Question.5119 - Week 6: Assignment 3Prompt:Research recent cyber breaches that have occurred with different companies. Select a company that had a cyber breach and consider what happened and what could have been done differently (examples include Sony, Maersk, Saks, Lord & Taylor, Sacramento Bee, TicketFly, Panera, Facebook, Target, Under Armour, and Equifax). Given that cyber breaches are more common, write about the importance of cyber defenses and organizational hardening for an organization's supply chain. In your paper, consider the government requirements that are currently in place and how this might apply to commercial organizations.
Answer Below:
Cyber xxxxxxxxxxxxx BeachesCyber xxxxxxxx have xxxxxxx as x rapidly xxxxxxxxxx threat xx organizations xxxxxx every xxxxxxxx undermining xxx long-held xxxxxx that xxxxxx firewalls xxx anti-virus xxxxxxxx alone xxx ensure xxxxxxxx The xxxx of xxxxxxxx attack xxxxx and xxxxxxxxxx has xxxx under-prepared xxxxxxxxxxxxx vulnerable xx severe xxxxxxxxxxx and xxxxxxxxxxxx damage xxxxxx et xx Weak xxxxxxxxxx practices xxx fragmented xxxxxx chains xxxxxxx create xxxxxx vulnerabilities xxxx attackers xxx exploit xxxx relative xxxx The xxxxxxx breach xxxxxxxxxxx how xx unpatched xxxx in xxxxxx used xxxxxxxx can xxxxxx millions xx sensitive xxxxxxx and xxxxx public xxxxx Fruhlinger xxxxxxx Sasi xx al xxxxxxx that xxxxxxxx vendor xxxxxxxxxx effective xxxxxxx segmentation xxx proactive xxxxxxxxxxxxx mitigation xxxxxxxxxxxxx reduce xxx likelihood xxx impact xx such xxxxxxxxx Therefore xxxxxxxxxxxxx cybersecurity xxxxxx the xxxxxxxxxxxxxx ecosystem xxx become xx operational xxxxxxxxxx Analysis xxx Argument xx EquifaxEquifax xxx long xxxxxxxxxx as x central xxxxxxxxxx for xxxxxxxxx financial xxx personal xxxx that xxxxxxx lending xxxxxxxxx employment xxxxxxxxxxxx and xxxxxxxxx assessments xx the xxxxxx States xxxxxxxx and xxxxxxxxxx emphasize xxxx such x critical xxxx demands xxxxxxxx security xxxxxxxx to xxxxxxx consumer xxxxxxx However xxxxxxx maintained x poor xxxxx record xx vulnerability xxxxxxxxxx and xxxxxxxxxxxx limited xxxxxxxxxxxxxx in xxx cybersecurity xxxxxxxxx before xxx breach x critical xxxxxxxxxxxxx disclosed xx March xxx identified xx the xxxxxx Struts xxxxxxxxx which xx widely xxxx in xxx dispute xxxxxxxxxx portal xxxxxxx Madnick xxxxxxxxxxx et xx issued xxxxxxxxxx urging xxxxxxxxx patching xxx Equifax xxxxxx to xxxxxx the xxxxxx or xxxxxx its xxxxx inventories xxxxxxxxxx This xxxxxxxxxx created xxxxxxxxxx that xxxxxxxxxx enabled xxxxxxxxx to xxxxxxxxx the xxxxxxx and xxxxxxxxxx massive xxxxxxx of xxxxxxxxx data x detailed xxxxxxxxxx of xxx breach xxxxxxxxxxxx how x single xxxxxxxxx vulnerability xxxxxxx into x prolonged xxxxxxxxxx with xxxxxx consequences xxx first xxxxxxxxx exploitation xx the xxxxxx Struts xxxx occurred xx mid-May xxxx attackers xxxxxx unauthorized xxxxxx to xxxxxxxxx internal xxxxxxx Kabanov xxx Madnick xxxx that xxxxxx patching xxx rigorous xxxxx tracking xxxxx have xxxxxxxxxx this xxxxxx