CISSP Study Guide – Understanding information security laws, ethics and regulations

For IT security professionals, technical expertise alone is not enough. Today’s security landscape demands a deep understanding of the legal, ethical, and regulatory frameworks that govern information systems. Beyond preventing attacks and securing networks, CISSP-certified professionals must also be capable of assisting organizations in legal matters, ensuring compliance, and handling incidents in a forensically sound manner.

This article provides a comprehensive guide for IT professionals studying for CISSP, detailing information security laws, ethics, cybercrime, attacker profiles, and incident investigation techniques.

Professional Ethics: The Foundation of Trust

Ethics in information security go beyond legal obligations—they form the bedrock of professional credibility. Security practitioners are expected to act responsibly toward:

• Employers
• Clients and constituents
• The information security profession as a whole

The (ISC)² Code of Professional Ethics, which CISSP candidates agree to uphold, sets standards for ethical behavior:

• Act honestly, responsibly, and in a manner that protects society
• Maintain and improve your professional competence
• Avoid conflicts of interest and protect the privacy of others
• Support adherence to security policies within organizations

Real-world insight: Ethical lapses, such as unauthorized access “just to test skills,” can result in criminal charges even if no harm is intended. Security professionals must set a high standard, modeling behavior for the entire IT team.

Cyberlaw and Computer Crimes

Cyberlaw is still evolving, and its rapid advancement challenges law enforcement. Jurisdictional complexities arise when attacks traverse multiple regions or countries. For instance, a hacker in one state launching a phishing attack against a company in another may involve federal, state, and even international law.

Types of Computer Crimes

Computer crimes generally fall into three broad categories:

1. Unauthorized access and data theft: Accessing systems without permission, stealing financial or personal information
2. Fraud and financial crimes: Using computers to commit fraud, embezzlement, or identity theft
3. Malicious disruption: Deploying malware, ransomware, or denial-of-service attacks

Examples:

• Data diddling: Altering data surreptitiously
• Salami attacks: Making small, repeated changes to avoid detection
• Password sniffing, IP spoofing, wiretapping

Security professionals must understand these crimes, how to identify them, and the applicable laws to prosecute offenders effectively.

Key Legislation

• Computer Fraud and Abuse Act (CFAA): Makes unauthorized access, fraud, and damage to federal or financial systems a crime
• National Information Infrastructure Protection Act (1996): Extends CFAA protections to critical national infrastructure
• Federal Information Security Modernization Act (FISMA): Requires federal agencies and contractors to implement structured information security programs
• Privacy Laws: HIPAA, GLBA, FERPA, COPPA, GDPR – governing sensitive personal data

Tip from practice: Knowing which laws apply to your environment is essential for drafting policies, handling incidents, and conducting investigations without violating rights or regulations.

Motives and Profiles of Attackers

While technology evolves, attacker motives remain consistent:

• Financial gain: Theft of funds, credit card data, or intellectual property
• Espionage: Corporate or government secrets
• Disruption: Activist hackers or competitors attempting sabotage

Attackers can range from script kiddies (amateurs experimenting) to organized cybercrime groups. Techniques may include:

• Exploiting software vulnerabilities
• Social engineering to manipulate employees
• Dumpster diving for sensitive information

Insight: Even seemingly harmless attacks, like curiosity-driven access attempts, should be treated seriously in corporate environments. Proper documentation and handling can prevent escalation into more serious breaches.

Incident Handling and Investigation Techniques

Effective incident handling requires forensic precision. Mishandling evidence can jeopardize legal proceedings and corporate accountability.

Basic Investigation Principles

• Preserve evidence: Avoid altering systems; document the environment
• Chain of custody: Label and secure evidence properly
• Use forensics tools: Disk imaging, tamper-proof containers, and secure storage
• Engage specialists: Consult forensic experts for complex incidents

Real-world example: When investigating ransomware attacks, imaging infected machines before restoration ensures that potential evidence is preserved for law enforcement.

Handling Evidence

Evidence can be categorized as:

• Best evidence: Original documents, source code, or logs
• Hearsay evidence: Testimonies or secondary reports, less reliable

Security professionals must understand limits on surveillance, including legal distinctions between:

• Enticement (legal) vs entrapment (illegal)
• Interviewing vs interrogating victims or witnesses

Categories of Laws Relevant to CISSP

1. Criminal Law: Enforced by police; penalties include fines, imprisonment, or community service
2. Civil Law: Governs disputes such as contracts or employment; enforced via courts
3. Administrative Law: Governs agencies enforcing criminal and civil statutes; codified in the Code of Federal Regulations (CFR)

Intellectual Property (IP)

Security professionals must protect intangible assets like:

• Copyrights: Automatic protection for original works, including software source code
• Trademarks: Protect brand names, logos, and slogans
• Patents: Protect inventions for 20 years
• Trade secrets: Sensitive business information, enforced via NDAs

Tip: Organizations should classify IP assets to ensure appropriate security measures and prevent inadvertent disclosure.

Import/Export Controls

• ITAR: Controls military or defense-related items
• EAR: Covers items with potential military applications, including some software
• Exceptions exist for certain countries, e.g., Cuba, Iran, North Korea

Privacy Regulations

Key regulations include:

• US: HIPAA, HITECH, GLBA, FERPA, COPPA, USA PATRIOT Act
• EU: GDPR, with breach notifications within 24 hours and the right to be forgotten

Practice insight: CISSP professionals must ensure that internal policies reflect the most stringent applicable laws, particularly when handling international data.

Licensing Considerations

Software and service licensing are critical to compliance:

• Contractual licenses: Formal agreements
• Shrink-wrap and click-through licenses: Consent via usage or online agreement
• Cloud service agreements: Often complex; IT teams must review terms carefully

Tip from experience: Failing to comply with licensing agreements can result in civil litigation or fines, so enforce audit controls and maintain documentation.

Real-World Study Recommendations

For CISSP aspirants:

• Focus on laws, regulations, and ethics as they apply to your environment
• Study incident handling case studies for practical application
• Understand IP protection, privacy, and compliance requirements
• Practice applying ethical decision-making scenarios

Pro advice: Combine textbook knowledge with hands-on simulations, such as conducting mock investigations, to reinforce concepts and improve exam readiness.

Conclusion

Mastering information security laws, ethics, and regulations is a cornerstone of CISSP certification. Security professionals are not only defenders of technology but also guardians of legal and ethical standards.

By understanding:

• Professional ethics and conduct
• Cybercrime laws and applicable regulations
• Privacy, IP, and compliance frameworks
• Incident investigation procedures

…IT professionals can protect organizational assets, ensure regulatory compliance, and confidently handle legal responsibilities.

Key takeaway: Ethical behavior, legal knowledge, and forensic competence together define a true CISSP professional, capable of navigating both technical and legal challenges in today’s complex cyber landscape.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.