University of Louisiana at Lafayette Marriott Data Breach Information Security Paper (Great English is a must!! No grammar errors!) (3 full pages, APA For

University of Louisiana at Lafayette Marriott Data Breach Information Security Paper (Great English is a must!! No grammar errors!)

(3 full pages, APA Format)

——————————–

Subject of the paper: Information Security Essay Analytic Question

Requirement: Search online for a recent report or news article on an information security breach. Discuss the breach, its potential impact, and how it might have been avoided. What should the key takeaways be for managers studying your example? Cite material from your textbook in addition to the HBR article. (materials are attached)

Other information: APA format. 3 pages. Attached are the materials. No plagarism please

Format:

APA Format
No plagiarism is accepted
The attached document represents the materials.

*** The work will be checked for plagiarism through Turnitin by the professor. It is essential for everything to be free of plagiarism otherwise sanctions will be imposed***

——–

Thank you for your support https://www.youtube.com/watch?v=N2It_DXnKg8&feature=emb_logo

SECURITY & PRIVACY
Why Do IoT Companies
Keep Building Devices
with Huge Security Flaws?
by Andrew Tannenbaum
APRIL 27, 2017
Earlier this year an alarming story hit the news: Hackers had taken over the electronic key system at a
luxury hotel in Austria, locking guests out of their rooms until the hotel paid a ransom. It was
alarming, of course, for the guests and for anyone who ever stays at a hotel. But it came as no surprise
to cybersecurity experts, who have been increasingly focused on the many ways in which physical
devices connected to the internet, collectively known as the internet of things (IoT), can be hacked
and manipulated. (The hotel has since announced that it is returning to using physical keys.)
COPYRIGHT © 2017 HARVARD BUSINESS SCHOOL PUBLISHING CORPORATION. ALL RIGHTS RESERVED.
2
It doesn’t take a great leap to imagine an IoT hostage scenario, or all of the other ways hackers
could wreak havoc with the networked objects we use every day. Smart devices permeate our homes
and offices. Smoke detectors, thermostats, sprinklers, and physical access controls can be operated
remotely. Virtual assistants, televisions, baby monitors, and children’s toys collect and send data to
the cloud. (One of the latest toy breaches, involving CloudPets teddy bears, is now the subject of a
congressional inquiry.) Some smart technologies can save lives, such as medical devices that control
intravenous drug doses or remotely monitor vital signs.
The problem is that many IoT devices are not designed or maintained with security as a priority.
According to a recent study by IBM Security and the Ponemon Institute, 80% of organizations do not
routinely test their IoT apps for security vulnerabilities. That makes it a lot easier for criminals to use
IoT devices to spy, steal, and even cause physical harm.
Some observers attribute the failure to the IoT gold rush, and are calling for government to step in to
regulate smart devices. When it comes to cybersecurity, however, regulation can be well-intentioned
but misguided. Security checklists that are drafted by slow-moving government bodies can’t keep up
with evolving technology and hacking techniques, and compliance regimes can divert resources and
give a false sense of security. Add up all the different federal, state, and international agencies that
claim a piece of the regulatory pie, and you get a mishmash of overlapping requirements that
can confuse and constrain companies — but leave hackers plenty of room to maneuver.
The Obama administration pushed regulatory proposals for cybersecurity infrastructure in its early
years, but eventually pivoted to a more effective risk-management approach. This was embodied by
the widely acclaimed National Institute of Standards and Technology (NIST) Cybersecurity
Framework, which was developed in collaboration with the industry and provides risk-based
guidance and best practices that can be adapted to an organization of any size or profile. Early signs
are that the Trump administration plans to continue the NIST approach.
A wise next step would be to build on that success and develop a similar framework for IoT. Rather
than trying to dictate specific controls for a diverse, growing set of technologies, the framework could
harmonize international best practices for IoT and help companies prioritize the most important
security strategies for their organization. This is essentially what the bipartisan Commission on
Enhancing National Cybersecurity recommended to the new administration in December. A
framework could also serve as a much-needed coordination point for a number of fragmented IoT
efforts currently under way in federal agencies.
VIDEO AVAILABLE ONLINE
TO VIEW, PLEASE VISIT THIS ARTICLE AT HBR.ORG
It would be a mistake, however, for the IoT industry to wait for governments to step in. The problem
is urgent, and it will become even more so as new IoT attacks come to light, as they certainly will. IoT
providers can demonstrate that they are serious about security by taking some basic steps.
