Legal Structure and the Security Professional: A Practical Guide (263874390)

8/9/2019 Legal Structure and the Security Professional: A Practical Guide (263874390)

http://slidepdf.com/reader/full/legal-structure-and-the-security-professional-a-practical-guide-263874390 1/119

EDUCAUSE Security Professionals Conference 2015

Legal Structure and the SecurityProfessional May 4, 2015

Patrick J. Feehan

irector, !" Policy and#y$ersecurity

#o%&lianceMontgo%ery #ollege

Ste'en J. Mconald

(eneral #ounsel

)hode !sland School of

esign



May 4, 2015Security Professionals

!ntroduction * +genda

1 2 3 4

Legal Syste% Structureand Landsca&e

-orking ith Layers

#ontracts /'er'ie

#lauses "hat Matter

"he )easona$le

Security Professional

"he Pri'acyPolicy

5



Gartner Hype Cycle

Peak of !nated &ectations

"rough of isillusion%ent

Slo&e ofnlighten%ent

Plateau of Producti'ity

Ste'ePatrick

Applied to Attorneys

S!Me&loy%ent




-e are all risk%anagers

-ith i3erent

istories




)o%anLayer

(aius +10 * 1607Le est 8uod

&o&ulus iu$etat8ue

constituit7

7"he la is hatthe &eo&le orderand esta$lish7




9:!;+# ! < 1=5 #o%&uting $egins


http://slidepdf.com/reader/full/legal-structure-and-the-security-professional-a-practical-guide-263874390 7/119May 4, 2015Security Professionals

1=>4

IBMSystem/360


http://slidepdf.com/reader/full/legal-structure-and-the-security-professional-a-practical-guide-263874390 8/119May 4, 2015Security Professionals

7ata Processing7 e&art%ent

id custo% softare de'elo&%ent

Procured and %anaged eotic and e&ensi'e hardare

9sed &unch cards and %agnetic ta&e for 7$atch7

&rocessing:o netorking, or ?ust si%&le lo*s&eed connections

!solated and %ysterious < no one outside of theorgani@ation had a clue a$out hat ent on ithin it

"Phreakers" arrive – precursor tohackers – made free phone calls

1=A5




1=61

IBM C




1=6> < First !CM P# ;irus *Crain

%irst &no'nIBM C (ir)s

-elco%e to the ungeonDcE 1=6-elco%e to the ungeonDcE 1=6> Casit +%?ad D&'tE Ltd.C)+!: #/MP9") S);!#S

A0 :!G+C CL/#H +LL+M+ !IC+L "/-:L+/)*P+H!S"+: P/: 40A=1,44246,26050.Ceare of this ;!)9SK.#ontact us for 'accinationKKKK

NON




1=6> < #o%&uter Fraud and +$use +ct

In*ormationSec)rity+ ,e$al

reco$nition + isBorn

1-.. C!AdisoriesBe$in




C,

#hange !%&acts )isk

Main*rame

HM7

Minicomp)ter

S

ersonalComp)ter

M

,ocal Area7et'or8s

S

Internetand t#e

9e:

9

Mo:ileeices

9;

1-53

1-65

1-<<

1-.3

1--1

200<

ec#nolo$y Adancementissatis*action

Increasin$ =pectations











2011

C,




"hreats (ro &onentially

400 Million totalmal'are + 2014

3-0>000 ne' malicio)pro$rams eery day




"hreats Q ;ulnera$ility Q !%&act R )isk




'en Percei'ed )isk (ros Steadily




)isks Meet at the #ontract

Attorney Sec)rity ro*essional




Legal Syste% Structure and

Landsca&e -orking ithLayers

Stee Mconald> !IS



es, -eTre Layers

• "he &ro$le% ith layer ?okes is that layers donTtthink theyTre funny, andno$ody else thinks theyTre

?okes . . . .

•==O of the layers %ake therest of us look $ad . . . .




La + "aono%y



Federal '. State La

• Federal la La esta$lished $ythe federal go'ern%ent

• Sources –9nited States #onstitution

–#ongress

–Federal court decisions

–)egulations enacted $y eecuti'e$ranch agencies



Federal '. State La

•a%&les –First and Fourth +%end%ents

–Patent and #o&yright Statutes

–#P+ –M#+

–F)P+



Federal '. State La

•

+ 7federal7 syste%, ith 7dual so'ereignty7 –:ational la for national issues

– "he 7la$oratory of the states7 for state issues

•

Pree%&tion Federal la is the 7Su&re%ela of the land7 and tru%&s conicting

state la

–For ea%&le !f state &u$lic records la

re8uires disclosure of records that F)P+

&rotects, then . . .

