CYB100_Week2Discussion_post2_2023

In my case, I choose Microsoft and it’s very interesting because of the number of laws and

regulations they carry with them but it’s also interesting because the laws and rules are vital

to ensuring public safety and company property. I know that certain companies sell users'

information but never private information, this comes into a privacy act where companies

cannot share sensitive user information and only things like pages visited or things you like.

This is how targeted ads work which are major moneymakers for Microsoft and companies

like google. There can be huge impacts on a company that violates any rules or laws in

place, which includes areas such as the cyber domain, lawsuits, and other legal issues that

could lead to bigger problems can happen if a company violates any of these rules set or

avalibility of their financial information. This law affects all different businesses that store

financial information so that they may not sell the information or lack security protocols to

protect that information. Another law that affects the cyber domain is the Electronic Funds

Transfer Act. This law states that anyone electronically transferring funds are protected

against errors and fraud. This can include any company that is electronically transferring

funds to or from an account. This can include ATM's, telephone bill payements, and POS

terminals. Another law that affects the cyber domain is Health Information Technology for

Economic and Clinical Health Act. This law is a direct modification to the HIPAA law that

while on it's own is directly targeted at the medical community but with this brings major

modifications to the way that patients information is stored and accessed. It states that

patient information stored must be secured in a reasonable way and helps to expand the

scope of the patient confidentiality of HIPAA. After doing extensive research on the laws

and regulations provided in this discussion I have come to the conclusion that the law that

impacts information security professionals the most in my opinion would be the Health

Insurance Portability and Accountability Act (HIPAA). This law basically protects the

patient’s personal information from anyone beside the person who is treating them. Their

caregiver is not allowed to share any of the information they receive without consent from

the patient. This law gives reassurance to both parties. The type of information this

regulation protects includes, but is not limited to, your payment information, address, health

information. There is a lot of information that a hospital receives when your being cared for,

and you do not want to let anyone get into your personal information. Not everyone has this

security, but I am glad I know my information is safe when I am being cared for. The law

that affects my organization the most is the Fair and Accurate Credit Transaction Act

(FACTA). This is because my organization often deals with credit applications and this

helps those customers avoid identity theft. If we follow this law as a company, we will not

have any issues. Not all nations have the same rules, but I am relatively familiar with the

laws I need to be following. The three laws and regulations that I see that fit to the company

I chose are Sarbanes-Sarbanes-Oxley Act, Federal Rules of Civil Procedure and also, one

that originated in the EU that affects us here in the states as well, the General Data

Protection Regulation. The Sarbanes-Sarbanes-Oxley Act is a 2002 law was a response to

corporate fraud and is designed to improve corporate disclosures and transparency. For IT

and security folks, that means information control and integrity, business continuity and

disaster recovery, and protecting information (and financial performance) from the impact of

a data breach or loss. The FRCP discovery rules govern court procedures for civil lawsuits It

makes clear that electronically stored information is discoverable, and they detail what, how

and when electronic data must be produced. As a result, companies must know what data

they are storing and where it is; they need policies in place to manage electronic data; they

need to follow these policies; and they need to be able to prove compliance with these

do so it regulates how such data is collected, stored, processed, and destroyed. The definition

of "personal data" is extremely broad: It includes names, addresses, and bank details, but

also data related to religion, race, mental or physical characteristics, and even IP addresses,

web cookies, contacts, and mobile device IDs, if they identify an individual.

not free game for threats to linger unchecked. The ethics of the cyber domain especially

across the world multiple governments and countries with each their own ethics and laws

driven from their culture is very enticing to threats as the perception of exploiting and

committing crime with minimal risk to the threat. The company I chose in week one was

Apple and they have a cross functional approach to conduct business on the cyber domain.

Meaning they have their own set of ethics and principles of how their customers should be

treated in person and in the cyber domain. They also have expectation to security and

privacy as we trust them with much of our personal information and financial information.