vector xxxxxxxxx investigators xxxxxxxxxx that xxxxxxxxxx network xxxxxxxxxxxx allowed xxxxxxxxx to xxxx laterally xxxxxx critical xxxxxxx with xxxxxxx resistance xxxxxxxxxx organizations xxxx mature xxxxxxxxx capabilities xxxxxxxxx identify xxxxxxxxxxxx lateral xxxxxxxx within xxxx and xxxxxxx such xxxxxxxx before xx escalates xxxx et xx However xxxxxxxxx monitoring xxxxxxx failed xx detect xxxxxxxx data xxxxxxxxxxxx until xxxx July xxxx attackers xxx accessed xxxxxxxx information xxxxxxxxx to xxxxxxxxxxxxx million xxxxxxxxxxx Kara xxxx sequence xx failures xxxxxxxxxxx how xxxxxxx detection xxx response xxx significantly xxxxxxx the xxxxxxxxxxxx of xx initial xxxxxxxx lapse xxxxxxx preventive xxxxxxxx could xxxx substantially xxxxxxx the xxxxxx of xxx breach xx prevented xx entirely xxxxxx application xx the xxxxxx Struts xxxxx would xxxx closed xxx exploited xxxxxxxxxxxxx before xxxxxxxxx initiated xxxxx activities xxxxxx Robust xxxxxxx segmentation xxx enforcement xx least-privilege xxxxxx controls xxxxx limit xxxxxxxxxxxx movement xxx contain xxxxxxxxx into xxxx sensitive xxxxxxx However xxxxxxx placed xxxxxxxxxxxxxxxx emphasis xx perimeter xxxxxxxx allowing xxxxxxxxxxx to xxxxxxxxx few xxxxxxxx once xxxxxx Kabanov xxxxxxx Encrypting xxxxxxxxx data xx rest xxxxx have xxxxxxx reduced xxx value xx stolen xxxxxxx This xxxx illustrates xxx a xxx approach xx risk xxxxxxxxxx turns xxxxxxxxxx threats xxxx catastrophic xxxxxx highlighting xxx necessity xx consistent xxxxxxxxxx and xxxxxxx defenses xxxxx Defenses' xxxxxxxxxxxx In xxxxxxxxxxxxxx vulnerability xxxxxxxxxx and x proper xxxxx inventory xxx the xxx complementary xxxxxxxxxxx of x sound xxxxxxxxxxxxx plan xxx example xx Equifax xxxxxxx to xxx the xxxxxxxxxxxxx in xxx Apache xxxxxx provides xx example xx the xxxx of xxxxxxxxxxx discipline xxxxx et xx Organizations xxxx good xxxxxxxxxxx are xxxx to xxxxxx systems xxxx are xxxxxxxxxxx quickly xxx patch xxxx before xxxxxxxxxxxx The xxxxxxxxxxxxx that xxx organizations xxxxxx watch xxxx their xxxxxxxxxxxxxxx fails xx consider xxx duty xx place xxxxxxx attention xx high-value xxxxxxx Thiyagarajan xx al xxxx that xxxx the xxxxxxxxx scanning xxxxx which xxx used xxxxxxx structured xxxxxxxxx the xxxxxxxxx of xxxxxxxx software xx reliable xxx Equifax xxxx is xx illustration xx how xxx failure xx fix xxxxx vulnerabilities xxxxx to xxx conversion xx manageable xxxxx into xxxxxxxxx access xxxxxx Folorunso xx al xxxxxxxxxxxxxxxxxx good xxxxx management xxx prompt xxxxxxxxxxx are xxx ways xxxx organizations xxxxx preventable xxxx of xxxxxxxxx information xxxxxxxxxxxx and xxxxxxx encryption xxx imperative xxxxxxxxxx that xxxxxx the xxxxxx of xxxxxxxxxx intrusions xx the xxxxxx of xxxxxxx the xxxxxx easily xxxxx within xxx misorganized xxxxxxxx and xxxxxx access xx unencrypted xxxxxxxx information xxxxxxx facing xxx obstacles xxx et xx On xxx other xxxx segmentation xxxx the xxxxxxxxx in xxxxxxxxxxxxx domains xxxx fewer xxxxxxx to xxxxxxx privileges xxxxxxxx encrypted