• F)P+ ins



"y&es DLe'elsE of La

•#onstitutional la –Legal foundation for ho la is

created and inter&reted

–Federal and state constitutions

go'ern the res&ecti'e go'ern%ents

–Federal constitution also go'erns

the relationshi& $eteen the

federal go'ern%ent and the states




• Statutory la –9sually hat e think of hen

e refer to 7las7

–La enacted $y legislati'e$odies < federal, state, or local

–

"ends to $e reacti'e, andso%eti%es hasty




•

#o%%on la – La that has de'elo&ed through court

decisions, so%eti%es o'er centuries

– Slo, deli$erate, incre%ental &rocess

– eference is gi'en to &re'iously decided

cases that esta$lish hat is referred to

as &recedent

– Pri%arily state la

– a%&les contract and tort la




•

+d%inistrati'eVregulatory la – La esta$lished $y ad%inistrati'e agencies

to hich rule%aking authority has $een

delegated, including Dat the federal le'elE

the e&art%ent of ducation, the Federal#o%%unications #o%%ission, and the

Federal "rade #o%%ission

• :et neutrality

– "hrough a rule%aking &rocess, they enact

regulations that go'ern the $eha'ior of

organi@ations o'er hich they ha'e

enforce%ent &oer



"y&es DHindsE of La

•#i'il –La go'erning dis&utes $eteen

to &arties, in hich the 7loser7

%ust %ake the 7inner7 hole, forea%&le through Unancial

co%&ensation

–#i'il la suits are DgenerallyE Uled

$y &ri'ate &arties



"y&es DHindsE of La

•#ri%inal –La go'erning cri%inal acti'ity and

the resulting &unish%ents, such as

Unes and ?ail ti%e, for cri%inalo3enses

–#ri%inal la suits are Uled $y the

go'ern%ent



"y&es DHindsE of La

•#ontract D&ri'ateE la –+n agree%ent $eteen to or

%ore &eo&le that is not created $y

la, $ut that is enforcea$le $y la –+ %eans of regulating &ri'ate

a3airs $eyond hat the la

re8uires, $ut in a ay that ill $e

$acked u& $y la



-hose La is it, +nyayW

•

Pu$lic –Su$?ect to las go'erning

go'ern%ent

–

a%&les #onstitutional la, &u$licrecords statutes, so'ereigni%%unity

•

Pri'ate –First +%end%entW :ot %y &ro$le%

• Coth




S&eaking of La

Juris*diction



-ill of the -!SP

•

Massachusetts Standards for Protection ofPersonal !nfor%ation of )esidents

– 7"he &ro'isions of this regulation a&&ly to all &ersons

Xhere'er locatedY that on or license &ersonal

infor%ation Xin any for%atY a$out a resident of the#o%%onealth.7

– 7/ns or licenses7 R 7recei'es, stores, %aintains,

&rocesses, or otherise has access to &ersonal

infor%ation in connection ith the &ro'ision of goods

or ser'ices or in connection ith e%&loy%ent7

– Must de'elo&, i%&le%ent, and %aintain a

co%&rehensi'e, ritten infor%ation security

&rogra% D-!SPE



+nd the CeatDingE (oes /n – Must designate res&onsi$le oBcial

– Must conduct co%&lete in'entory and risk analysis

– Must i%&le%ent 7ad%inistrati'e, technical, and &hysical

safeguards to ensure the security and conUdentiality7 of

&ersonal infor%ation

– Must include security &olicies for storage, access, and

trans&ortation of &ersonal infor%ation o3*&re%ises

– Must encry&t all &ersonal infor%ation tra'eling across

&u$lic or ireless netorks and on la&to&s or other

&orta$le de'ices

– Must ha'e ongoing e%&loyee training

– Must %onitor co%&liance

–

. . .



#an "hey o "hatWDo ! a'e to o "hatWE

• !t de&ends

• !f #hina ado&ted such a la,

ould e $lindly assu%e e hadto co%&lyW

• "hen hy do e do so ith

res&ect to MassachusettsW

• "o %ore 8uestions . . .



