×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Book Review: Locked Down: Information Security For Lawyers

samzenpus posted about a year ago | from the read-all-about-it dept.

Books 43

benrothke writes "Had Locked Down: Information Security for Lawyers not been published by the American Bar Association (ABA) and 2 of its 3 authors not been attorneys; one would have thought the book is a reproach against attorneys for their obliviousness towards information security and privacy. In numerous places, the book notes that lawyers are often clueless when it comes to digital security. With that, the book is a long-overdue and valuable information security reference for anyone, not just lawyers." Read below for the rest of Ben's review.Such a title is needed as the legal field has embraced digital technology. Wireless (often insecure) networks are pervasive in corporate offices throughout legal America.

The underlying problem is that while attorneys often know the intricacies of tort law, court proceedings and the like; they are utterly unaware of the information security and privacy risks surrounding the very technologies they are using. In many firms, the lawyers think that someone is protecting their data, but don't understand their requirements around those areas of data protection.

Legal IT systems are a treasure trove of personal data. Many small law firms are extremely attractive to identity thieves gives their systems have significant amount of personal information via social security numbers, credit card information, birth dates, financial information and much more. Small law firms are notorious for weak information security controls and attackers will scan those systems and networks for vulnerabilities.

A pervasive aspect of the book is ABA rule 1.6 regarding the confidentiality of information regarding client-lawyer relationships. The rule requires that a lawyer not reveal information relating to the representation of a client unless the client gives informed consent. The lawyer though can reveal information relating to the representation of a client to the extent the lawyer reasonably believes necessary. The myriad details of 1.6 can be left to the bar association to enforce, suffice to say that a lawyer can find themselves on the wrong side of the law if they are not careful with information security controls.

The authors note that although lawyers are all well aware of rule 1.6, the challenge is how to keep client data secure in the digital age. In a world of paper, things were much easier and cheaper This is why the authors note that so many otherwise competent layers fails so miserably in reference to their duty to maintain the confidentiality of digital client data.

The book quotes an ABA 2011 technology survey in which 21% of large law firms reported that their firm had experiences some sort of security breach, and 15% of all firms reported that they suffered a security breach. It is figures like those which show that attorneys really need to read this book and take the information to heart.

The books 17 chapters are in a readable 150 pages, with an additional 120 pages of appendices. Written in an easily understandable style and non-technical for the technologically challenge lawyer.

When it comes to the security of client data, in chapter 4 the authors write that encryption is a topic that most attorneys don't want to touch with a ten-foot pole. But it has reached a point where attorneys must understand how and when encryption should be used. Just as important, they need to know about key managements, and what good encryption is. The chapter provides a high-level detail on what needs to be done regarding encryption.

Chapter 13 is on secure disposal, is an important topic to everyone, and not just lawyers. Digital media needs to be effectively disposed of; and for many lawyers, they often think that means reformatting a hard drive or simply erasing files. The chapter effectively details the issues and offers numerous valuable hardware and software-based solutions.

Chapter 14 on outsourcing and cloud computing is an area where too many attorneys are oblivious to of the security and privacy risks. For example, the authors advise attorneys against the use of the free Gmail service since the terms of service allow Google to do anything it wants with the data. That opens a Pandora's Box when it comes to securing client data. The authors advise to use premium Google business versions, so attorneys can stay in control of their data with added security and privacy features.

Two omissions in chapters 13 and 14 are that the authors don't reference NAID (National Association for Information Destruction) or the CSA (Cloud Security Alliance (CSA).

Firms that outsource their digital disposal to non-NAID certified firms run the risk of having a glorified recycler do their work. As to NAID, it is an international trade association for companies providing information destruction services. NAIDs mission is to promote the information destruction industry and the standards and ethics of its member companies; while the mission of the CSA is to promote the use of best practices for providing security assurance within cloud computing and to provide education on the uses of cloud computing to help secure all other forms of computing.

The authors include many real-world stories and case law to reinforce their point.

The book closes with a number of appendices on various rules from the FTC, state information protection regulations, the SANS Institute glossary of security terms and more.