xxxx results xx unreadability xx stolen xxxx hence xxxxxxxxxxxxxxx remains xxxxxxxxxx Equifax xxxxxx these xxxxxxxx due xx the xxxxxxxxxxxxx belief xx perimeter xxxxxxxxx which xxx to xxx extent xx the xxxxxx Though xxxxx organizations xxx cost xxx complexity xx excuses xxx to xxxxxxx and xxxxxxx the xxxx illustrates xxxx insufficient xxxxxxxx result xx higher xxxxxxxx Sunday xxxxxxxxxxxx Thus xxx strict xxxxxxxx are xxxxx to x strong xxxxxxxxxxxxx system xxxxxxxx training xxxxxxxx response xxxxxxxxxxxx and xxxxxx chain xxxxxxxx together xxxxxx an xxxxxxxxxxxxxx ability xx detect xxx contain xxxxxxxx Equifax's xxxxxxx recognition xx malicious xxxxxxxx exposed xxxx escalation xxxxxxxxxx and xxxxxxxxxx staff xxxxxxxxx Hong xx al xxxxxxxxx poor xxxxxxxxxxx risk xxxxxxxxxx enabled xxxxxxxx on xxxxxxxx software xxxxxxx sufficient xxxxxxxxx In xxxxxxxx organizations xxxxxxxxxx regular xxxxxxxx and xxxxxxxxxx response xxxxxxxxx develop xxx capacity xx react xxxxxxx Conversely xxxxxx supplier xxxxxxxxxxx reduce xxxxxxxxx risks xxxx compromise xxxxxxxx systems xxxxxxxx Ilori xx al xxxxx that xxxxxxxxxxx in xxxxxxxx and xxxxxx audits xxx burden xxxxxxxxx Equifax's xxxxxxx shows xxxx neglecting xxxxx measures xxxxxx even xxxxxx costs xxxxxxxxx preparation xxxxxxx essential xx maintaining xxxxx and xxxxxxxxxx Government xxxxxxxxxxxx ApplicableThe xxxxxxx Trade xxxxxxxxxx Act xxxxxxxxxxx a xxxxx expectation xxxx companies xxxxxxxxx consumer xxxxxxxxxxx against xxxxxxxxxxx risks xxxxxxx grants xxx agency xxxxxxxxx to xxxxxxxxx unfair xx deceptive xxxxxxxxx including xxxxxxxx to xxxxxxxxx reasonable xxxxxxxx measures xxxxxxxxxx Lawyers xxxxxxxxxxx In xxxxxxxxx case xxx FTC xxxxx that xxxx patching xxxx segmentation xxx inadequate xxxxxxxxxx constituted xxxxxx practices xxxxxxx consumers xxxxxxxxxx some xxxxxxxx argue xxxx post-breach xxxxxxxxxxx lacks xxxxxxxxx value xxx provides xxxxxx practical xxxxxxxx for xxxxxxxxxx Mushtaq xxxx However xxxxxxxxxxx history xxxxx regulators xxxxxx proactive xxxxxxxxxx controls xxxxxxxx to xxxx sensitivity xxx Equifax xxxxxxxxxx confirmed xxxx ignoring xxxxx vulnerabilities xxxxxxxxxx not xxxx operational xxxxxxx but x violation xx federal xxxxxxxx protection xxx The xxxxxxxxxxxxxxxxxx Act xxxx and xxx Fair xxxxxx Reporting xxx FCRA xxxxxxx companies xxxx Equifax xx protect xxxxxxxx financial xxxx GLBA xxxxxxx mandates xxxx financial xxxxxxxxxxxx maintain x comprehensive xxxxxxx security xxxxxxx under xxx Safeguards xxxx Gramm-Leach-bliley xxx Similarly xxx FCRA xxxxxxxx credit xxxxxxxxx agencies xx use xxxxxxxxxx procedures xx ensure xxx confidentiality xxx accuracy xx credit xxxx Diamond xxxxxxx Equifax's xxxxxxxx in xxxxxxxx vulnerabilities xxx enforcing xxxxxx controls xxxxxxxxxxxx insufficient xxxxxxxxxx to xxxx these xxxxxxxxx Meanwhile xxxxxx bureaus xxxx invested xx risk-based xxxxxxxxxx and xxxxxxx evaluations xxx not xxxxxxxxxx similar xxxxxxxxx This xxxx illustrates xxxx regulatory xxxxxxxxxx impose xxxxxxx duties xxx noncompliance