#an "hey nforce "hatW Judicial Jurisdiction

• Su$?ect %atter ?urisdiction – Jurisdiction o'er the case

• "y&e of case

• +%ount in dis&ute

• Personal ?urisdiction – Jurisdiction o'er the &arties

• /riginally a %atter of &uregeogra&hy . . .



Judicial (eogra&hy




!nternet (eogra&hy



+ )eally Cig Shoe

7XYue &rocess re8uires only that in

order to su$?ect a defendant to a

?udg%ent in &ersona%, if he $e not

&resent ithin the territory of the foru%,

he ha'e certain %ini%u% contacts ith

it such that the %aintenance of the suit

does not o3end Ttraditional notions offair &lay and su$stantial ?ustice.T7

< International Shoe Co. v. Washinton



+nd +nother

7-e Und that Sulli'an, as the &roducer and

%aster of cere%onies of T"he d Sulli'an

Sho,T entered +ri@ona $y &roducing the&lay entitled T+ #ase of Li$elT in :e ork

#ity. . . . X"Yhe telecast of the sho . . . in

+ri@ona XasY 'oluntary, &ur&oseful,

reasona$ly foreseea$le and calculated to

ha'e e3ect in +ri@ona . . . .7

< Peler v. Sullivan



#hoice of La and



•

Cack to contracts, here youha'e a choice

– ours '. theirs

–Li%itations on state institutions

–elete it and defer the argu%ent

till later

–Suit %ust $e Uled in !efen!ants

?urisdiction

#hoice of La and Jurisdiction



#an "hey !%&le%ent "hatWLegislati'e Jurisdiction

• 7+ State does not ac8uire &oer or su&er'ision

o'er the internal a3airs of another State %erely

$ecause the elfare and health of its on citi@ens

%ay $e a3ected hen they tra'el to that State.7 <

#ielo$ v. %irinia

• 7X!Yt ould $e i%&ossi$le to &er%it the statutes of

Missouri to o&erate $eyond the ?urisdiction of that

State . . . ithout throing don the constitutional

$arriers $y hich all the States are restricted ithinthe or$its of their laful authority and u&on the

&reser'ation of hich the (o'ern%ent under the

#onstitution de&ends.7 < &e$ 'or( )ife Ins. Co. v.

*ea!



State of Mine

•

Massachusetts has legislati'e ?urisdiction o'er you if Dand only ifWE

– ou are located in Massachusetts

–

ou are organi@ed as a Massachusettscor&oration, e'en if located elsehere

– ou are registered to do $usiness in

Massachusetts as a foreign cor&oration – ou are otherise o&erating in

Massachusetts



#+EA,-




Layers + 9serTs Manual

Stee Mconald> !IS



"he /Bce of :oW



#an -hat is Possi$le

May -hat is Per%issi$le

Must -hat is )e8uired



ou Make the #all

•

"he good nes – "he la gi'es us considera$le discretion

– -e get to %ake a choice

• "he $ad nes – "he la gi'es us considera$le discretion

– -e have to %ake a choice

• :ot %aking a choice is %aking achoice, to acce&t the status 8uo



May -hat is Per%issi$le

Should -hat is +d'isa$le

Must -hat is )e8uired

#an -hat is Possi$le



ecisions, ecisions

• La • )isks

• CeneUts

•#osts

• ;alues

• )elationshi&s

• Pu$lic )elations• Practicalities

• . . .



Finding our !nner Layer



)isky Cusiness

•

)isk is so%ething to $e anae!, notavoi!e! – )isk includes not only the $ad things that

%ight ha&&en if you &roceed, $ut also the

good things that onTt ha&&en if you donTt&roceed

• (ray areas are ?ust as gray fro% theother side, and therefore ?ust as risky for