For the lawyer looking for an easy to read introduction to nearly everything they need to know about information security and privacy, the book is a great resource.

The book closes with the note that since lawyers have an ethical duty to protect their client's data, they have no choice but to keep themselves as well educated as possible.

For the attorney that wants to ensure their requirements remain current and are looking for an easy to read introduction about information security and privacy Locked Down: Information Security for Lawyers should be considered required reading.

Reviewed by Ben Rothke.

You can purchase Locked Down: Information Security for Lawyers from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

43 comments

Redacting PDFs with black lines over text (4, Funny)

DickBreath (207180) | about a year ago | (#43775823)

How many times have we seen 'redacted' legal documents as a PDF with black bars overlaying the text? (See Groklaw for past examples.)

1. Open the PDF in Acrobat Reader.
2. Select All
3. Copy
4. Switch to text file editor (not Edlin!)
5. Paste
. . . .
6. Profit?

Does this demonstrate a failure in understanding information security?

Re:Redacting PDFs with black lines over text (1)

cusco (717999) | about a year ago | (#43776111)

My mom was a legal secretary for 17 years, with the result that she loathes most lawyers. From her description of the bozos that she worked with over the years most of them think that changing their default password to their pet's name or their brat's birthday is all the security that their laptop will ever need. After all, they only browse the vanilla porn sites on their work laptop, there shouldn't be any malware on those, right?

Re:Redacting PDFs with black lines over text (1)

tlhIngan (30335) | about a year ago | (#43778887)

My mom was a legal secretary for 17 years, with the result that she loathes most lawyers. From her description of the bozos that she worked with over the years most of them think that changing their default password to their pet's name or their brat's birthday is all the security that their laptop will ever need. After all, they only browse the vanilla porn sites on their work laptop, there shouldn't be any malware on those, right?

I find this true of a lot of professionals. They can earn a ton of money, but they also can be extremely cheap. And even worse, their "superior" knowledge in one field makes them believe that they're superior in all other fields - thinking everyone else not in the same field

It applies to all fields - be it IT, medical, legal, educational, etc. It seems just because someone spent a few years learning something specialized, they're suddenly above everyone else.

Hell, you'll see spending on non-field related things to be extremely cheap as well - a lawyer may spend a lot on nice furniture and stuff to show they're good, but their IT and office assistant spending would be very low. Ditto doctors - I've finally seen the people who use the crappiest of the crappy laptops that get sold at Best Buy. Hell, they'll complain about it but not do a single thing about it - or spending a few more bucks and getting something that would frustrate them less.

And yes, it applies to you, the IT worker as well - see how much money you spend on nice clothes rather than the jeans and T-shirt. Or even if you have a suit and tie (or are you the type that says "clothes don't matter"? Well, to a lawyer, IT doesn't matter, either. That includes security.).

It won't be long until this comes and bites someone in the ass. Imagine a lawyer or doctor gets hacked and ends up violating lawyer-client or doctor-patient privilege. Will said information be allowed in a case? What if it was due to poor security? Who's responsible?

IT workers are lucky though - there's no privilege that depends on them keeping secrets that a court respects. Other than maybe getting discredited because of poor dress.

Re:Redacting PDFs with black lines over text (0)

Anonymous Coward | about a year ago | (#43778363)

yes, jackass,
here comes pain in the ass editing it so can actually read it.
woot woot

Wait, what? (3, Funny)

fuzzyfuzzyfungus (1223518) | about a year ago | (#43775875)

I always carefully add:

"Confidentiality: The information contained in this e-mail is intended only for the
personal and confidential use of the designated recipients of the email. This message
may be an attorney-client communication and, as such, is privileged and confidential. If
you are not an intended recipient of this message or an agent responsible for delivering
it to an intended recipient, you are hereby notified that you have received this message
in error, and that any review, dissemination, distribution, or copying of this message is
strictly prohibited. If you have received this message in error, please delete it and all
copies and notify us immediately by reply e-mail or by telephone"

To the signature section of all my emails. Surely that qualifies as due-diligence concerning information security?

