In information security, security architects and CISOs must navigate four distinct legal domains. Each category imposes different burdens of proof, enforcement bodies, and liabilities on a modern bank like Apex Global.
Apex Bank Scenario 1.2
The Ransomware Extortion Attack
A threat actor deploys ransomware targeting Apex Bank's wire transfer gateway, encrypting settlement databases and threatening to leak 2 million customer loan applications. This single incident triggers all four categories of law simultaneously.
1. The Four Legal Categories Explained
🔒 1. Criminal Law
Violations against society and public order prosecuted by government authorities (e.g. DOJ, FBI, Crown Prosecution Service).
Burden of Proof: Beyond a reasonable doubt (99%+).
Apex Bank Context: Prosecuting the extortion gang under the Computer Fraud and Abuse Act (CFAA).
📄 2. Civil / Contract Law
Governs disputes between private parties, corporate entities, and contractual relationships.
Burden of Proof: Preponderance of the evidence (51%+).
Apex Bank Context: Cloud vendors breach SLA agreements during the outage.
⚠️ 3. Tort Law (Negligence)
Civil wrongs resulting in harm or injury, where a party failed to uphold a legal duty of care.
Burden of Proof: Preponderance of the evidence.
Apex Bank Context: Class action lawsuit filed by depositors alleging negligence in patching known CVEs.
🏛️ 4. Administrative / Regulatory Law
Standards created by regulatory agencies with executive oversight over specific industries.
GDPR (General Data Protection Regulation): Up to 4% of global annual turnover or €20 million for mishandling EU citizens' personal data.
3. Knowledge Check
Checkpoint Quiz: Classifying Legal Exposure
When customers sue Apex Bank for identity theft damages after unpatched server logs were exposed on the web, what category of law does this customer lawsuit fall under?