the other side – -hy cede that hole s&ace to the other sideW

• 7Pigs get fed, $ut hogs get slaughtered7




#ontracts

+ Sur'i'al (uide

di i



edication

7#ould you ?ust take a 8uick look at this

X15*&age, single*s&aced, 6*&oint font,

for%Y contract XthatTs $een on %y desk

for the last three %onths, $ut that !ha'enTt readY and let %e kno hether

itTs /H X$efore the 'endor co%es in 0

%inutes fro% no to &ick it u&YW7< :u%erous clients ho ill for their and %y

&rotection re%ain anony%ous

h i # W



-hat is a #ontractW

•

X+ tra&Y

-h i # W



-hat is a #ontractW

+n agree%ent $eteen to or%ore &eo&le that is enforcea$le$y la



-hat oes it "ake to Make a #ontractW

/3er !Tll doV&ay Q if you doVdonTt do

+cce&tance /H Din any for%E

#onsideration Q and !n other ords, there %ust $e a

$argain Din the sense of an agreed,

%utual echangeE, $ut it need not

$e a 7$argain7 Din the sense of an

e8ual echange or good dealE



-hat Doesnt it "ake to Make a #ontractW

All that atters is

that you have"anifeste! your

utual assent" to thecontract

-hat Should $e in a



-hat Should $e in a#ontractW•

X+n onerTs %anualY

-hat Should $e in a



-hat Should $e in a#ontractW

-ho the &arties -hat the rights and duties of the &arties

-here the &lace of &erfor%ance

-hen the ter%DsE of the contractdeadlines

-hy any rele'ant $ackground

o the %ethod of &erfor%ance

o %uch a%ount and ter%s of &ay%ent

-hat if ter%ination rights and re%edies

+ #ontract is First and Fore%ost



+ #ontract is, First and Fore%ost,a #usiness ocu%ent

7ouT'e got to $e 'ery careful if youdonTt kno here youTre going, $ecauseyou %ight not get there.7 < ogi Cerra

!f you donTt kno and s&ecify hat it isyou ant to recei'e, youTre going to getonly hat the 'endor ants to &ro'ide

ou donTt get hat you deser'e you gethat you negotiate.7 < r. #harles L.Harrass

Everythin Dal%ostE is



e y Da os E s:egotia$le

-h t Sh ld $ i # t tW



-hat Should $e in a #ontractW

"here is no real 7%agic language7 < the key is ?ust

to $e as clear and co%&lete as &ossi$le, to a'oid

%isunderstandings and dis&utes

!f there is a dis&ute, itTs not hat you think the

contract says, itTs hat an outside, o$?ecti'e

o$ser'er Di.e., the courtE thinks the contract says,

usually $y looking only 7ithin the four corners7 of

the contract itself

7Cut itTs organic < e canTt s&ecify details no7

So is co%&ost, hich is a &rocess of deterioration

7-eTre i%&ortant to the%, so theyTll take care of us7

"rust, $ut 'erify

#+EA,-



#+EA,-




#ontract #lauses -hichShould !nterest ou

atric8 %ee#an

S M #l S Littl




1 2 3 4

-arranties

Merger #lause

Lia$ility

"er%ination

Security

5

So Many #lauses, So Little

"i%e

?o) Are #e SM @may:e




?o) Are #e SM @may:e 9#at Are 9e B)yin$

?o) Are #e SM @may:e 9#at




?o) Are #e SM @may:e 9#atAre 9e B)yin$

-arranties



-arranties

1. "his is a large issue in anycontract.

2. -hat is the arranty of the'endorW

. "heir for% ill ty&ically eclude

%ost if not all arranties.

9arranty isclaimer



9arranty isclaimer

isclai%er. ce&t as set forth a$o'e, Patrick %akes noarranties to #usto%er or to any third &arty, hether e&ress,i%&lied, or statutory regarding or relating to the Softare, theocu%entation, any eli'era$le or any %aterials or ser'icesfurnished or &ro'ided to #usto%er under this +gree%ent,

including Maintenance and Su&&ort. A!IC& H!B?ISC,AIMS A,, IM,I 9A!!A7IS %M!CHA7ABI,I?> 77I7%!I7GM7 A7 %I7SS%! A A!IC,A! !S 9IH !SC HS%9A!> CM7AI7> ,I(!AB,S A7 SAIH! MA!IA,S A7 S!(ICS> A7 9IH !SC H S % A7? % H %!GI7G A!IC& S7 9A!!A7 HA !AI7 % H S%9A! IS!!!+%! ! HA IS !AI7 9I,, B7I7!! A7 H!B? ISC,AIMS A,, ,IABI,I?7 ACC7 H!%

-arranties -eak Cut )eal



-arranties < -eak, Cut )eal

7Patrick does not arrant that its Ser'icesare or ill $e error free. Patrick further doesnot arrant that its electronic Ules

containing infor%ation &ertaining to#usto%er andVor #usto%erTs students arenot susce&ti$le to intrusion, attack, orco%&uter 'irus infection, $ut gi'en the

conUdential nature of %uch of this data,Patrick ill use co%%ercially reasona$lee3orts to insure and safeguard the securityof this data.7

-arranties Mini%u% or SL+Ts



-arranties < Mini%u% or SL+ s

#onsulting Ser'ices. #onsulting Ser'ices shall $eco%&leted in a &rofessional, ork%anlike%anner, ith the degree of skill and care that is

re8uired $y sound &rofessional &rocedures and&ractices.

