, SSCP, CISM, C|CISO, ITIL Foundation
Publisher: Rothstein Publishing
Category: Business & Economics
In today’s litigious business world, cyber-related matters could land you in court. As a computer security professional, you are protecting your data, but are you protecting your company? While you know industry standards and regulations, you may not be a legal expert. Fortunately, in a few hours of reading, rather than months of classroom study, Tari Schreider’s The Manager’s Guide to Cybersecurity Law: Essentials for Today’s Business, lets you integrate legal issues into your security program. Tari Schreider, a board-certified information security practitioner with a criminal justice administration background, has written a much-needed book that bridges the gap between cybersecurity programs and cybersecurity law. He says, “My nearly 40 years in the fields of cybersecurity, risk management, and disaster recovery have taught me some immutable truths. One of these truths is that failure to consider the law when developing a cybersecurity program results in a protective façade or false sense of security.” In a friendly style, offering real-world business examples from his own experience supported by a wealth of court cases, Schreider covers the range of practical information you will need as you explore – and prepare to apply – cybersecurity law. His practical, easy-to-understand explanations help you to: Understand your legal duty to act reasonably and responsibly to protect assets and information. Identify which cybersecurity laws have the potential to impact your cybersecurity program. Upgrade cybersecurity policies to comply with state, federal, and regulatory statutes. Communicate effectively about cybersecurity law with corporate legal department and counsel. Understand the implications of emerging legislation for your cybersecurity program. Know how to avoid losing a cybersecurity court case on procedure – and develop strategies to handle a dispute out of court. Develop an international view of cybersecurity and data privacy – and international legal frameworks. Schreider takes you beyond security standards and regulatory controls to ensure that your current or future cybersecurity program complies with all laws and legal jurisdictions. Hundreds of citations and references allow you to dig deeper as you explore specific topics relevant to your organization or your studies. This book needs to be required reading before your next discussion with your corporate legal department.
This book discusses the legal and regulatory aspects of cybersecurity, examining the international, regional, and national regulatory responses to cybersecurity. The book particularly examines the response of the United Nations and several international organizations to cybersecurity. It provides an analysis of the Council of Europe Convention on Cybercrime, the Commonwealth Model Law on Computer and Computer Related Crime, the Draft International Convention to Enhance Protection from Cybercrime and Terrorism, and the Draft Code on Peace and Security in Cyberspace. The book further examines policy and regulatory responses to cybersecurity in the US, the UK, Singapore, India, China, and Russia. It also looks at the African Union's regulatory response to cybersecurity and renders an analysis of the Draft African Union Convention on the Establishment of a Credible Legal Framework for Cybersecurity in Africa. The book considers the development of cybersecurity initiatives by the Economic Community of West African States, the Southern African Development Community, and the East African Community, and further provides an analysis of national responses to cybersecurity in South Africa, Botswana, Mauritius, Senegal, Kenya, Ghana, and Nigeria. It also examines efforts to develop policy and regulatory frameworks for cybersecurity in 16 other African countries (Algeria, Angola, Cameroon, Egypt, Ethiopia, Gambia Lesotho, Morocco, Namibia, Niger, Seychelles, Swaziland, Tanzania, Tunisia, Uganda, and Zambia). Nigeria is used as a case study to examine the peculiar causes of cyber-insecurity and the challenges that hinder the regulation of cybersecurity in African states, as well as the implications of poor cybersecurity governance on national security, economic development, international relations, human security, and human rights. The book suggests several policy and regulatory strategies to enhance cybersecurity in Africa and the global information society with emphasis on the collective responsibility of all states in preventing trans-boundary cyber harm and promoting global cybersecurity. It will be useful to policy makers, regulators, researchers, lawyers, IT professionals, law students, and any person interested in seeking a general understanding of cybersecurity governance in developed and developing countries.Ã²Ã²
This book gives insight into the legal aspects of data ownership in the 21st century. With the amount of information being produced and collected growing at an ever accelerating rate, governments are implementing laws to regulate the use of this information by corporations. Companies are more likely than ever to face heavy lawsuits and sanctions for any misuse of information, which includes data breaches caused by cybercriminals. This book serves as a guide to all companies that collect customer information, by giving instructions on how to avoid making these costly mistakes and to ensure they are not liable in the event of stolen information.
