UCIS 227 - Cyber Law and Ethics

Basic understanding of current cyber security laws and the ethical principles involved. Includes describing and evaluating the impact of various laws and regulations in an industry or business. Also includes the importance of policies, procedures, guidelines, and information classification; risk identification; evaluation and mitigation; and the role of compliance.

Recommendation:

The following recommendation is for the Cybersecurity Marketable Skills Achievement noncredit pathway for which this course is a part of:

To succeed in this 32-week course series, students should have the following prerequisite knowledge and skills:

Familiarity with Operating Systems: Experience using Windows and Linux systems, including file navigation and command-line utilities.
Networking Fundamentals: An understanding of networking concepts such as IP addresses, subnets, firewalls, and protocols like TCP/IP, HTTP, and DNS.
IT Security Awareness: Awareness of cybersecurity principles, including understanding common threats (e.g., phishing, malware) and basic protection strategies.

While prior certifications (e.g., CompTIA IT Fundamentals or CompTIA A+ or Network+) or coursework are not mandatory, they are highly recommended for students lacking direct IT experience. This is not an entry level IT pathway. The program is designed for IT professional upskilling.

Course Learning Outcomes:

Explain the ethical and legal ramifications of accessing, using, and manipulating data in today’s society.
Implement examples of modern compliance in relation to NIST and other applicable standards, laws, and regulations.
Apply ethical and moral behaviors when implementing and using information technology.
Describe the role of cybersecurity in supporting and encouraging ethics, as well as where cybersecurity practices can cause ethical conflicts.

Outline:

Principles of Ethics
- Ethical values in a digital world
- Ethical decision making
- Ethics as applied to the gathering and possession of information
- Ethical vs. unethical hacking
- Professional organizations
Anti-Hacking Laws
- Computer Fraud and Abuse Act
- Origins of the CFAA
- Views of “Exceeds Authorized Access” and “Without Authorization”
- Sections of the CFAA
- Digital Millennium Copyright Act
- Cyberwarfare - The Tallinn Manual
Business Impact
- Policies and procedures
- Information classification
- Technical baselines
- Risk management
- Internal and external training
- Cybersecurity legal standards and requirements applied to businesses and industries
- Tradeoffs and challenges balancing security and business need
Compliance
- Sarbanes – Oxley
- Gramm – Leach – Bliley
- Privacy (COPPA) HIPAA / FERPA
- USA Patriot Act
- Americans with Disabilities Act, Section 508
- Payment Card Industry Data Security Standard (PCI DSS)
- European General Data Protection Regulation (GDPR)
- Other Federal laws and regulations
- State law and regulations
- Practical effects of compliance requirements
State, US, and International Standards/Jurisdictions
- NIST
- ISO
- COBIT
- SABSA
- TOGAF
- ITIL
Data Breach Response Management
- Internal management of data breach
- External management of data breach
- Ethical decisions and ramifications post data breach
- Data breach response plans