!f a third &arty asserts a clai% against #lient thata Ser'ice ac8uired under this +gree%entinfringes a &atent or co&yright, ':/) ill

defend #lient against that clai% and &aya%ounts Unally aarded $y a court against#lient or included in a settle%ent a&&ro'ed $y;endor.

Merger and !ntegration #lause




Mer$er and Amendments #isA$reement may not in any 'ay :emodiDed> c#an$ed or amended e=cept:y a ritten instru%ent duly eecuted $ythe &arties hereto. "his +gree%ent, heneecuted, and the ehi$its attachedhereto, constitutes the entire, Unal,

co%&lete and eclusi'e agree%ent$eteen the &arties and su&ersedes any&rior negotiations, understanding oragree%ents hether oral or in riting,

concerning the su$?ect %atter, hereof.





!emem:er my !oman ,a'yer#at is #o' old t#is cla)se is

9e mer$e> 'e inte$rate to asomet#in$ o)t t#ere > oral orin 'ritin$> '#ic# ma8es a

diEerent promise

,ia:ility/IndemniDcation



,ia:ility/IndemniDcation

Lia$ility is usually &ro for%a.

our #ollegeTs "er%s and #onditions %aycall for s&eciUc insurance to co'er thetransaction. ou %ay call for s&eciUcinde%nity. Most ;endors ill a'oid &uttinginsurance language in the contract.

Left to its on de'ices the ;endor ill

disclai% lia$ility as %uch as it can orcertainly li%it the lia$ility.



,imitin$ ,ia:ility In t#er 9ords



,imitin$ ,ia:ility In t#er 9ords

"he ;endor is saying

!t does not %atter ho $ad e scre

u&K 'en if e lose +LL of your data and

you are on the front &age of the

-ashington Post.

"he %ost you can reco'er fro% us is

12 %onths of ser'ice fees.

ermination o* t#e A$reement



ermination o* t#e A$reement

Ho' do yo) terminate t#e contract

*ten times yo) 'ill see yo)r o'nColle$eFs erms and Conditions call *or

ermination *or B)d$et !easons oreen ermination at t#e Conenienceo* t#e Colle$e resident

(endors #ate t#ose

?o) need t#e Contract to reect '#atyo)r Colle$e needs

"he Language in our



#ontract• eter%ines the standard of care $eteen

the &arties.

-hat is the standard of



#areW• "he atchfulness, attention, caution and

&rudence that a reasona$le &erson in thecircu%stances ould eercise. !f a&ersonTs actions do not %eet this standard

of care, then hisVher acts fail to %eet theduty of care hich all &eo&le Dsu&&osedlyEha'e toard others. Failure to %eet thestandard is negligence, and any da%ages

resulting therefro% %ay $e clai%ed in alasuit $y the in?ured &arty.

-hat does that %ean for us as !"



-hat does that %ean for us as !"Security ProfessionalsW

• LetTs Look at a #loud #ontract as anea%&le.

+n +ctual #ontract



Paragra&h•

S%ith arrants that DiE S%ith illnot share any records &rocessedand stored $y the #usto%er

ithin S%ithTs syste% to anyother &erson or entity and DiiES%ith ill use co%%ercially

reasona$le e!orts to fulUll itso$ligations under this+gree%ent.

#o%%ercially )easona$le



3orts• "hat sounds reasona$le to %e.

• -hat does it %ean to youW

• -ould this change if ! re%o'e the ordcommercially W

7)easona$le7



)easona$le

• S%ith arrants that DiE S%ith ill not shareany records &rocessed and stored $y the#usto%er ithin S%ithTs syste% to anyother &erson or entity and DiiE S%ith ill

use reasona$le e!orts to fulUll itso$ligations under this +gree%ent.

)easona$le 3orts



)easona$le 3orts

• "hat sounds reasona$le to %e too.


• as the standard of care changed fro%7#o%%ercially )easona$le7W

• -ould the standard of care change ifre%o'e the ord 7reasona$le7 and insertthe ord 7$est7W

7Cest7



Cest

• S%ith arrants that DiE S%ith ill not shareany records &rocessed and stored $y the#usto%er ithin S%ithTs syste% to anyother &erson or entity and DiiE S%ith ill

use $est e!orts to fulUll its o$ligationsunder this +gree%ent.