COPYRIGHT © 2017 HARVARD BUSINESS SCHOOL PUBLISHING CORPORATION. ALL RIGHTS RESERVED.
3
First, security and privacy should be incorporated into design and development. Most security
testing of IoT devices occurs in the production phase, when it is too late to make significant changes.
Planning and investment up front can go a long way. For example, many IoT devices share default
user names and passwords that are well known and can be found with a quick Google search. Because
most consumers do not change those settings, products should be designed to ship with unique
credentials, or require users to set new credentials upon first use. This would thwart the easiest and
most widespread method of compromising IoT devices. Just last fall, hackers used known factory
credentials to infect thousands of DVRs and webcams with the Mirai botnet, which was used to cause
massive internet outages.
Second, IoT devices should be able to receive software updates for their entire life span. New
software vulnerabilities are often discovered after a product is released, making security patching
critical to defend against threats. If there are limits to the length of time that updates can reasonably
be provided, then the product should be clearly labeled with an “expiration date,” past which
security will no longer be maintained.
Third, transparency to consumers should be improved. Unlike mobile phones and computers, IoT
devices often operate without human supervision or visibility. Many of these objects lack screens to
display messages. As with other types of product recalls, owners need to be notified when the device
has a security issue and told how to apply security updates. When IoT devices are resold, there
should be a simple way to conduct a factory reset to erase data and credentials. For example, IBM
Security recently demonstrated how sellers of used cars can retain access to vehicles’ remote
functions (like geolocation) without buyers being aware.
It is still early days in the world of IoT, but it’s a fast-moving world, with billions of new devices being
connected every year. And the window on building a trustworthy ecosystem is closing. Will others
follow the Austrian hotel’s example, disconnecting when their devices, and their trust, are breached?
The IoT industry should not wait to find out. We can either invest now in securing that trust, and
safely enjoy the benefits of this remarkable technology, or we can expect hackers to wreak more
havoc and governments to intervene in a heavy-handed manner.
Andrew Tannenbaum, IBM’s first chief cybersecurity attorney, is the founder and leader of a global legal team that
guides the company on a wide range of cybsersecurity legal, policy, and investigative matters. Working closely with IBM’s
chief security officers and senior business leaders, he provides advice on areas extending from IBM’s overall corporate
governance for managing cyber risk, to the company’s response to sensitive cyber incidents, to the operational details of
IBM’s internal cyber program and policies. He has overseen hundreds of cyber incident response investigations
worldwide.
COPYRIGHT © 2017 HARVARD BUSINESS SCHOOL PUBLISHING CORPORATION. ALL RIGHTS RESERVED.
4
Copyright of Harvard Business Review Digital Articles is the property of Harvard Business
School Publication Corp. and its content may not be copied or emailed to multiple sites or
posted to a listserv without the copyright holder’s express written permission. However, users
may print, download, or email articles for individual use.
Journal of
Information
Systems
Education
Volume 29
Issue 1
Winter 2018
Teaching Case
Security Breach at Target
Miloslava Plachkinova and Chris Maurer
Recommended Citation: Plachkinova, M. & Maurer, C. (2018). Teaching Case: Security Breach
at Target. Journal of Information Systems Education, 29(1), pp. 11-20.
Article Link: http://jise.org/Volume29/n1/JISEv29n1p11.html
Initial Submission:
Accepted:
Abstract Posted Online:
Published:
31 January 2017
26 October 2017
12 December 2017
21 March 2018
Full terms and conditions of access and use, archived papers, submission instructions, a search tool,
and much more can be found on the JISE website: http://jise.org
ISSN: 2574-3872 (Online) 1055-3096 (Print)
Journal of Information Systems Education, Vol. 29(1) Winter 2018
Teaching Case
Security Breach at Target
Miloslava Plachkinova
Department of Information and Technology Management
University of Tampa
Tampa, FL 33606, USA
mplachkinova@ut.edu
Chris Maurer
McIntire School of Commerce
University of Virginia
Charlottesville, VA 22903, USA
maurer@virginia.edu
ABSTRACT
This case study follows the security breach that affected Target at the end of 2013 and resulted in the loss of financial data for
over 70 million customers. The case provides an overview of the company and describes the reasons that led to one of the biggest
security breaches in history. It offers a discussion on Target’s vendor management processes and the vulnerability at Fazio
Mechanical Services that was among the main causes of the breach. Further, the case introduces the incident response plan