This book presents a framework to reconceptualize internet governance and better manage cyber attacks. It examines the potential of polycentric regulation to increase accountability through bottom-up action. It also provides a synthesis of the current state of cybersecurity research, bringing features of cyber attacks to light and comparing and contrasting the threat to all relevant stakeholders. Throughout the book, cybersecurity is treated holistically, covering issues in law, science, economics and politics. This interdisciplinary approach is an exemplar of how strategies from different disciplines as well as the private and public sectors may cross-pollinate to enhance cybersecurity. Case studies and examples illustrate what is at stake and identify best practices. The book discusses technical issues of Internet governance and cybersecurity while presenting the material in an informal, straightforward manner. The book is designed to inform readers about the interplay of Internet governance and cybersecurity and the potential of polycentric regulation to help foster cyber peace.
The U.S. government is responsible for protecting the country's energy and technology infrastructure. Critics argue the United States has failed to prepare, protect and respond to incidents involving the national electric grid leaving communities vulnerable to prolonged power outages. Protection of investor owned utilities' critical infrastructure is vulnerable to cyber and physical harm from the absence of criminalizing the intrusion of private sector computer networks, the lack of cybersecurity threats in emergency management, and the absence of cyber-intelligent leadership supports this argument. The purpose of this study was to introduce an electric grid protection theoretical concept, while identifying whether cybersecurity law and emergency management, amongst the investor-owned utility community, has an optimized relationship for protecting the national electric grid from harm. Easton's political system input/output model, Sommestad's cybersecurity theory, and Mitroff's crisis management theory provided the theoretical foundations for this study. The study utilized a mixed method research design that incorporated a Likert collection survey and combined quantitative chi-square and qualitative analysis. The key findings identified that cybersecurity law and the use of emergency management in the electric grid protection theory were not optimized to protect the national electric grid from harm. The recommendations of this study included the optimization of the theory elements through educational outreach and amending administrative cybersecurity law to improve the protection of the national electric grid and positively impacting social change by safeguarding the delivery of reliable electric energy to the millions of Americans who depend upon it.
An essential compliance tool for every privacy officer and attorney involved in managing privacy and data security issues, Privacy and Cybersecurity Law Deskbook provides the thorough, practical, sector-specific guidance that helps you meet today's challenges and minimize the risk of data breaches that can damage a company's reputation. Written by one of the world's foremost legal practitioners in the field, Privacy and Cybersecurity Law Deskbook (formerly titled Privacy and Data Law Deskbook) has been updated in this 2018 Edition to include: The groundbreaking EU General Data Protection Regulation Adoption of the European Commission Directive on Network and Information Security (NIS Directive) Updates to the APEC Privacy Framework Recent HHS guidance on ransomware and cloud computing Nullification of the Federal Communication Commission's Broadband Consumer Privacy Rules Recent FTC enforcement actions addressing companies' use of online tracking mechanisms The newly enacted New York State Department of Financial Services Cybersecurity Regulation The importance of cybersecurity in corporate transactions Recent FTC enforcement actions for privacy and information security violations, including Upromise, VIZIO, InMobi, and ASUSTek Computer Updates to various global privacy laws, including new information about breach notification and data localization requirements Keep Abreast of the Latest Developments to Identify to Comply with Privacy and Cybersecurity Laws-- Across the Country and Around the World. Only Privacy and Cybersecurity Law Deskbook makes it simple to: Comply with global data protection laws Navigate the various state-by-state breach notification requirements Keep completely current on emerging legal trends
"...excellent for use as a text in information assurance orcyber-security courses...I strongly advocate thatprofessors...examine this book with the intention of using it intheir programs." (Computing Reviews.com, March 22, 2007) "The book is written as a student textbook, but it should beequally valuable for current practitioners...this book is a veryworthwhile investment." (Homeland Security Watch, August 17,2006) While the emphasis is on the development of policies that lead tosuccessful prevention of terrorist attacks on the nation’sinfrastructure, this book is the first scientific study of criticalinfrastructures and their protection. The book models thenation’s most valuable physical assets and infrastructuresectors as networks of nodes and links. It then analyzes thenetwork to identify vulnerabilities and risks in the sectorcombining network science, complexity theory, modeling andsimulation, and risk analysis. The most critical components become the focus of deeper analysisand protection. This approach reduces the complex problem ofprotecting water supplies, energy pipelines, telecommunicationstations, Internet and Web networks, and power grids to a muchsimpler problem of protecting a few critical nodes. The new editionincorporates a broader selection of ideas and sectors and moves themathematical topics into several appendices.