Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.

learn more… | top users | synonyms (1)

7
votes
2answers
230 views

Business-to-Business Security Disclosure and Agreement

Looking for a template covering the disclosure information security practices that are standard in Business-to-Business partnerships that share data. For example: Access management Password ...
5
votes
3answers
407 views

What to consider in an SLA to ensure secure software when outsourcing software development?

To ensure secure development in the off shore team what are considerations to be taken into account in the SLA? I got this as a reference: ...
3
votes
1answer
205 views

HITECH : New United States Federal Act on Data Security

Has anyone heard of the new HITECH Federal Act? I understand that it is an underscore of the HIPAA Federal Act but am unclear of the requirements that they are requesting. It targets companies that ...
3
votes
1answer
343 views

What lawful interception standards are used outside Europe?

In Europe European Telecommunications Standards Institute (ETSI) define the standard requirements to handle a lawful interception. It's define all from the terminology and definition to the ...
2
votes
1answer
125 views

Privacy policy about links to other sites

In many of the privacy policies, I noticed there is one section as a disclaimer mainly talking about "our websites contain links to other websites, and it is your own risk/responsibility to familiar ...
4
votes
5answers
484 views

Am I required to hash passwords

Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen? If not required in the US, but required in the ...
19
votes
6answers
10k views

Is Facebook allowed to sell/give your information away to anyone willing to buy it?

Is Facebook allowed to sell information about their users to other companies? For example selling name, address and IP information on a specific geographic location could be very valuable ...
1
vote
1answer
240 views

Can we protect domain name by law? [closed]

Some company have domain names worth a million dollar. But sometime they are lost to hackers. So I wonder how can we protect domains by law instead of technology?
12
votes
3answers
4k views

Should anyone support / implement P3P policies? Do they matter? Are they legally binding?

Google and Facebook authentication both have fake P3P policies in the HTTP headers that link to a webpage that explains why they don't support it: CP="This is not a P3P policy! See ...
4
votes
2answers
241 views

What are the consequences for deceptive practices against stated privacy policy

Disclaimer: I'm aware my question is a bit far from IT security practices but here is the most appropriate place I can think of to post my question within the whole stackexchange. Let's say, many ...
14
votes
5answers
971 views

Is it legal to log passwords from failed logins?

Is it legal to store/log mistyped passwords? How many of you have seen this happen in a log file or DB?
3
votes
3answers
696 views

Why have export controls for cryptography?

I've always heard someone justify the means for export restrictions with "it's for governmental control/spying". In most reasonable countries, the justice system asks people to adhere to the "spirit ...
5
votes
1answer
405 views

How does sound signature recognition work and how to override it?

Today a lot of websites that allow the upload of media content are implementing automatic sound signature checks to prevent the illegal distribution of videos containing copyrighted content. How ...
7
votes
7answers
7k views

Storing credit cards for automatic payments?

I have no experience with storing credit cards and I do not know anything about the legal end of this. The company I work for / develop for wants to store credit cards to process auto payments for ...
2
votes
2answers
303 views

SOHO router intrusion

In the hypothetical scenario where someone has managed to gain unlawful access to a SOHO router (any of the consumer wifi models will serve nicely), what steps can you take to verify this, so as to ...
5
votes
2answers
294 views

What to do in response to a source code and/or database leak by a third party hosting provider?

My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak. On first appearances, the web host ...
18
votes
5answers
93k views

Can someone steal money from my bank account if they know my IBAN and personal details?

To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
25
votes
6answers
13k views

Sharing wifi at a business - Bad Policy?

Is it safe for a small business to let customers use their wifi while waiting? My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
22
votes
6answers
20k views

At what point does “hacking” become illegal? (US)

Hypothetical situation: before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites. Issue: this situation raises a big ...
9
votes
3answers
427 views

How do researchers “gain control of an attacking PC” and not themselves be considered attackers / criminals?

In reference to this Network Computing Report article titled "'Operation Shady Rat' Perpetrated Five Years Of Long-Term Attacks On Government, Enterprises" The Cliff's Notes to the article is thus: ...
18
votes
5answers
933 views

Is there any legal reason to save a cleartext password?

I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen. I asked her about this and she defended the ...
2
votes
5answers
717 views

What happens with a subpoena and a system designed to protect itself from you?

After reading about the recent Dropbox issue I'm starting to wonder if they could legally keep their initial promise. Lets say that you're like Dropbox or Lastpass and you store users' information in ...
7
votes
2answers
2k views

Export laws on the cloud (key size)

Do the U.S. export laws around AES-256 apply to applications hosted in the cloud?
18
votes
2answers
677 views

How to handle security issues of someone else's website

A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
12
votes
5answers
524 views

How can citizens prevent government-led Internet blackouts?

