Hello.
My name is Lyron Andrews.
Welcome to my course, Legal, Risk, and Compliance for CCSP.
I am a cloud security consultant and author, a small business owner
specializing in cybersecurity training and professional development.
This course accounts for 13% of the weight of the CCSP certification exam.
First, we will connect the legal abstractions that could
impact your cloud consumption model.
Then, we'll look at an assortment of risk frameworks that you
can select from for your cloud consumption,
some specific recommendations for consuming services in the cloud.
Finally,
we'll leave off with assurances that we can have from our CSP that
their controls are aligned with our business needs.
Starting here,
we will take a look at some common legal terms and see how they can still be
applicable across regions and continents around the world.
Then, we will review some implications that there are for data
privacy as we are consuming services in the cloud, and we'll
break down the actual roles that have to do with protecting the
data subject's information.
Let's get into the common legal definitions that we could really
see no matter where you are around the world.
A warrant is issued to law enforcement by a judge on
presentation of appropriate probable cause.
This could enforce the arrest of an individual,
the acquisition of property, or some other authorized court action.
A subpoena could be issued by an attorney with a material interest in a case.
So the subpoena is deemed issued by an officer of the court and must
be obeyed in much the same manner as a warrant.
An extradition will support a formal process whereby one country transfers
a suspected or a convicted criminal to another country,
but the process would include a criminally punishable act
in each country, and the countries must have a treaty, or
an agreement, between them.
And typically, the extent of the punishment may slow the extradition
process for the sending to the receiving country.
The idea of jurisdiction is one that we would
probably feel most often in the cloud.
It's the practical authority that's granted to a legal body to
administer justice within a defined area of responsibility.
So, in most cases, it's referring to a geographic area or a
territory over which a court has authority.
International jurisdiction may be extremely complex and be defined by treaties,
international laws, and other conventions that may arise.
Something that's important to separate is the assumed
difference between laws versus regulations, and a lot of
times that assumption is wrong.
Sometimes people may create differences in their minds or
assumptions where they say one has fines, the other could
include a prison sentence.
One comes from a legislative body, the other comes from some type of authority.
They both can cross over and have aspects of the other.
The main difference is that a law applies to all
citizens of a regime and any visitors.
So if I go into a country,
I will actually be expected to follow the laws of that country if even I am
not a citizen, whereas regulations are typically bound to some specific
industry or some specific practice. In the cloud,
we have to be concerned about legal issues at a local,
at a regional, and at a global level.
Here's a more specific example of each of them.
From a global perspective,
let's examine a few internationally known legal
entities that may have an impact.
The first, from the United Nations, is the International Court of Justice.
This main body of the UN settles legal disputes submitted to it by
states in accordance with international law. It also gives advisory
opinions on legal questions referred to it from authorized UN organs
and specialized agencies.
Interpol is another example where you have a participation in
several projects related to information,
communication, and technology based upon the cooperation of multiple nations.
Their role is to ensure that the needs of law enforcement are
considered and integrated into their solutions and that
Interpol's rules and regulations reflect the technological
changes in global law enforcement.
There is a huge problem when we start thinking about regional
concerns in the cloud because regions will differ in the
requirements for maintaining data.
The prohibition of data distribution because of data sovereignty and
something called geofencing is really bringing up this issue of
harmonization of law. Here is where organizations must be aware of the
precept to follow the law that they are closest to because the law will be
in effect wherever the transaction is taking place.
So harmonization of laws when there is an attempt for countries
that are cooperative to have laws that are commensurate in order
to facilitate business and economics.
Even harmonization of laws strained or lacking, countries may
have basic agreements on what is criminal.
So these MLATs, or mutual legal assistance treaties, could come into play
where two or more countries have the exchange of information to enforce public
or criminal laws such as fighting money laundering.
Then at a legal level, it's important to know the municipal,
the local, township laws where you're doing your primary cloud transactions.
These laws may come in form of ordinances,
commonwealth statues, or general rules of incorporation that we have
to adhere to wherever our physical presence may be based upon the
logical consumption of our cloud service.
There are two primary legal practices that we should consider.
The first one is what's called tort.
A very famous tort case, often maligned, is the elderly woman that
burned herself with coffee from a McDonald's.
The coffee heating policy was that they kept it between 180 to 190 F,
which could cause a third‑degree burn in less than 15 seconds contact with skin.
She suffered this on 16% of her body.
McDonald's had previously injured 700 people. In tort cases, the
defendant must prove they are not liable from the preponderance of
evidence of negligence and damage that's brought by the plaintiff. In
that case, both were not trivial.
The cost to cover her hospital bills was also part of this case.
Typical criminal law states that the accused is considered innocent
until proven guilty beyond a reasonable doubt.
In some areas of the world,
the guilty could be forced to forfeit your possessions
and/or freedom. In other areas of the world, there's a
third thing that's at jeopardy, the forfeiture of an individual's life.
Join me over in the next clip, and we will consider the
jurisdictional differences that can arise with data privacy.