Re:Wait, what? (1)

TheBestMerlinEver (2927797) | about a year ago | (#43775947)

Those disclaimers are worthless!

Re:Wait, what? (4, Insightful)

fuzzyfuzzyfungus (1223518) | about a year ago | (#43775973)

Those disclaimers are worthless!

Oh, hardly. I find that they are an excellent heuristic for identifying people who are likely to be rather irritating in person, and quite possibly in whatever email resides above that vapid regurgitation... They really do a fine public service that way.

Re:Wait, what? (2)

i.r.id10t (595143) | about a year ago | (#43776001)

Unless your employer is automagically adding it to each outgoing email...

Re:Wait, what? (0)

Anonymous Coward | about a year ago | (#43776093)

In all fairness, I find the type of people willing to work for such an employer are more often than not annoying in person...

It doesn't mean all are...but in terms of raw probability...

Re:Wait, what? (1)

i.r.id10t (595143) | about a year ago | (#43793401)

Please don't paint us all with such a large brush. We've just had a similar disclaimer automagically added to our emails (only one per mail, so replies, etc. don't have multiple copies on them), but according to our college's lawyer, it is state mandated.....

Re:Wait, what? (2)

Doug Otto (2821601) | about a year ago | (#43776013)

In all fairness, those disclaimers are almost never IT's idea. In every company I've worked, the idea came down from above; i.e. some executive read about it in an airline magazine.

In those cases, you just roll your eyes, add the signature and collect your paycheck.

Re:Wait, what? (0)

Anonymous Coward | about a year ago | (#43776039)

Such disclaimers have no legal force but they are not worthless.

Most people are idiots. They see the law as incomprehensible bad juju. If such an idiot receives a mis-sent email the warning may prompt them to delete it rather than publish it. And thus the disclaimer has some worth.

However, to use such a disclaimer implies that you view people as idiots. Even if true, advertising this opinion is impolitic.

Not worthless (1)

Etherwalk (681268) | about a year ago | (#43776831)

Those disclaimers are worthless!

No, they're just mostly worthless. Attorneys in some states have ethical duties to delete confidential material they receive by accident, or to notify the sender, or to take other actions. The disclaimers can be useful if (1) they are in a state where their obligation to destroy received material only accrues when they are told to do so, or (2) to show a judge that they didn't do what they were bound to do and they knew they should have, because (a) not only is it in the state ethics rules but (b) it actually TELLS THEM to destroy it.

For example.

Re:Wait, what? (1)

jeffmeden (135043) | about a year ago | (#43775963)

I always carefully add:

"Confidentiality: The information contained in this e-mail is intended only for the
personal and confidential use of the designated recipients of the email. This message
may be an attorney-client communication and, as such, is privileged and confidential. If
you are not an intended recipient of this message or an agent responsible for delivering
it to an intended recipient, you are hereby notified that you have received this message
in error, and that any review, dissemination, distribution, or copying of this message is
strictly prohibited. If you have received this message in error, please delete it and all
copies and notify us immediately by reply e-mail or by telephone"

To the signature section of all my emails. Surely that qualifies as due-diligence concerning information security?

Sounds iron clad, you can just lock up everyone who calls/emails as they have obviously already broken your rule... [/snark]

Re:Wait, what? (1)

schneidafunk (795759) | about a year ago | (#43775985)

So after I spent time reading your confidential email to a client, I see in your signature that it was a mistake and you would like me to call you on the phone?

Re:Wait, what? (1)

intermodal (534361) | about a year ago | (#43776007)

I always carefully add:

"Confidentiality: The information contained in this e-mail is intended only for the
personal and confidential use of the designated recipients of the email. This message
may be an attorney-client communication and, as such, is privileged and confidential. If
you are not an intended recipient of this message or an agent responsible for delivering
it to an intended recipient, you are hereby notified that you have received this message
in error, and that any review, dissemination, distribution, or copying of this message is
strictly prohibited. If you have received this message in error, please delete it and all
copies and notify us immediately by reply e-mail or by telephone"

To the signature section of all my emails. Surely that qualifies as due-diligence concerning information security?