The United Nations now considers Internet access a basic human right. [PDF] Despite the questionable effectiveness of Internet blackouts in silencing a populace and preventing uprisings1, it's ...
15
votes
3answers
734 views

How to secure identity after someone dies?

How would you go about securing the online identity(ies) of someone as best you can after they've died, when they haven't put anything in place ahead of time for this event? Assume we don't know how ...
17
votes
3answers
2k views

Techniques for ensuring verifiability of event log files

Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
30
votes
7answers
4k views

Is it illegal to read an e-mail that was accidentally sent to you?

I'm not sure if this is the right website to ask this but I'm giving it a shot. I got the following message in an email today: (it's translated so sorry for the typo's/mistakes) This e-mail and ...
5
votes
6answers
1k views

What might be the legal and policy consequences of traffic sniffing?

I found a security hole in an organisation in the UK with many employees. Login form sends user name and password in clear text to the public facing IP via HTTP. Initially I pointed this to IT but ...
5
votes
7answers
4k views

Can I reclaim ex employee gmail account?

This is the best place in SE I can find to post this. We have an ex employee who created a gmail account for work purposes that looks like staff_name.company_name@gmail.com He left the company and ...
8
votes
2answers
203 views

How can one easily determine which IT Security related regulations apply?

Joe Tech gets a job managing Acme Startup's IT services. Acme Startup handles information of X, Y, and Z data types, and offers services A, B, and C. Joe Tech is aware that some of these data types ...
21
votes
5answers
3k views

Can ECC be used without infringing on patents?

Can ECC (Elliptic Curve Cryptography) be safely used without infringing on Certicom's patents? I would like to make use of ECC in an embedded system to establish a secure channel. But, I am concerned ...
7
votes
2answers
2k views

Is strong cryptography legal across the internet?

In many countries strong cryptography is outlawed. That means you must store the data of your users in such a way, that government of that country can always decrypt it. And if you don't, you are a ...
48
votes
17answers
3k views

Can we still provide confidentiality when cryptography is outlawed?

In certain jurisdictions, use of cryptography by the private sector is limited: e.g. there are reports that in the UAE and other countries not all of the encryption capabilities of the BlackBerry are ...
3
votes
2answers
282 views

Legal process for suing joejobber?

I'm currently being joejobbed, and want to sue the joejobber. Details: I have real damages: the joejob causes me to receive fake bounces, which: stop/delay my receipt of legitimate mail, since ...
14
votes
4answers
2k views

Is Steganography considered encryption and subject to USA export restrictions?

I have written an application for Apple's iOS which embeds messages in JPEG files using steganography (see http://en.wikipedia.org/wiki/Steganography). For the purposes of this question lets assume ...
7
votes
5answers
2k views

Privacy issues with email providers [closed]

I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
4
votes
4answers
663 views

What particular concerns should one bear in mind when wardriving?

I'm considering starting a neighborhood-wide wardrive, with the objective of raising awareness to the risks of running unsecured wireless networks. Right now, I'm still in the planning stages of this ...
4
votes
2answers
344 views

Issues with the use of network surveillance tool in your company?

What issues will we face with the use of network surveillance tool in the company network with respect to the Telecommunication Interception Act and Privacy Act ? And what policies could be ...
8
votes
4answers
1k views

Copyright issues with encryption algorithms

I'm developing application for Android/Java. Application is a kind of password manager, so I'm storing encrypted passwords under the hood of master password. There are number of encryption algorithms ...
9
votes
2answers
182 views

War dial research

Anyone know of any specific UK Law that would prevent the use of war dialling as part of a security research project?
7
votes
3answers
1k views

What does a court need to successfully prosecute a hacker? Please cite previous cases if possible

Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that: Integrity of the investigation is maintained The ...
3
votes
2answers
167 views

What International laws should one in the InfoSec industry we be aware of?

What InfoSec regulations should one be aware of when dealing with 'live' cross-border communications, or the offline transport of information?
7
votes
5answers
2k views

What security requirements are a defacto standard in the Financial Industry?

What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry? If you're familliar with the Financial Industry, can you share details? For example: What ...
12
votes
7answers
595 views

Is the law the only thing stopping many sites from being hacked/cracked?

There are so many common vulnerabilities out there, so how is it that every Wordpress blog, for example, isn't hacked into often? It seems like the security community is overly paranoid, unless the ...