xxxxx to xxxxxx financial xxxxxxxxx and xxxxxxxxxxxx harm xxxxxx notification xxxx adopted xx the xxxxx level xxxxx with xxxxxxx frameworks xxxx the xxxx Cybersecurity xxxxxxxxx have xxxxxxxxxxx higher xxxxxxxxxxxx for xxxxxxxxx security xxxxxxxxx Every x S xxxxx requires xxxxxx notification xx data xxxxxxxx though xxxxxxxxx timelines xxx thresholds xxxx The xxxx Cybersecurity xxxxxxxxx NIST xxx provides xxxxxxxxxxx guidance xx risk xxxxxxxxxxxxxx protection xxxxxxxxx response xxx recovery xxxxx However xxxxxxxxx delayed xxxxxx disclosures xxx inconsistent xxxxxxxxxxxxx with xxxxxxxx consumers xxxxxxxxx outdated xxxxxxxxxxx about xxxxxxxx management xx and xxx note xxxx legislators xxx regulators xxxx since xxxxxxxxxx faster xxxxxxxxxxxx and xxxx precise xxxxxxxxxxx planning xxxx shift xxxxx that xxxxxxxxxxxx reforms xxxxxx a xxxx transparent xxx proactive xxxxxxxx posture x contemporary xxxxxxxxxxxx must xxxxxxxxx federal xxxx state xxxxxxxxxxx and xxxxxxxxxxx frameworks xx build xxxxxxxxxx and xxxxxxx public xxxxx ConclusionThe xxxxxxx breach xxxxxxxx lasting xxxxxxxx into xxx consequences xx failing xx uphold xxxxx cybersecurity xxxxxxxxx The xxxxxxxxx to xxxxx critical xxxxxxx segment xxxxxxxx and xxxxxxx suspicious xxxxxxxx demonstrates xxxx predictable xxxxxxx can xxxxxxxx into xxxxxx when xxxxxxxxxx is xxxx However xxxxxxxxxxxxx that xxxxxx in xxxxxxxxx protection xxx continuous xxxxxxxxxxx are xxx better xxxxxxxx to xxxxxxx the xxxxx of xxxxxxxxx information xxxxxxxxxx must xxxx align xxxx regulatory xxxxxxxxxx such xx the xxx Act xxxx and xxxxxxxxxxx notification xxxx to xxxxxxxx public xxxxx and xxxxx severe xxxxxxxxx In xxxxxxxx treating xxxxxxxxxx as x secondary xxxxxxx invites xxxxxxxx and xxxxxxx reputation xx sum xxx Equifax xxxxxxxx underscores xxxx disciplined xxxxxxxxxxxxx and xxxxxxxxxx adherence xxx essential xxxxxxx of xxxxxxxxxxxxxx resilience xx an xxxxxxxxxxxx hostile xxxxxxx environment xxxxxxxxxxxxxxxx W x Munaye x Y xxxx A x Cyber xxxxxxxx State xx the xxx challenges xxx future xxxxxxxxxx Cyber xxxxxxxx and xxxxxxxxxxxx https xxx org x csa xxx S x A xxx F xxxxxx R xxxx M x The xxxxxxxx Impact xx information xxxxxxxx breach xxxxxxxxxxxxx on xxxxxxxxxx confidence xxx context xx Efficient xxxxxx Hypothesis xxxxxxxxxxxxxx https xxx org xx California xxxxxxx Association xxxxxxx FTC xxxxxxx and xxxx Security xxxxxxxxxxx and xxxxxxxx under xxxxxxx - xxxxxxxxxx Lawyers xxxxxxxxxxx https xxxxxxxxx org xxxxxxxxxxxx antitrust-unfair-competition-law xxxxxxxxxxxx -vol- xxxx -ftc-privacy-and-data-security-enforcement-and-guidance-under-section- xxxxxx C x E xxxxxxxx Vulnerability xxxxxxxxx Apache xxxxxx CVE- x - xxxxxxxx Centre xxx Cyber xxxxxxxx Canadian xxxxxx for xxxxx Security xxxxx www xxxxx gc xx en xxxxxxxxxxxxxxxxx vulnerability-impacting-apache-struts- xxxxx - xxxxxxx K xxxxxxx K xxxx Top xxxxxxxxxx of xxx Fair xxxxxx Reporting xxx Ziegler xxxxxxx Law xxxxx attorneydebtfighters xxx top-violations-of-fair-credit-reporting-act-and-how-to-address-them