In plain English, that means "My password is weak and my inbox and outbox contain a lot of names, addresses, and social security numbers."

Re:Wait, what? (0)

Anonymous Coward | about a year ago | (#43776253)

You forgot to add:
"This telecast is intended to be used by our audience for entertainment purposes. Any rebroadcast without the express written consent of the National Football League is prohibited."

Re:Wait, what? (1)

Synerg1y (2169962) | about a year ago | (#43776491)

Using PGP is due diligence, adding meaningless messages... well scares the morons, which is good enough I guess. At least it's not a read receipt...

Why is this a surprise? (1)

shankarunni (1002529) | about a year ago | (#43775967)

I'll surmise that from a lawyer's point of view, information security is just another "feature" or "service" to take for granted (just like electricity or water). If any confidential information is lost, it is the _client_ who's injured, and hey, the lawyer will be happy to help the client sue whoever for absurd sums of money (for a small consideration, of course..).

Re:Why is this a surprise? (1)

MozeeToby (1163751) | about a year ago | (#43776067)

I'll surmise that from a lawyer's point of view, information security is just another "feature" or "service" to take for granted (just like electricity or water).

To be fair, why should the necessarily be wrong? I'm not talking about phishing or viruses or key loggers; I'm talking about whole disk encryption, network security, end to end messaging encryption. These things should be commodities by now, there's no reason every PC sold shouldn't have full disk encryption. There's no reason any business grade networking gear should work without encryption. It should be standard. It's really hard to get security perfect, but somewhere along the line the industry forgot that they can get as close to perfect as possible with relatively little effort.

Re:Why is this a surprise? (0)

Anonymous Coward | about a year ago | (#43776291)

It's all about support. Secure systems are hard to use, and most people don't need them. So why create extra support headaches for the sake of the few?

Re:Why is this a surprise? (0)

Anonymous Coward | about a year ago | (#43776383)

there's no reason every PC sold shouldn't have full disk encryption.

Most people don't need it, and it's easy to lose your data.

Amazon Review (1) NOT GOOD (5, Informative)

MrMagooAZ (595319) | about a year ago | (#43775971)

I post this having not read a single page of this book. I was interested in getting this book for my attorney wife. When looking at it on AMAZON.COM, I noticed that the post here is a copy of only ONE of TWO reviews the book has on Amazon.com. The other review is HORRIBLE. http://www.amazon.com/Locked-Down-Information-Security-Lawyers/product-reviews/1614383642/ref=cm_cr_dp_qt_hist_one?ie=UTF8&filterBy=addOneStar&showViewpoints=0 [amazon.com] Read/order with caution.

Re:Amazon Review (1) NOT GOOD (0)

Anonymous Coward | about a year ago | (#43776309)

I read the other review, and in the comment section, Ben Rothke jumps in and addresses the other reviewer's criticisms one by one. If Mr. Rothke has some connection with the book, shouldn't it be disclosed in the Slashdot review?

Also a Violation of the /. Book Review Guidelines (3)

eldavojohn (898314) | about a year ago | (#43776361)

I post this having not read a single page of this book. I was interested in getting this book for my attorney wife. When looking at it on AMAZON.COM, I noticed that the post here is a copy of only ONE of TWO reviews the book has on Amazon.com. The other review is HORRIBLE. http://www.amazon.com/Locked-Down-Information-Security-Lawyers/product-reviews/1614383642/ref=cm_cr_dp_qt_hist_one?ie=UTF8&filterBy=addOneStar&showViewpoints=0 [amazon.com] Read/order with caution.

As someone who occasionally writes reviews for Slashdot (and usually reads all of the ones posted), this is a clear violation of the book review guidelines [slashdot.org] :

First, an important one: by submitting your review to Slashdot, you represent that the review is your own work, that it is original to Slashdot, and that it is unencumbered by any existing or anticipated contractual relationship; further, you are granting Slashdot permission to publish your review, including any editing the Slashdot editorial team finds necessary and appropriate. (Major edits will involve consultation by email or other means.) If you've reviewed the book elsewhere anywhere besides a personal home page (for instance, on Amazon) please be sure that your review for Slashdot is substantially different.