Best Eorts



Best Eorts

• "hat sounds reasona$le to %e too. !s itthe $estW


• as the standard of care changedW

LetTs )ate -hich !s "he ighest



gStandard

• )easona$le 3orts

• #o%%ercially )easona$le 3orts

• Cest 3orts

• [[[[[[ e3ort Dnothing stated a$out thety&e of e3ortE

• -hich &laces the highest standard of care

on a 'endorW

:et < )easona$le 3ort



:et )easona$le 3ort

• +easona/le %eans using sound ?udg%ent *eercising a sensi$le 'ie. "he test ofreasona$leness is an o$?ecti'e test thatill assess hat other reasona$le &ersons

ould ha'e done in the sa%ecircu%stances.

:et *#o%%ercially$l



)easona$le• +easona/le coercial eorts involve!

a(in a /usiness ?udg%ent and the&articular correctness of the ?udg%ent asnot rele'ant to hether the standard had

$een %et.• 3orts hich use a standard of

reasona$leness deUned $y hat a si%ilar&erson ould do as ?udged $y the

standards of the a&&lica$le $usinessco%%unity.

• !f it is reasona$le to $usiness < it isreasona$le.

:o < /ne ! )ecei'ed Lastk



-eek• S%ith shall &ro'ide eneral syste%

security including general &hysicalsecurity of the hosting location, eneral netork and internal syste%s security and

the &rotection of licenseeTs data, as ell asgeneral &lans for %anaging disasterreco'ery.

• o does 7general7 Ut ith reasona$le,

co%%ercially reasona$le or $est e3ortsW

;ery )ecent a%&le *+d $



+do$e

Fact Pattern < ou +re "he Judge



Fact Pattern ou +re "he Judge

• Patco #onstruction '. /cean Cank.

• ackers stole #F/ of PatcoTs login credentialsand initiated a series of transfers throughoutthe eek starting on May = that totaled o'er566,000. Patco disco'ered the fraud on May1, hen one of its co*oners found a noticefro% /cean Cank in his %ail$o, stating thatse'eral recent transfers had $een re?ected.Patco notiUed the $ank on the %orning ofMay 14. -hile the $ank atte%&ted to rescindthe transfers, Patco as ulti%ately out atleast 45,000 in stolen funds.

-ho !s +t FaultW



-ho !s +t FaultW

• "he Cank clai%ed that Patco $asres&onsi$le for the loss.

• "hey cited a $anking related rule, signed$y Patco, hich stated custo%ers ho

use auto%ated clearinghouse D+#Etransactions on their co%%ercial accounts7assu%e all lia$ility and res&onsi$ility to%onitor those accounts on a daily $asis7

and 7XiYn the e'ent you o$?ect to any +#de$it, you agree to notify us of youro$?ection on the sa%e day the de$itoccurs.7

Patco #lai%ed Cank -as +tF lt



Fault• Patco clai%s that /cean Cank is res&onsi$le

for the loss, arguing that the $ank $reachedits duty to &ro'ide a coercially reasona/lesecurity syste $ecause it only &ro'ided asingle*factor authentication syste% for ire

transfers.

• /cean Cank did not &ro'ide a co%%erciallyreasona$ly secure security syste%, $ecause itelected not to i%&le%ent se'eral &arts of thesecurity softare it &urchased, hich includednotifying #usto%er hen the risk score of atransaction eceeded a certain le'el.

-ho o ou "hink Should-i W



-inW• Factual 8uestions to $e ansered ill

include the etent to hich /cean Cankre&resented and agreed that it ouldi%&le%ent security %easures to &rotect

the funds of custo%ers hether /ceanCank fulUlled its re&resentations and&ro%ises in that regard hether /ceanCank acting res&onsi$ly in light of its

&osition of trust and in light of reasona$leindustry standards and hether /ceanCank should ha'e $een on notice ofi%&ro&er cri%inal conduct $ased on the

facts.

Security Measures Matter



Security Measures Matter

• !n the Patco case, the critical 8uestion,$efore /cean Cank can clai% any safehar$or fro% lia$ility for the fraud da%agesis did /cean Cank o3er a co%%ercially

reasona$le security &rocedure to PatcoW• "he o$?ect lesson of this lasuit is not

necessarily hat the ulti%ate outco%e ill$e $ased on its uni8ue facts. "he real &oint

is that causes of action do eist in the lathat can %ake a third*&arty, like a $ank,&otentially res&onsi$le for har% su3ered$y others at the hands of #y$er cri%inals.