The ethics and principles Apple has from what I can tell developed from most of society in

stored somewhere on an information system. These laws and regulations give security

professionals boundaries to work within which helps them to understand to what level

information needs to be protected. There are different types of information being handled

depending on the service that a company may provide. Companies that deal with electronic

transactions have to comply with regulations like payment card industry data security

Standard (PCI DSS) and the Electronic Fund Transfer Act. Both of these regulations keep

consumers electronically stored information safe. PCI DSS provides an enhanced security

level when it comes to a customer’s payment account data. This set of requirements include

things like security management, policies, and other protective measures. Electronic Fund

Transfer Act protects consumers from errors and fraud while conducting electronic fund

transfers (EFT). This Act covers things like ATM transfers and POS terminal transfers in

stores. In 2010, a new provision was added to keep companies from charging inactivity or

service fees on pre-paid purchases like gift cards. CACI is impacted by these laws and

regulations on many fronts as they try to protect their own data from threats but they also

purchase things like gift cards for their employees. In that realm they have to make sure they

purchase from law abiding companies as their employees can be susceptible to illegal

practices. The company also operates in Nevada and Massachusetts so they have to follow

those states regulations in reference to collecting resident’s information. In Nevada, they

enacted a data security law to encrypt customers’ personal information if it is to be stored or

security measures or software they need to. This probably can be applied to all of the laws

researched. The law that stood out to me the most in regard to the organization I chose was

the PCI DSS law. It requires policies and protective measures to keep customers account

information safe. It is a requirement to be implemented with PCI DSS if you accept credit

cards no matter the size of your business. While being implemented is a requirement being

compliant is not, but it reduces the risk of credit card fraud if you are. If your business is not

complaint with PCI DSS and you experience a security breach you may have to pay fines.

From what I have been able to find it seems Europe uses PCI DSS however, I wasn’t able to

find a full list of countries it is used in. I don’t know that I have ever had any direct

experience with any of the laws, HIPPA is the law I am most familiar with though. I feel

that the Federal Information Security Management Act (FISMA) mostly impact

professionals. Professionals are responsible for providing security programs for information

systems and are required to perform assessments. Some of the main roles for the

professionals that are held responsible for upholding this law includes testing and evaluating

how effective the information security policies are. After researching through the

international laws and regulations, they focus mainly on protecting disclosure of personal

information from businesses and organizations. My experience with the laws and regulations

would most likely relate to the Fair and Accurate Credit Transaction Act (FACTA),

including Red Flags Rule. I work in an office building that receives applications from

date for what ever process, is responsible for the data. the IT guy is responsible for maintain

the systems and logging vulnerabilities along with testing and monitoring, and if I

understand correctly PCI security standard council is responsible for enforcing the standard.

This affects System76 by the way they collect payment for customers purchases, they do

practice some transference of liability by allowing customers the option to finance their

purchase, which at that point the creditor carries the responsibility of maintaining the data.

This process is well practiced across the board all over, it seems to me like most every

retailer online has a very similar way they process payments and many offer a third party

credit line possibly, which in turn transfers the responsibility. I understand the PCI DSS

standards, again, simply because it is just that a standard that most every retailer follows

both here in the U.S. and abroad. I think the transference of responsibility is becoming more

of the option the retailers would prefer since most major retailers offer some kind of credit

card with perks attached to them. Cyber security is the practice of defending computers,

servers, mobile devices, electronic systems, networks, and data from malicious attacks. It's

also known as information technology security or electronic information security. Today,

there is no consensus on who is responsible for data privacy. Some consumers agree that the

responsibility lies with them, but others think governments or businesses are better equipped

to deal with this complex issue. Data breaches have become both more common and more

severe. Cyber attacks that were previously considered large-scale are today seen as normal.

leaders, meanwhile, are pushing for federal privacy laws, and are beginning to see privacy as

a human right. After doing some research on the laws and regulations that most impacts

information security professionals there was one that stood out to me and that is the Health

Insurance Portability and Accountability Act (HIPAA). The Health Insurance Portability and

Accountability At is intended to improve the efficiency and effectiveness of the health care

system. It does so by protecting the patient identifiable health information and by protecting

the confidentiality, and availability of patients information. I know about this act from

experience because I am HIPAA certified. So I am a medical assistant and we are one of the

people who has to follow the the rule of HIPAA. This is very important for the patient