...The article, Hackers Steal Card Data from Neiman Marcus, was written in an attempt to inform readers of the incident regarding a data breach attack that occurred at Neiman Marcus, the high end brick and mortar retail store, which was detected in mid-December. In response to inquiries about a data breach which involved consumer’s payment card information, Neiman Marcus acknowledged that it is working with the United States Secret Service to investigate a breach that has exposed an unidentified number of customers (Krebs, 2014). Krebs’ Sources from the financial industry reported that there have recently been a rising number of fraudulent payment card charges that were occurring at numerous stores; however the common point of purchase for the fraudulent activity was at Neiman Marcus. The author then proceeded to contact Neiman Marcus, seeking conformation of if there was a breach or not. Ginger Reeder, Spokesperson for Neiman Marcus, explained that a lot of the information on the breach is unknown, because the forensics team that was hired has not completed their investigation on the breach; however she mentioned that there is no evidence that online customers were also affected by the data breach. Eventually Neiman Marcus released a formal disclosure which notified clients that the company was contacted by its credit card processor to notify the, that there was a possibility of fraudulent payment card activity that occurred subsequent to client purchases at their stores. Neiman...
Words: 2330 - Pages: 10
...Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Case Study: Critical Controls that Could Have Prevented Target Breach In December 2013 over 40 million credit cards were stolen from nearly 2000 Target stores by accessing data on point of sale (POS) systems. This paper will explore known issues in the Target breach and consider some of the Critical Controls that could have been used to both prevent this breach and mitigate losses. AD Copyright SANS Institute Author Retains Full Rights Case Study: Critical Controls that Could Have Prevented Target Breach GIAC (GSEC) Gold Certification Author: Teri Radichel, teri@radicalsoftware.com Advisor: Stephen Northcutt Accepted: August 5th 2014 Abstract In December 2013 over 40 million credit cards were stolen from nearly 2000 Target stores by accessing data on point of sale (POS) systems. This paper will explore known issues in the Target breach and consider some of the Critical Controls that could have been used to both prevent this breach and mitigate losses. From what is known about the Target breach, there were multiple factors that led to data loss: vendors were subject to phishing attacks, network segregation was lacking, point of sale systems were vulnerable to memory scraping malware and detection strategies employed by Target failed. A possible...
Words: 8983 - Pages: 36
...Theft of Information Robert M Polstra III Kennesaw State University 2004 Westwood Rd Smyrna, GA 30080 404-641-8937 rpolstra@hotmail.com ABSTRACT 1. INTRODUCTION This paper shows the importance that management plays in the protection of information and in the planning to handle a security breach when a theft of information happens. Recent thefts of information that have hit major companies have caused concern. These thefts were caused by companies’ inability to determine risks associated with the protection of their data and these companies lack of planning to properly manage a security breach when it occurs. It is becoming necessary, if not mandatory, for organizations to perform ongoing risk analysis to protect their systems. Organizations need to realize that the theft of information is a management issue as well as a technology one, and that these recent security breaches were mainly caused by business decisions by management and not a lack of technology. After counter-terrorism and counter-intelligence, cyber crime is the third highest priority for the U.S. Federal Bureau [4]. With the rise of the theft of information and the lure of big profits for this stolen information, it is necessary for information systems to have the ability to protect this valuable asset. It is estimated that a credit card number unsupported by any other documentation is worth $10, and a credit history report retails for $60 [2]. Recent breaches of information systems...