xxxxxxxxxxx N xxxxxxxxxx A xxxxxx M xxxxx M x Software xxxxxxxx Patch xxxxxxxxxx -- x systematic xxxxxxxxxx review xx challenges xxxxxxxxxx tools xxx practices xxxxx Cornell xxxxxxxxxx https xxx org xxxxx Folorunso x A xxxx N x Samuel x B xxxxxxxx N x Security xxxxxxxxxx and xxx implications xxx cybersecurity xxxxx Journal xx Advanced xxxxxxxx and xxxxxxx https xxx org xxxxx Fruhlinger x April xxxxxxx data xxxxxx FAQ xxxx happened xxx was xxxxxxxx what xxx the xxxxxx CSO xxxxxx https xxx csoonline xxx article xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx htmlGibilaro x Mattarocci x Financial xxxxxxxx and xxxxxxxxxxx Sharing xxxxxxxx from xxx Italian xxxxxx Register xxxxx https xxx org xxxxx Gramm-Leach-bliley xxx June xxxxxxx Trade xxxxxxxxxx https xxx ftc xxx business-guidance xxxxxxxxxxxxxxxx gramm-leach-bliley-actHong x Kim x Roh x Mitigating xxx impact xx work xxxxxxxx on xxxxxxxxxxxxx behavior xxx Moderating xxxxxxxxx of xxxxxxxxx Ethics x Mediated xxxxxxxxxx Analysis xxxxxxxxxxxxxx https xxx org xx Ilori x O xxxxx N x T xxxxx N x N x Third-party xxxxxx risks xx IT xxxxxxxx A xxxxxxxxxxxxx audit xxxxxx and xxxxxxxxxx strategies xxxxx Journal xx Advanced xxxxxxxx and xxxxxxx https xxx org xxxxx Kabanov x Madnick x A xxxxxxxxxx study xx the xxxxxxx failures xx the xxxxxxx cybersecurity xxxxxxxx SSRN xxxxxxxxxx Journal xxxxx doi xxx ssrn xxxxxxx I xxxxxxx S xxxxxxxx the xxxxxxx from xxx Equifax xxxxxxxxxxxxx Incident xx Build x Better xxxxxxx MIS xxxxxxxxx Executive xxxxx doi xxx msqe xxxx April xxxx study xxxxxxx Data xxxxxx - xxxxx Pillars xxxxxxxxx Seven xxxxxxx Institute xxxxx sevenpillarsinstitute xxx case-study-equifax-data-breach xxxxxxx S xxxx M xxxxxxxx Factors xxx Practices xx Mitigating xxxxxxxxxxx within xxxxxxxxxxxx Services x Rapid xxxxxx on xxxxxxxxxx Public xxxxxxx Management xxxxxxxxxxx https xxx org xxxx Nason x June xxxx is xxx NIST xxxxxxxxxxxxx Framework xxxx Cybersecurity xxxxx www xxxx net xxxxxxxx nist-cybersecurity-frameworkSasi x Lashkari x H xx R xxxxx P xxxxx S x comprehensive xxxxxx on xxx attacks xxxxxxxx detection xxxxxxxxxx and xxxxxxxxxx Journal xx Information xxx Intelligence xxxxx doi xxx j xxxxx Sunday x E xxxxxxxxxxxx O x An xxxxxxxxx data xxxxxxxxxx for xxxxx storage xxxxxxx encryption xxxxxxxxxxxxx Journal xx Advanced xxxxxxxxxx and xxxxxxxxxxxx https xxx org xxxxx Thiyagarajan x G xxxx N x Nayak x P xxx Hidden xxxxxxx of xxxxxxxx Software x Cybersecurity xxxxxxxxxxx International xxxxxxx of xxxxxxxxxx Research xx Computer xxxxxxx Engineering xxx Information xxxxxxxxxx https xxx org xxxxx Xu x Dai x Evaluation xx local xxxxxxxxxx digital xxxxxxxxxx ability xxx Sustainable xxxxxxxxxxx a xxxx study xx Hunan xxxxxxxx Sustainability xxxxx doi xxx su xxxxx X xxxxxxxxx M x Dadkhah x Isah x Le x P xxxxxxxx A x Data xxxxxx analysis xxxxxxxxxxxxxxx and xxxxxxxxxx International xxxxxxx of xxxxxxxxxxx and xxxxxxxx Security xxxxx doi xxx ijicsMore Articles From Management Information System
.ico)
.ico)
.ico)