Language Matters



Language Matters

• )ead yours

• o not $e afraid to challenge 'aguelanguage < to ask for s&eciUcs. !f thelanguage calls for reasona$le secuerity

%easures, ask hat that %eans.• Ce +are of the 9&sell

Security is Like + li8uorLi



License• 7Security is like a li8uor license to a

restaurant ** an o&&ortunity to u&*sell eachcusto%er ith a high*&roUt %argin &roductto $alance out the dis%al or loss*leading

%argins of the core &roduct. Security isthe single %ost &roUta$le di3erentiatorthat a ser'ice &ro'ider can add to !aaS toha'e any ho&e of %aking %oney..7 –

*P# -orld, March 20, 2011




"he Pri'acy State%ent <)ead !t

atric8 %ee#an

) ad a Pro$le%



ad a o$ e

• "hey had an e%&loyee ho as s&ending4 hours a %onth doing e%&loyee inco%e'eriUcations.

• "hey had a solution.

•+ ;endor ould take o'er that task for the#ollege.

• +ll it re8uired as 6 hours e'ery othereek of !" &ersonnel ti%e.

"o o "his < ata ad to Ce



"ransferred

• %&loyer #o%&any #ode

• %&loyee :a%e

• SS: 9ser ! P!:

• +s of ate• Most )ecent ire ate

• /riginal ire ate

•

Jo$ "itle• %&loyee Status

• ate of "er%ination Dif a&&lica$leE PayFre8uency




"ransferred

• #urrent Pay )ate

• " gross Case &ay

• " gross /'er*ti%e &ay

• " gross Conus &ay

• " gross #o%%ission &ay

• " gross /ther inco%e

• " gross "otal•




"ransferred

• %&loyee o%e +ddress

• Pay Period nd ate

• ate PaidV#heck ate

• "otal ours orked for &ay &eriod• (ross ages for &ay &eriod

• :et Pay for &ay &eriod

Patrick < they said < o ouhi



+&&ro'e "hisW

• 7:o7, ! said.

• 7)ead their &ri'acy state%ent7

Pri'acy State%ent Said




• 9HM 9 MA? ISC,S HI7%!MAI7 9 C,,C

• -e take reasona$le &recautions to $e sure thatnonaBliated third &arties and aBliates, to ho%

e disclose your &ersonally identiUa$leinfor%ation are aare of our &ri'acy &olicy andill treat the infor%ation in a si%ilarly res&onsi$le%anner. /ur contracts and ritten agree%ents

ith nonaBliated third &arties that recei'einfor%ation fro% us a$out you &rohi$it those&arties fro% transferring the infor%ation otherthan to &ro'ide the ser'ice that you o$tain fro%us.





• A$ents and contractors /ur contractorsso%eti%es ha'e access to your &ersonalinfor%ation in the course of assisting in o&eratingour $usiness and &ro'iding &roducts or ser'ices

to you. "hese contractors include 'endors andsu&&liers that &ro'ide us ith technology,ser'ices, andVor content for the o&eration and%aintenance of our site. So%e of these

relationshi&s %ay $e ith co%&anies that co*$rand &ortions of their site and ser'ices, or that&ro'ide ser'ices to you on our $ehalf. #o*$randedsites %ay ha'e their on &ri'acy &olicies &ostedon their sites

+nd !ronically



+nd !ronicallyK

• %%!S 9 MA& SA%GA! ?!!S7A, I7%!MAI7

• -e are co%%itted to &rotecting the security of yourinfor%ation K$y taking these ste&s

• -e li%it access to your &ersonal infor%ation toe%&loyees ha'ing a reasona$le need to access thisinfor%ation to &ro'ide &roducts and ser'ices to youand to our custo%ers. %&loyees ho %isuse

infor%ation are su$?ect to disci&linary action,including ter%ination.

• -e ha'e reasona$le &hysical, technical and&rocedural safeguards to hel& &rotect your &ersonalinfor%ation.

+nd Finally



+nd FinallyK

Legal Structure and the Security Professional: A Practical Guide (263874390)

Documents

Transcript of Legal Structure and the Security Professional: A Practical Guide (263874390)