(emphasis mine) There is no difference that I can see ...

I Guess This Is Allowed Now? (3, Informative)

eldavojohn (898314) | about a year ago | (#43776433)

Sorry to respond to my own comment but for Ben Rothke it looks like he just reposts his Amazon reviews here:

Book Review: The Plateau Effect: Getting From Stuck To Success [slashdot.org] is identical to this Amazon review [amazon.com] .

Book Review: The Death of the Internet [slashdot.org] is identical to this Amazon review [amazon.com] .

Book Review: Everyday Cryptography [slashdot.org] is identical to this Amazon review [amazon.com] .

Book Review: Liars and Outliers [slashdot.org] is identical to this Amazon Review [amazon.com] .

It just keeps going ...

Re:I Guess This Is Allowed Now? (0)

Anonymous Coward | about a year ago | (#43778115)

It just keeps going ...

On one of those Slashdot reviews, I remember Ben plugged his book on computer security [amazon.com] (it was $6 at the time) so like a fool I figured, hey, you can't go too wrong with $6, right? Wrong. It was the single WORST purchase I've EVER made at amazon.com, and I give them close to a thousand each and every year. Ben's book was a like a long CNET article full of tips like "don't choose a password that hackers can guess, like 123456". In the trash it went inside of two minutes.

I plain don't trust the guy, he fooled me once and took my money. Go away Ben!

Re:I Guess This Is Allowed Now? (0)

Anonymous Coward | about a year ago | (#43794161)

You were fooled by paying $6 for a book that itself says it is a basic intro?

I do not get how you were ‘fooled’please explain.

Paid Reviewer Alert (4, Insightful)

guttentag (313541) | about a year ago | (#43776437)

The reviewer's Web site [rothke.com] and LinkedIn profile [linkedin.com] both state "I review and recommend books on digital security, privacy and other relevant issues and write a monthly book review on topics of information security and privacy for Security Management magazine and Slashdot."

The reviewer reviews IT books on Amazon like clockwork [amazon.com] , almost always 7 or 8 days between reviews, which are always positive, written like marketing material and always give 4 or 5 stars:
May 20, 2013 Locked Down: Information Security for Lawyers [amazon.com] 5 Stars
May 13, 2013 The Plateau Effect: Getting from Stuck to Success [amazon.com] 4 Stars
May 7, 2013 Secure Coding in C and C++ (2nd Edition) (SEI Series in Software Engineering) [amazon.com] 5 Stars
May 1, 2013 Cybersecurity: Public Sector Threats and Responses (Public Administration and Public Policy) [amazon.com] 4 Stars
April 22, 2013 Applied Information Security: A Hands-on Approach [amazon.com] 4 Stars
April 15, 2013 The Death of the Internet [amazon.com] 5 Stars
April 8, 2013 Applied Cyber Security and the Smart Grid: Implementing Security Controls into the Modern Power Infrastructure [amazon.com] 4 Stars
March 28, 2013 Introduction to Computer Networks and Cybersecurity [amazon.com] 4 Stars
March 20, 2013 Managing Risk and Information Security: Protect to Enable [amazon.com] 4 Stars
(362 Reviews total)

There's a theme in his reviews of either saying that the book is a must-read for _____, or suggesting that the only people who won't get a lot out of the book are people who don't understand how much they need it: "For the reader who may be indifferent to their need for change, the book may not be of full value to then." And "The only negative thing about the book is the over the top title, which I think detracts from the important message that is pervasive in it."

Re:Paid Reviewer Alert (1)

guttentag (313541) | about a year ago | (#43776569)

And if you look at benrothke's page on slashdot [slashdot.org] , you'll notice that he only has one comment and many submitted book reviews. His one comment [slashdot.org] :

Thank you for the comments. In my haste to get this review out, I was not as diligent in proofreading as I should have. With that, you are correct that information is their enemy. I hope my grammatical errors in the review don’t get in the way of Mr. Wrights important message. Thanks again.

