Cybersecurity Breach

The purpose of this meeting is to inform you of a security breach that occurred in our company, and to inform you of what has been affected, how we found out, and what measures have been used to correct and prevent this from happening again. The following is a bulleted list of relevant information related to the security breach.

A data breach is an incident in which sensitive, protected or confidential data has potentially been viewed, stolen or used by an individual unauthorized to do so. Data breaches may involve personal health information (PHI), personally identifiable information (PII), trade secrets or intellectual property. The most common concept of a data breach is an attacker hacking into a corporate network to steal sensitive data. However, not all data breaches are so dramatic. If an unauthorized hospital employee views a patient's health information on a computer screen over the shoulder of an authorized employee that also constitutes a data breach.

Every few weeks, we learn about another data breach. It 's the privacy world 's version of an oil spill. A hacker breaks into a company and grabs a database of our personal details. They 're sold on the black market, and the exposure puts us at higher risk of fraud and identity theft. Information protection is something you do, not something you buy. It is not a policy to put in place and forget. Information security requires a strong process and effective technologies, all based on a sound understanding of the business the organization is in and how it performs that business. These days, criminal hacking is a business, everything that is done has a chain linked to real dollars. And hackers are looking for the shortest chain.

TGT’s public announcement of data breach disclosed that “approximately 40 million credit and debit card accounts may” were potentially compromised (Target, 2013). This came weeks after the breach, and a day after the company was out-ed on technology security blog (Krebs, B. 2013). The event’s high-impact (on stakeholder emotions and finances) demanded an immediate response. TGT failed to notify the public immediately and did not provide consistent and adequate communications.

Young, Sam. (2013). Contemplating corporate disclosure obligations arising from cybersecurity breaches. Journal of Corporation Law, 38(3), 659. Retrieved from https://www.lib.jjay.cuny.edu/

Following is a summary of the security breach at Corporation Techs. As soon as the breach was detected the firewall logs were reviewed and confirmation of the security breach was documented. The IT group had a meeting to administrator the corrective action. The incident was isolated and then the damaged was assessed. The goals of the incident response were to minimize downtime, minimize loss, and restore the environment back to a secured normal state as quickly as possible. We followed six primary steps to conclude. The steps included,

The massive security breach at TJX companies in 2005 has become a lesson in proper security in retail stores across the world. This breach that led to the loss of personal information on millions of customers is a direct result of inadequate security safeguards. Managing risk over critical information can always be tricky, but it is important to integrate security standards and privacy requirements across each company. TJX companies certainly put their customers information at risk by relying on weak encryption technology to protect this information. With the proper security measures, this record breaking data breach could have been avoided.

Blue Moon Financial (BMF) is a large financial services firm that has recently started to understand the value of protecting the organizations network resources, largely in response to a recent rash of network intrusions that have victimized other firms within the industry. BMF has allocated additional funds for the acquisition of technical resources and additional training for technicians in order to help mitigate any breaches that may significantly impact the sustainability of the company and services provided to its clients. As the Senior Security Analyst at BMF I am awaken one night by a phone call from a technician who

Information governance [IG] is an approach that employs multiple activities and technologies effectively within an organization. This policy incorporates more than traditional records management as multiple departments are involved in its implementation. An established information governance policy is necessary to reduce accompanying jeopardies and expenses. According to the 2005 Second Annual Data Breach Industry Forecast, after 62 percent of consumers reported they had received at least two data breach notifications involving separate incidents in the past two years, perhaps surprisingly the most frequent response was inaction. [1] This may be an indication that a stronger IG is necessary for some organizations. With the expanded use of cloud and other budding future technologies, more breaches are likely to increase. There are several steps an organization can take implement an effective IG policy..

Securing cyberspace is one of the most important and urgent challenges of our time. In light of the growing threat and the national security and economic ramifications of successful attacks against American businesses, it is essential that corporate leaders know their responsibility for managing and disclosing information security risk. (Rockefeller, Menendez, Whitehouse, Warner, & Blumenthal)

Computers are faster than ever before and interconnected in ways no one would have guessed 50+ years ago. In the last couple years, cybersecurity dangers including data breaches have become increasingly prevalent. Advances in technology changes fast, much faster than any current form of government, but that’s not to say government can’t or shouldn’t regulate the technology industry like they do with other industries. With the safety of citizen’s personal information at risk, and potentially billions of dollars worth of damage caused, government needs to step up and protect it’s citizens before another data breach like Equifax happens which could cost upwards of 100 billion dollars. This is why I think data breach disclosure laws need to be

Organizations, on the other hand, are prime targets for social engineering attacks. As technological changes moves at such a rapid rate, many companies, especially, small businesses struggle to keep pace, and policies and procedures are developed haphazardly, if at all. However, information security poses a great risk and must be addressed if organizations are to avoid a range of unpleasant side-effects and sometimes significant financial losses. A 2007 study conducted by the Ponemon Institute on security breach revealed that “average total cost per reporting company was more than $6.3 million per breach and ranged from $225,000 to almost 35 million”. Moreover, according to an article published in one of the leading Information Security Magazines “85% of organizations experienced a data breach in 2008” (Raymond.Al, 2009).

The blame for the security breach was the CEO of the company. The CEO knows that client information is important. It is his responsibility to ensure that confidential information is manipulated carefully and the servers and technological devices are strong enough to prevent this issues. It is not information protection its company safety, if the hackers accessed to the headquarter information in Massachusetts (from Minnesota where the store is located) is a proof of lack of controls.

It is important to note that whether an attack is perpetrated by a hacker group, other corporations or individuals, organizations must always prepare adequately through intrusion detection and prevention systems in place. Data breaches can have very devastating business and social impact to large businesses and their customers – the users. For instance, were Cloudflare attacked by a competing company, their trade secrets could have given the opponents ammunition to take them out of the field. In addition, lost data could influence criminal activity if for instance particular client information, for

With the recent disclosures about the enormous data breaches that occur within the online retail community it is certain that a strong plan is needed by all companies. For example in 2014,Target, Nieman Marcus, White Lodging, Sally Beauty, Michaels, Affinity Gaming (casinos), UPS, Home Depot and even New York reported data breaches that involved the theft of credit or debit card information of millions of consumers ( Hardekopf, 2015). One of the first things that must be considered is the communication process because it is where the breakdown first begins. Having strong polices that are followed to the letter is the beginning of setting up a risk management framework. This is especially true when you consider that internal risk is growing as fast as external.