implemented by Target and discusses the aftermath of the attack. The lessons learned describe some of the steps the company
took to mitigate risks in the future and to strengthen its security posture. While the breach had a significant impact on Target, the
organization was able to fully recover from it and develop best practices that are now widely implemented by other retailers. The
case is suitable for both undergraduate and graduate students enrolled in information security or information systems courses that
discuss vendor management, security incident response, or general security program administration topics.
Keywords: Information assurance & security, Cybersecurity, Case study, Teaching case, Experiential learning & education
1. INTRODUCTION
There are numerous definitions of information security, but
many of them revolve around achieving confidentiality,
integrity, and availability of the information and/or systems
(Anderson, 2003; Dhillon and Backhouse, 2000; Sumra,
Hasbullah, and AbManan, 2015; Von Solms and Van Niekerk,
2013). These goals are important, as they provide trust and
guarantee the safety of data in motion and data at rest.
Within the retail industry, information security is critical
as it ensures that the organizations follow best practices and
can protect the personal and financial information of the
customers. As Greig, Renaud, and Flowerday (2015) point
out, a focus on employee behavior is vital since an
“organization’s success or failure effectively depends on the
things that its employees do or fail to do” (Da Veiga and Eloff,
2010). Security culture has the potential to play a significant
role in this respect (Vroom and Von Solms, 2004). A strong
and effective security culture is in place when every employee
performs daily tasks in a secure manner and such secure
behavior is considered to be ‘the norm’ (Von Solms, 2000).
11
Demonstrating a strong security posture is especially
important for retail companies because they rely on having
positive brand recognition and gaining the customers’ trust. A
security breach at a big retail company can also have a domino
effect and potentially impact many other corporations in a
negative way. Thus, understanding the critically important
factors in building a strong security culture and following best
practices is essential for any retail company.
2. MOTIVATION
The authors’ motivation to write this case study comes from
the need to incorporate real world examples into the
cybersecurity curriculum. While it is important for students to
master terminology and have solid foundational knowledge,
the authors believe they should also be able to apply the
knowledge to actual organizational settings where information
security issues arise. There has been a myriad of breaches
affecting a wide range of companies and individuals (Home
Depot, JP Morgan Chase, Ashley Madison, the Office of
Personnel and Management, eBay, Sony, and Hillary Clinton),
Journal of Information Systems Education, Vol. 29(1) Winter 2018
but there are relatively few case studies developed solely for
use in the classroom with accompanying learning objectives
and teaching notes. Thus, the authors wanted to explore the
recent security breach at Target due to the abundance of
information available and the various angles from which the
students can approach the topic.
Target’s efforts to improve its security and minimize the risk
of other attacks in the future.
The structure of the presented case study is as follows:
Target’s company profile, the timeline of the events, the
company’s business processes before and after the breach
(including vendor management and incident response), the
investigation, the fallout, and lessons learned.
3. EVALUATION
5. CASE TEXT
After drafting the case text, it was distributed to students in an
information security principles course at a medium-sized,
private university in the US. Thirty eight undergraduate
students were presented with the case text and reflection
questions (provided in the teaching notes). Students’ analyses
of the case and reflection questions were collected as part of a
graded assignment and were evaluated using rubrics to
determine whether students exceeded, met, or did not meet
expectations across various learning objectives. The authors
also provided students with a paper survey that included
several open-ended questions. The authors asked them to
describe what they liked and disliked about the case, whether
any additional information should be provided, whether they
have any suggestions for improvement, and what sources they
used when preparing their analyses. Overall, students provided
very positive feedback on the case write-up. Students
expressed some concern over the discussion of vendor
management processes, and therefore additional detail around
the vendor management processes was added to the case.
In terms of performance against leaning outcomes, the
average grade students received on this assignment was 94%,
which exceeds expectations. More specifically, 1 student did
not meet the expectations (90%). These results indicate that students were
able to successfully perform the case study analysis,
understand and interpret the main issues, and provide feasible
and adequate solutions for improving the security practice at