That sounds like an apology to the author for making mistakes in the review, and he bends over backwards to call the author Mr. Wright and his book an "important message." Why was he in such a hurry to get the review out? Did the publisher give him a deadline?

He's definitely copying and pasting reviews written elsewhere. Check this submission [slashdot.org] out from January 27th:

"Untitled documentol{margin:0;padding:0}.c5{max-width:468pt;background-color:#ffffff;padding:72pt 72pt 72pt 72pt}.c0{color:#1155cc;font-size:12pt;text-decoration:underline}.c3{color:inherit;text-decoration:inherit}.c2{text-align:justify;direction:ltr}.c4{height:11pt;direction:ltr}.c1{font-size:12pt}.c7{font-style:italic}.c8{height:11pt}.c6{direction:ltr}.title{padding-top:24pt;line-height:1.15;text-align:left;color:#000000;font-size:36pt;font-family:"Arial";font-weight:bold;padding-bottom:6pt}.subtitle{padding-top:18pt;line-height:1.15;text-align:left;color:#666666;font-style:italic;font-size:24pt;font-family:"Georgia";padding-bottom:4pt}li{color:#000000;font-size:11pt;font-family:"Arial"}p{color:#000000;font-size:11pt;margin:0;font-family:"Arial"}h1{padding-top:24pt;line-height:1.15;text-align:left;color:#000000;font-size:18pt;font-family:"Arial";font-weight:bold;padding-bottom:6pt}h2{padding-top:18pt;line-height:1.15;text-align:left;color:#000000;font-size:14pt;font-family:"Arial";font-weight:bold;padding-bottom:4pt}h3{padding-top:14pt;line-height:1.15;text-align:left;color:#666666;font-size:12pt;font-family:"Arial";font-weight:bold;padding-bottom:4pt}h4{padding-top:12pt;line-height:1.15;text-align:left;color:#666666;font-style:italic;font-size:11pt;font-family:"Arial";padding-bottom:2pt}h5{padding-top:11pt;line-height:1.15;text-align:left;color:#666666;font-size:10pt;font-family:"Arial";font-weight:bold;padding-bottom:2pt}h6{padding-top:10pt;line-height:1.15;text-align:left;color:#666666;font-style:italic;font-size:10pt;font-family:"Arial";padding-bottom:2pt}

In its first week, Going Clear: Scientology, Hollywood, and the Prison of Beliefwas #3 on the New York Times Best Sellers list and will likely be #1 soon. The fact that the book is in print is somewhat miraculous given the voracious appetite Scientology has for litigation.

And this [slashdot.org] from January 21:

"Untitled documentol{margin:0;padding:0}.c6{max-width:468pt;background-color:#ffffff;padding:72pt 72pt 72pt 72pt}.c0{text-align:justify;direction:ltr}.c4{color:#1155cc;text-decoration:underline}.c3{color:inherit;text-decoration:inherit}.c1{font-size:12pt}.c7{font-style:italic}.c5{height:11pt}.c2{direction:ltr}.title{padding-top:24pt;line-height:1.15;text-align:left;color:#000000;font-size:36pt;font-family:"Arial";font-weight:bold;padding-bottom:6pt}.subtitle{padding-top:18pt;line-height:1.15;text-align:left;color:#666666;font-style:italic;font-size:24pt;font-family:"Georgia";padding-bottom:4pt}li{color:#000000;font-size:11pt;font-family:"Arial"}p{color:#000000;font-size:11pt;margin:0;font-family:"Arial"}h1{padding-top:24pt;line-height:1.15;text-align:left;color:#000000;font-size:18pt;font-family:"Arial";font-weight:bold;padding-bottom:6pt}h2{padding-top:18pt;line-height:1.15;text-align:left;color:#000000;font-size:14pt;font-family:"Arial";font-weight:bold;padding-bottom:4pt}h3{padding-top:14pt;line-height:1.15;text-align:left;color:#666666;font-size:12pt;font-family:"Arial";font-weight:bold;padding-bottom:4pt}h4{padding-top:12pt;line-height:1.15;text-align:left;color:#666666;font-style:italic;font-size:11pt;font-family:"Arial";padding-bottom:2pt}h5{padding-top:11pt;line-height:1.15;text-align:left;color:#666666;font-size:10pt;font-family:"Arial";font-weight:bold;padding-bottom:2pt}h6{padding-top:10pt;line-height:1.15;text-align:left;color:#666666;font-style:italic;font-size:10pt;font-family:"Arial";padding-bottom:2pt}

