Cyber Breach Case Research

The challenges facing cybersecurity globally have weakened the complex systems that were put in place. Cybersecurity activities should be guided towards providing sustainable economic and health systems security. The United States has been on the lead in fighting cyber insecurity with both legislation and policies that aim towards minimizing acts of cyber terror. The NIST framework is aimed at using business drivers to guide cybersecurity activities and taking care of the risks that arise in the process by including them as management processes. This paper discusses cases of cybersecurity that have happened in various companies across the different industries from social media to health among others. 0 Snapchat (DISC) 7 1. 1What made the breach happen? 8 1. 2 Procedure to improve company processes 8 1. 3 Concerns from a legal perspective 9 1.

4 Preventative measures 9 1. 3 Legal perspective 14 1. 4 Preventative measures 15 1. 5 Recommendation 15 1. 0 University of Oklahoma (HACK) 16 1. 1 What made the breach happen? 16 1. 1 Vulnerability and risk/loss value According to the company they learned about the ransomware attack on February 12 and thus made arrangements including the impromptu deployment of third-party experts to look into the matter and report shortly the amount, nature and contents of the data that was breached before taking necessary actions. According to the reports, it was confirmed that approximately 10,200 clients’ data had fallen prey of the attacker as they had not been adequately protected following the prerequisite data protection procedures as stipulated by the company bylaws (Pierret, 2017). The company also confirmed that, up to the time the breach was discovered, there hadn’t been any evidence in the public domain that indicated that the information that was stolen by the attackers had been used elsewhere.

The short-term impact of the attack saw that the company carries out an in-depth audit of its information systems to determine other areas that were deemed vulnerable. The company also took to itself to ensure that their customer's financial records and accounts were not breached in the process by offering to look into the customer’s accounts through credit monitoring in partnership with financial institutions. 3 Regulatory guidelines Implementing procedures that detect and guard company systems against malicious software that is introduced into the system illegally. The procedure should include an analysis of the risks so as to identify threats and the system vulnerabilities to the company electronic protected health information (ePHI). HIPAA requires that companies implement access controls that close out malicious personnel and activates from gaining access into the ePHI by providing access to specific persons who are authorized to access the system (Carlson & Mandel, 2017).

The guidelines also direct that the company systems should at all times incorporate backups that run systematically with the company systems. This directive equally emphasizes the need for a business continuity plan in the event of a malware attack (Fetzer & West, 2008). The breach was thereby categorized as a phishing attack (Russel, 2016). 2 Procedure to improve company processes To reduce future similar attacks on the company, the chief executive officer of the company says that they are on the verge of pursuing advanced training for its employees to help them in understanding the modes of attacks that hackers and other attackers would use in perpetrating attacks on the company. Training is the number one procedure that needs to be implemented by the company if it has to fight disclosure attacks.

A similar attack that happened in 2014 in which more than 200,000 photos from users in which attackers used third-party applications to infiltrate the company’s database would be prevented if the employees of the company were trained on the different ways with which attackers would cause an attack (Russel, 2016). The company was seen giving reports that no user data was affected in the process of the attack and that users shouldn’t fear for their information being disclosed but in the end, the user data was disclosed to the public. Both data in storage and data in transit is kept safe through encryption and makes disclosure hard for the attacker. The use of third-party authentication reduces the number of password combinations that users need to remember in order to gain access to the site.

The more the customers have to remember the more they are likely to use keyloggers and written references making their access information vulnerable to the attacker. 5 Recommendations Make security a business problem and not just an IT problem. Issues of information security should be dealt with using resources and tools approved by the management without leaving it to the ICT team of the company. 1 What made the breach happen The breach happened because of the transactions that were made at the company’s website. Gamestop identified that the hacker might have taken advantage of one of the user’s information to pose as an administrator thus causing the breach. Initially, the company management believed that the breach might have resulted from the retails stores and that one of the company’s point of sale system might have been affected by a malware introduced to the system by the hacker.

The reason for this conclusion is because the attack happened at the height of sales season during a holiday. However, the company later attributed the attack to a hacker who used malware to steal Card Verification Values (CVV2) from the company website. The regulation aims at making the individuals have control over their data by initiating policies and strict conditions over the acceptance by the user on the data to be captured and stored by a company (Buttarelli, 2017). The UE creates obligations to companies in different areas such as compulsory breach notifications, data anonymization and appointment of officers to oversee data protection measures as well as compelling companies that handle user information to make key changes in the way they organize the collection s and dissemination of user data.

There are standards that govern the companies that would want to operate in the countries where this regulation covers and other affiliate member states. Companies should issue notifications to the relevant authorities within 72 hours of becoming aware of the breach with fines and penalties on those who fail to fulfill this requirement. 4 Preventative measures The main preventive measure the company should implement is to stay updated on the contemporary hacking threats. The company was founded in 2011 by Annika Weyhrich a public curator in the music and culture space. The company has ten employees. Fling. com is an adult dating site with approximately 57 million users globally. 1 What made the breach happen The attack which happened in 2017 by a hacker saw the hacker make away with user details for more than fifty million users.

The company will need to set realistic and measurable objectives to align with the overall strategic organization plans and goals. 3 Legal perspective The Active Cyber Defense Certainty Act (ACDC) provides an exception to the Computer Fraud and Abuse Act (CFAA) liability by allowing companies or affected individuals to go out of their way and gather intelligence from diverse networks outside their own to obtain intelligence on the potential hackers for purposes of attribution. The FBI led national Cyber Investigative Joint Task Force (NCIJTF) has an internal set of procedures to oversee and provide guidance on the occurrence of hacking. The company is however required to implement procedures that minimize the chances of attackers gaining privileged information from their sites. In this view, Fling is supposed to come up with measures and procedures that limit information access by outsiders.

0 University of Oklahoma (HACK) The University of Oklahoma is an educational institution with company size of approximately 5,000 employees. The institution of higher learning fell prey to a devastating cyber-attack on November 7, 2017, leading to information breach of more than 280,000 patients (Evolvemga, 2018). 1 What made the breach happen? The breach at the university happened as a result of the hacker gaining access to administrator details from one of the university management account activities. The hacker gained access to confidential folders containing patient information on Medicaid billing for more than 280,000 patients (Evolvemga, 2018). 2 Procedure to improve company processes The first measure to improve services of Oklahoma University is through creating new standards and policies which will act as the benchmark to guide employees. government personal information protection directive.

4 Preventative measures The best preventive measure against the hacking attack on the Oklahoma University is to toughen access control. Since the attacker infiltrated the system through the administrator side of the account, it is vital that the organization enforces user credentials that cannot be guessed by the hacker. This included limiting the number of tries by the administrator in the event that their account is inaccessible. Login details should never be sent through the email.  European Data Protection Law Review, 3(2), 155-159. http://dx. doi. org/10. 21552/edpl/2017/2/5 Carlson, S. , & Gruman, G.  How to rethink security for the new world of IT. InfoWorld Media Group. Evolvemga.  Oklahoma State University Breach Impacts Nearly 280k Medicaid Patients. Retrieved 16 March 2018, from https://www. databreaches. net/plastic-surgery-associates-of-south-dakota-notifies-10200-after-ransomware-attack/ Russel, J.