Target Corp. The authors evaluated the students’ writing
skills, as well as their ability to support their statements with
additional resources, readings, and integrate previous course
content in their analysis. The authors used TurnItIn to avoid
any plagiarism on the assignment, and the grading rubrics
were adapted from the University’s College of Business
recommended rubric for problem solving.
4. CASE SYNOPSYS
At the end of 2013, amid the holiday shopping season, Target
became a victim of a security breach affecting over 70 million
customers. Their personal and financial data was stolen
through a vulnerability in one of Target’s vendors – Fazio
Mechanical Services. The breach was first reported by the
security journalist Brian Krebs, and Target’s official response
came shortly after the announcement. While slightly late, the
company’s incident management was still successful as they
were able to regain the customers’ trust and maintain their
status as a successful retailer. After the attack, Target
implemented several steps to mitigate any future breaches.
The company created a Cyber Fusion Center, provided free
credit card monitoring for its customers, and implemented
POS terminals with chip readers. These steps demonstrate
12
5.1 Company Profile
With its first store opening in Roseville, Minnesota, on May 1,
1962, Target aimed to differentiate itself by providing many
features of traditional department stores but provide low prices
typically associated with discount retailers. The name Target
was chosen purposefully as Stewart Widdess (Director of
Publicity) states “As a marksman’s goal is to hit the center
bulls-eye, the new store would do much the same in terms of
retail goods, services, commitment to the community, price,
value and overall experience” (Target, 2017). The company
went public on October 18, 1967, (under the name “Dayton
Corporation”) and began expanding across the country.
Through various acquisitions and expansions into new areas of
the country, Target has become the second-largest discount
retailer in the United States (behind Walmart). As of February
1, 2014, Target operated 1,793 retail store locations in the
United States, employed approximately 360,000 employees,
and had annual revenues of $72.6 billion (Statista, 2015).
Target’s slogan of “Expect more. Pay less.” embodies
their corporate mission of providing great value to its
customers while maintaining an exceptional shopping
experience. A key component of Target’s strategy for creating
an exceptional experience for both customers and employees
is to always behave ethically and with integrity. Their efforts
to be a responsible corporate citizen have earned various
awards such as inclusion on Fortune Magazine’s “20 Most
Generous Companies of the Fortune 500” and “World’s Most
Admired Companies” lists (Target, 2017).
While Target has worked diligently to position itself as a
leading retailer in the United States with prominent charitable
values, they have certainly experienced hardships throughout
their long history. Notably, in 2013, they suffered a massive
data breach that exposed sensitive financial information for
millions of customers. While the data breach significantly
affected Target’s operations, the company has recovered and
has learned many valuable lessons on the importance of
protecting sensitive information.
5.2 Before the Breach
Like many corporations, Target employed a staff of dedicated
security professionals to implement safeguards to protect
sensitive data. As part of their ongoing security efforts, Target
successfully passed a compliance audit for the Payment Card
Industry Data Security Standard (PCI-DSS) in September of
2013 (Riley et al., 2014). PCI audits involve a review of
critical security controls and systems configurations to verify
that best practices for protecting payment card information on
computer systems is maintained. Target also completed the
implementation of a $1.6 million malware detection tool
developed by the cybersecurity company FireEye in 2013
(Riley et al., 2014). Their security operations center, with
Journal of Information Systems Education, Vol. 29(1) Winter 2018
teams of personnel in Minneapolis, Minnesota, and Bangalore,
India, provided round-the-clock monitoring of cybersecurity
threats on the network. While there is no method for ensuring
complete protection against cybersecurity threats, Target
appeared to be following industry best practices and had
reasonable security controls in place.
5.3 Breach Notification and Initial Response
On November 30, 2013, security operations personnel in
Bangalore, India, received a notification from their malware
detection software that some potentially malicious activity was
recorded on the network. The alert was shared with security
personnel in Minneapolis, but no further action was taken.
Another alert was raised on December 2, 2013, but again no
action was taken (Riley et al., 2014). It was not until
December 12, 2013, when the U.S. Department of Justice
contacted Target about a possible data breach on their
network, that Target began investigating the issue in earnest.
The Federal Bu…
Purchase answer to see full
attachment