First off, my apologies for my late post this week, I spent this week in France with a customer, a large U.S. based manufacturing company who eight months ago acquired a France based manufacturing company in the same market to grow their business in Europe. As a U.S. based company, operating from the U.S. there were many challenges that they faced, information technology is often an area that organizations immediately look to post-acquisition to drive synergies and efficiencies, but when a U.S. based company enters the European market this can be significantly more complex. The reason I mention this is because the legislation and cyber law differences between the U.S. and the E.U. can make this complex and pretty challenging. Regulations like GDPR (E.U. General Data Protection Regulation) (Palmer, 2018) is an example of one regulation that the E.U. imposed to protect data privacy. There are plenty of other regulations like PCI, HIPPA, SOX, etc. that all need to be considered in the context of GDPR, this is a real challenge for many organizations.

A side note on why I was late this week, and maybe some travel advice for anyone flying from the New York area (EWR) to Paris (ORY).  As a million mile flyer on United, I more often than not fly United, although I dislike the airline immensely, I was a loyal Continental flyer for a very long time and it’s hard to give up airline status when you travel 100K+ miles a year. My typical process week after week is to work while I travel, well this trip I flew La Compagnie, a small French boutique airline, with two 757s in their fleet flying between Newark (EWR) <-> Paris and Newark (EWR) <-> London, the flights are all business class at a price below United economy fares, seating only 74 passengers, with good service the only downside (for me at least) is no WiFi. Anyway, sorry for the tangent, but just wanted to give some background.

In this weeks Legislation lecture, Ronda R. Henning states that “Legislation, the legal foundations of cyberlaw, lag technology.” (Henning, n.d.) She goes on to say that most legislators are technologically illiterate; that most cyberlaw is derived from legacy mediums (e.g. – print) and this legacy legislation has been applied to cyberlaw. Henning also discusses the topic of authenticity, maintaining chain of custody, and being able to demonstrate through metadata that digital assets have not been tampered with. In the past, we have discussed hashing as a method of creating a digital signature, hashes like MD5, SHA-256, etc. can create a digital signature of a file which can be used to validate data integrity and authenticity. (Simon, 2013)

I think a telling and interesting aspect of cyberlaw and “Legal Obligations” when it comes to the relative measure of obligations, meaning that things like “best effort” and “industry standard” are defined by relative measures of what others are doing within a given industry or discipline.  What this means is there are frameworks for governing how we maintain and audit our security posture, but what we need to do is far more fluid.

Looking at the IBFS (Intergalactic Banking and Financial Services) case study, while fictitious, we can see requirements and challenges which are likely common across the finance and banking industry which is steeped in legacy and highly regulated. We can see the need to balance cost and capability, to increase agility and elasticity via partnerships and outsourcing and to do this while being compliant with regulations which govern the banking and finance industry. As we look at the emergence of game-changing technologies and such as the emergence of blockchain and cryptocurrencies, applying legacy legislation becomes more difficult. While copyright example moved from print media to video content to digital assets, not perfectly but fairly easily, applying legacy financial regulations to technologies like blockchain and cryptocurrencies will not be as easy. I will be interesting to see how regulatory bodies adapt, the idea of legislators being technology illiterate will probably need to change.

Cyberlaw is very complex, we can to some degree understand aspects of cyberlaw such as copyright and regulations, but when we add things like the Patriot Act and the NSA to the mix things get really complex. (Diamond, 2015)

We have discussed security frameworks like NIST, ISO 27001, SABSA and SSAE-16 and I have looked at all these frameworks, which are primarily process driven frameworks. We learned this week that protecting an organization is about best effort, best practices, and industry standards, I use the Center for Internet Security (CIS) (Links to an external site.)Links to an external site. as my guide for industry standards and best practices is the. CIS provides best practices, benchmarks, and toolsets and they do this all in the context of the platform you are securing, Windows, Linux, Hypervisor, etc.

References

CIS Center for Internet Security. (n.d.). Retrieved September 11, 2018, from https://www.cisecurity.org/

Diamond, J. (2015, May 23). Patriot Act debate: Everything you need to know – CNNPolitics. Retrieved September 11, 2018, from https://www.cnn.com/2015/05/22/politics/patriot-act-debate-explainer-nsa/index.html

Henning, R. R. (n.d.). Legislation. Retrieved September 11, 2018, from http://learningmodules.bisk.com/play.aspx?xml=L0Zsb3JpZGFUZWNoTUJBL01HVDUxNTUvQ1lCNTI3NU01VjEvRGF0YS9tb2R1bGUueG1s Florida Institute of Technology

Palmer, D. (2018, May 23). What is GDPR? Everything you need to know about the new general data protection regulations. Retrieved September 11, 2018, from https://www.zdnet.com/article/gdpr-an-executive-guide-to-what-you-need-to-know/

Sherwood, J., Clark, A., & Lynas, D. (2005). Enterprise security architecture: A business-driven approach. Boca Raton: CRC Press.

Simon. (2013, May 29). Verifying File Authenticity via Hashing. Retrieved September 11, 2018, from https://www.anotherwindowsblog.com/2013/05/verifying-file-authenticity-via-hashing.html

Yacine, a very interesting and thought-provoking post. I may be a bit of a conspiracy theorist but I think operating under the premise that Ronda R. Henning touches on this week, in regards to wiretapping or eavesdropping and how living in the digital world alters information intercept. I found it really interesting that Ronda R. Henning pointed out Skype of wireless or VoIP. She points out CDRs (call detail records), what the industry refers to as metadata. I think or metadata as the data that matters, if I have the metadata, I likely have a path to all the data. While the Patriot Act has been reeled in (at least publically) by the Freedom of Information Act, we still see the government looking to take control of communication mediums, most recently the movement to nationalize the 5G network. These are complex issues, the nationalization of anything scares me a little, but on the other hand, I think it would be naive not to consider the complexity of maintaining order in a wireless world where information moves free and frictionless over the airwaves, on the other hand, if it’s on the airwaves it can be intercepted by anyone who can decode it. I reminded of a scene from the movie Heat.

We should pay attention to the fact that the FBI broke the encryption on the iPhone. They politely asked Apple to assist, when Apple said not they figured out how to crack it. The best way to operate is to assume someone is always watching.

References

ACLU v. FBI – FOIA Case for Records Relating to Patriot Act Section 215. (2014, October 6). Retrieved September 16, 2018, from https://www.aclu.org/cases/aclu-v-fbi-foia-case-records-relating-patriot-act-section-215

Henning, R. R. (n.d.). Legal Obligations. Retrieved September 16, 2018, from http://learningmodules.bisk.com/play.aspx?xml=L0Zsb3JpZGFUZWNoTUJBL01HVDUxNTUvQ1lCNTI3NU01VjEvRGF0YS9tb2R1bGUueG1s

Miller, D. (2017, October 03). FBI allowed to keep details of iPhone hacking secret. Retrieved September 16, 2018, from http://www.abc.net.au/news/2017-10-02/fbi-to-keep-details-of-san-bernardino-iphone-hacking-secret/9007400

Vazquez, M., Berlinger, J., & Klein, B. (2018, January 30). FCC chief opposes Trump administration 5G network plan. Retrieved September 16, 2018, from https://www.cnn.com/2018/01/28/politics/trump-nationalize-5g/index.html