Chapter 9 — Law and security | Bachelor's Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Law and security

Lesson map

Lesson 09 published. Map, example, EX025.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Why law matters"]
  N2["9.2 Personal data"]
  N3["9.3 Unauthorised access"]
  N4["9.4 Contracts"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX025"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Why law matters"]
  N2["9.2 Personal data"]
  N3["9.3 Unauthorised access"]
  N4["9.4 Contracts"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX025"]

[Learning outcomes]
    |
    v
[9.1 Why law matters]
    |
    v
[9.2 Personal data]
    |
    v
[9.3 Unauthorised access]
    |
    v
[9.4 Contracts]
    |
    v
[Worked example] --> [Exercise EX025]

Learning outcomes

You will (1) identify laws relevant to information security; (2) explain obligations to protect personal data; (3) recognise legal limits on security activities.

9.1 Why law matters

Aisha learns that laws shape information security in several ways. Data protection law requires organisations to protect personal data with appropriate security. Financial regulators expect institutions such as credit unions to manage operational risks, including cyber risks. Computer misuse laws make unauthorised access a crime. Dr. Carrow explains that the specific laws depend on the country, so the course teaches principles and asks students to check the law that applies where they work. Aisha makes a table listing each type of law and the Ashfield activity it affects.

9.2 Personal data

Ashfield holds personal data about members and staff. Data protection laws in many countries require security appropriate to the risk, limits on how long data are kept and notification of certain breaches to regulators and affected people. Aisha notes that these obligations make security a legal duty, not just good practice. She learns that a breach can lead to regulatory penalties and compensation claims, as well as lost trust. She notes that Ashfield's compliance officer is the person who would decide whether a breach must be reported, and that security staff must provide facts quickly.

9.3 Unauthorised access

Computer misuse laws make it a crime to access systems without permission. Aisha learns that this applies to security testing too: testing Ashfield's systems without written authorisation could be illegal, even if intended to help. Dr. Carrow explains that professional testers always work under signed agreements that define scope and timing. Students must never test real systems they do not own or have permission to test. Aisha signs the university's ethical testing agreement, which confirms that course exercises use only laboratory systems and synthetic data provided by the department.

9.4 Contracts

Ashfield's contracts with suppliers include security obligations, such as protecting member data and reporting incidents. Aisha reviews a synthetic contract with the card processor and finds clear incident reporting terms but no right for Ashfield to check the supplier's security. She recommends adding audit rights at renewal. She learns that contracts extend security obligations beyond an organisation's own walls. Ashfield's head of operations agrees and adds the change to the renewal checklist. Aisha also notes that contracts should say how quickly a supplier must report incidents, and finds this one requires notice within twenty-four hours.

Worked example

Aisha identifies data protection, regulatory and misuse laws, links personal data obligations to security, insists on written authorisation for testing and finds a missing audit right in a contract.

Synthetic case. Laws vary by country; the contract is synthetic.

Errors and limits

Testing systems without written authorisation may be a crime.

Exercises

EX025 — Law types. Name one type of law shaping security. Rubric: 3 = data protection law;; 2 = one;; 1 = vague;; 0 = none.
EX026 — Testing rule. What must testers always have? Rubric: 3 = signed authorisation defining scope;; 2 = partly correct;; 1 = vague;; 0 = none.
EX027 — Contract gap. What did the card processor contract lack? Rubric: 3 = audit rights;; 2 = partly correct;; 1 = other;; 0 = none.

Continue studying — lesson 09 (chapter 09 of 40)

← Chapter 08 · Course chapter index · Chapter 10 →

Continue to the next authored lesson.