Question 1

The employees at iPremier all performed well except for Bob Turley, CIO. In this case, even having one employee not perform well, meant that the company overall performed poorly. The overnight or third shift had an immediate response to the attack by taking the initiative to call the CIO at 4:30 am to inform him about the malicious incident and to drive down to the data center because no one on the Qdata phone was being helpful.
Bob Turley should have pulled the plug much sooner. He had been working at iPremier for nearly three months and should have been aware of the company’s limited hacker defense capabilities. That awareness would have meant that iPremier was very vulnerable to anything beyond the most basic cyber-attacks. There was suspicion that the hackers could be stealing credit card information, yet he left the system up and running. The plug was only pulled after the legal counsel advised him to do so. Every second waiting to pull the plug could have been more and more damaging to the company, customers, and employees. A worst case scenario must be assumed in such a vulnerable situation.
Another mishap was when Bob told an employee not to call the police because it could hurt the stock price. The stock price should not have been Bob’s most pressing concern considering law enforcement has resources available to assist iPremier in identifying or defending against the attack. There was also precious time wasted by waiting for his boss to call before Bob finally asked him to contact Qdata for assistance.

Question 2

The attack shed light on the various vulnerabilities iPremier had. Because people are the first line of defense in information security, Bob Turley should be discharged and replaced with a more competent CIO (Baltzan, 2015). The relationship with Qdata needs to be reevaluated. They had vulnerabilities as well, but the strong