427 Botnet fm qxd

www.syngress.com
Intelligence Resources • Chapter 11
405
427_Botnet_11.qxd 1/9/07 9:56 AM Page 405

---

If you don’t have permission to use a person or organization’s name and
information, you shouldn’t discuss it outside an organization with which you
have a confidentiality agreement. If you do, you should use hypothetical situa-
tions and names. For example, saying “a company last year was affected by a
botnet, and disassembled it and found the IP address information was being
sent to X” provides enough information to colleagues without mentioning
specifics about who was involved. Similarly, using false names like “Jane Doe”
or “Widgets Inc.” allows you to convey a scenario without identifying who
was involved.
Potential Impact of 
Breaching These Agreements
The same limitations on releasing information should also apply to discussing
aspects of your own company. At a minimum, breaking a confidentiality
agreement where you work could result in your employment being termi-
nated. In some situations, that may be a best-case scenario. Records dealing
with patients in medical facilities, criminal backgrounds in police depart-
ments, personal information on clients, and other privileged information need
to be secure, and are controlled through policies and laws.There are strict reg-
ulations to control the release of information in such situations, and breaking
these rules could result in fines, compensation to clients and other third par-
ties, and imprisonment.
Membership organizations also have policies that determine what will
occur when someone breeches a confidentiality agreement. If the agreement
is broken, the person who broke the rules can have his or her membership
revoked. If the situation is serious enough, that person’s company may be
blacklisted, preventing anyone from the company from joining the member-
ship organization in the future.
The exception to being released from the confines of a confidentiality
agreement is when you are legally required to do so. During a criminal inves-
tigation, you may be required to provide information to law enforcement or
while testifying. If a confidentiality agreement prevents you from providing
information, you can request a warrant or subpoena issued, or you may be
ordered during testimony to provide the information. In such cases, any con-
fidentiality agreement becomes secondary, as you can be charged with con-
tempt of court or other charges by failing to comply.