James Strassburg wrote...
For anyone still interested: I posed this question to our corporate
legal team. Their response stated that since we have a corporate
information systems use policy that includes not using the Internet for
inappropriate reasons (there is much more language in the policy of
course), we would have a good argument that we were not negligent by
training developers in this respect. Therefore, he didn't feel a CYA
signed waiver or disclaimer was necessary. They did suggest reaffirming
the relevant parts of the information systems use policy verbally at the
start of the class however.
In this particular case, I'd agree with them, but IMHO (and IANAL), I
think that in the general case there needs to be other considerations
taken into account beyond an "acceptable use policy" or internal
"code of conduct". For instance prior to HIPPA, Sarbanes-Oxley, etc.,
your company might collect millions of customer records with unencrypted
SSNs and CC#s. Let's suppose that you kept those in a Oracle DB and
that the user id / password to access these records was widely known
not just to IT people but throughout the company. If you have a rogue,
disgruntled employee grab a few million SSNs and CC#s and sell them, I'm
not so sure that your company wouldn't be liable in class-action lawsuits
because you did not practice "due diligence" and/or best security practices.
(And even if you weren't liable, the resulting bad publicity could give your
company a black eye from which they might never recover. There is more to
risk management than just legal issues.)
However, I agree that in this particular case, CYA is not really needed--
mostly for all the reasons stated in recent threads on this topic.
(Wow; imagine that. A legal team that is not anal-retentive. I never
thought that possible. ;-)
-kevin
---
Kevin W. Wall Qwest Information Technology, Inc.
Kevin.Wall@qwest.com Phone: 614.215.4788
"The reason you have people breaking into your software all
over the place is because your software sucks..."
-- Former whitehouse cybersecurity advisor, Richard Clarke,
at eWeek Security Summit
