O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 26] 26.2 Criminal Prosecution
you might check with your agent to see if it covers damages resulting from law-enforcement agents
during an investigation. Business interruption insurance provisions should also be checked if your
business depends on your computer.
26.2.6 Other Tips
Here is a summary of additional observations about the application of criminal law to deter possible
abuse of your computer. Note that most of these are simply good policy whether or not you anticipate
break-ins.
●
●
●
●
●
●
●
●
●
Replace any welcome message from your login program and /etc/motd file with warnings to
unauthorized users stating that they are not welcome. We know of no legal precedent where a
welcome message has been used as a successful defense for a break-in; however, some legal
authorities have counselled against anything that might suggest a welcome for unwanted visitors.
Put copyright and/or proprietary ownership notices in your source code and data files. Do so at the
top of each and every file. If you express a copyright, consider filing for the registered copyright -
this version can enhance your chances of prosecution and recovery of damages.
Be certain that your users are notified about what they can and cannot do.
If it is consistent with your policy, put all users of your system on notice about what you may
monitor. This includes email, keystrokes, and files. Without such notice, monitoring an intruder or
a user overstepping bounds could itself be a violation of wiretap or privacy laws!
Keep good backups in a safe location. If comparisons against backups are necessary as evidence,
you need to be able to testify as to who had access to the media involved. Having tapes in a public
area probably will prevent them from being used as evidence.
If something happens that you view as suspicious or that may lead to involvement of
law-enforcement personnel, start a diary. Note your observations and actions, and note the times.
Run paper copies of log files or traces and include those in your diary. A written record of events
such as these may prove valuable during the investigation and prosecution. Note the time and
context of each and every contact with law-enforcement agents, too.
Try to define, in writing, the authorization of each employee and user of your system. Include in
the description the items to which each person has legitimate access (and the items that each
person cannot access). Have a mechanism in place so that each person is apprised of this
description and can understand their limits.
Tell your employees explicitly that they must return all materials, including manuals and source
code, when requested or when their employment terminates.
If something has happened that you believe requires law-enforcement investigation, do not allow
your personnel to conduct their own investigation. Doing too much on your own may prevent
some evidence from being used, or may otherwise cloud the investigation. You may also aggravate
law-enforcement personnel with what they might perceive to be outside interference in their
investigation.
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch26_02.htm (7 of 8) [2002-04-12 10:45:05]