In the 4th edition of A Gift of Fire: Social, Legal, and Ethical Issues for Computing Technology, author Sara Baase takes a broad look at the social, legal and ethical issues around technology and their implications. Baase notes that her primary goal in writing the book is for computer professionals to understand the implications of what they create and how it fits into society. The book is an interesting analysis of a broad set of topics. Combined with Baase's superb writing skills, the book is both an excellent reference and a fascinating read.

Same CSS junk at the beginning of several reviews before that. This guy needs to be blacklisted.

Re:Paid Reviewer Alert (0)

Anonymous Coward | about a year ago | (#43782753)

So he writes reviews on slashdot then posts his content on book review sites.sounds like fair use to me.

We need better lawyers and better laws. (1)

SniperJoe (1984152) | about a year ago | (#43776539)

I attended an information security conference last year that had a prominent attorney speaking regarding information security. His biggest message to all of us was that he wanted to see more information security professionals consider becoming attorneys, as there was a serious shortage in experts in both security and the law. He said that his major issue is that there is a lot of bad law and bad precedent out there and he would like to see that change. I suppose this book is just a case in point of that argument. If there is a systemic issue of attorneys not being security-aware and not protecting their data and the data of their clients, how can we expect them to be able to argue before the courts and help create proper, forward-looking precedents?

Re:We need better lawyers and better laws. (1)

TheBestMerlinEver (2927797) | about a year ago | (#43776583)

Good point. How many lawyers are also CISSP's? I would guess less than 1,000. How many lawyers have a cert from SANS? I would guess less than 10

Re:We need better lawyers and better laws. (0)

Anonymous Coward | about a year ago | (#43780255)

This is totally irrelevant to the wider conversation... but I'm an attorney, and passed my CISSP exam yesterday!

Re:We need better lawyers and better laws. (1)

Etherwalk (681268) | about a year ago | (#43776857)

If there is a systemic issue of attorneys not being security-aware and not protecting their data and the data of their clients, how can we expect them to be able to argue before the courts and help create proper, forward-looking precedents?

Many will not. Good attorneys, however, learn a great deal about a topic before they argue it, and that (ideally) includes both reviewing basic reference material and discussions with an expert or two.

Wish they'd do one for doctors (1)

skegg (666571) | about a year ago | (#43776943)

My, how I've become irate over the years with medical practitioners having such lax (nay, absent) IT security policies.

I'm sick of doctors installing random software off the internet.
I'm sick of doctors connecting their computers directly to the internet, with nothing but Windows as protection.
I'm sick of doctors throwing unencrypted DVD back-up's in their trash.

The list goes on ...

It's kind of a hopeless propostion (1)

gelfling (6534) | about a year ago | (#43777533)

We have to include scads of attorneys in every security incident. They grab 90% of the oxygen in the room, rattle off endless questions and NEVER EVER bring anything to the table. All they ever do is demand draft communications documents for the customer and then relentlessly and obsessively red line everything including the few fragments they themselves offered. After about 9 or 10 iterations of this the lawyers play the passive aggressive game and mumble "do whatever you want!".

Don't you love it when the 3 people leading your meeting are lawyers who, when you ask them for anything, the first thing they say is "Well I'm not technical so I can't say." BUT YOU JUST DID SAY, YOU FUCKING SHITHEAD. IN FACT ALL ANYONE HAS DONE FOR THE PAST 90 MINUTES IS LISTEN TO MICROMANAGE.

Die die die die cut all their heads off on Youtube every last one.

Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...