Words: 3469 - Pages: 14
...Privacy and Security Rules. Even after providing education to health care workers on proper HIPPA practices, there continues to be intended and unintended breaches especially in hospital settings. In 2010, New York-Presbyterian Hospital (NYP) and Columbia University (CU) health care system was under investigation for an accidental release of electronic medical records for 6,800 individuals. The incident impacted the health care industry because it was largest HIPPA settlement to date. At the time, U.S. News and World Reports NYP health care system as number one in the state and number six in the nation. The HIPPA Privacy Rule protects the “privacy of individually identifiable health information”; while the HIPPA Security Rule “sets national standard for the security of electronic protected health information”, and the HIPPA Breach Notification Rule requires business to notify of a “breach of unsecured protected health information” (HHS, 2014). Basically these rules are to protect the privacy of the patients’ health information. It says who can look at and receives information about the individuals. It gives the patients reassurance that their health information is safe and secure. The ethical and legal issues of the article The issue of the article is that “a physician employed by CU who developed applications for both NYP and CU attempted to deactivate a personally owned computer server on the network containing NYP patient electronic protected health information (ePHI)”...
Words: 1095 - Pages: 5
...Privacy and Security Rules. Even after providing education to health care workers on proper HIPPA practices, there continues to be intended and unintended breaches especially in hospital settings. In 2010, New York-Presbyterian Hospital (NYP) and Columbia University (CU) health care system was under investigation for an accidental release of electronic medical records for 6,800 individuals. The incident impacted the health care industry because it was largest HIPPA settlement to date. At the time, U.S. News and World Reports NYP health care system as number one in the state and number six in the nation. The HIPPA Privacy Rule protects the “privacy of individually identifiable health information”; while the HIPPA Security Rule “sets national standard for the security of electronic protected health information”, and the HIPPA Breach Notification Rule requires business to notify of a “breach of unsecured protected health information” (HHS, 2014). Basically these rules are to protect the privacy of the patients’ health information. It says who can look at and receives information about the individuals. It gives the patients reassurance that their health information is safe and secure. The ethical and legal issues of the article The issue of the article is that “a physician employed by CU who developed applications for both NYP and CU attempted to deactivate a personally owned computer server on the network containing NYP patient electronic protected health information (ePHI)”...
Words: 1104 - Pages: 5
...Question 1: Discuss vicarious liability and cyber-liability Vicarious liability is the principle of law that holds one party liable for the acts or inactions of another (Beyer, 2006). The concept means that a party maybe held responsible for injury or damage even when he or she was not actively involved in the incident. Under the specific type of fault required or complicity rule, vicarious liability will only be found if the employer authorized or ratified the conduct or the manner in which the particular task was performed or empowered the employee for example by making him or her a manager or recklessly hired or retained an employee that was unfit for the particular job. The existence of vicarious liability can be justified on both legal or policy grounds and organizational management grounds. There are reasons for the application of vicarious liability in legal or policy. First reason is the wrongful act of the employee are so closely related to their duties that they can be properly and fairly regarded as being within the course of employment. Second there is the business risk rationale, that it is an inevitable part of commercial life that agents and employees may act beyond their authority and instructions causing damage to a third party. Employers have calculated and accepted this risk thus incurring legal liability. Given that an employer generally benefits from the work undertaken by its employees it is not unreasonable that it also bear any losses that those activities...
Words: 2528 - Pages: 11
...Security Breach at TJX 1. Identify & describe the failure points in TJX's security that requires attention (including, but not limited to: People, Work Process, and Technology)? After analyzing the Ivey case on TJX data fiasco, I would say there were three major failure points that caused this $168MM financial hit to the corporation. * Technology: it is obvious that TJX had several technology deficiencies mainly driven by systems limitations and vulnerability. For example, inadequate wireless network security allowed the hackers to attack specific stores just by using a laptop and an antenna which permitted the thieves access to the central database. As it was mentioned in the business case, TJX was using (WEP) as the security protocol and it is well-known in the e-commerce arena that WEP encryption can be deciphered in less than one minute which makes it very unreliable and risky for business transactions. Last but not least, TJX failed to encrypt customer data. * Auditors: it is concerning that TJX passed a PCI DSS check up and that non auditor noticed the technology issues TJX was facing. * Executives at TJX: It is evident that the company wasn’t in compliance with the Payment Card Industry (PCI) standards. Primarily, the person in charge of the IT department should have been on top of ensuring TJX to be in compliance, by setting expectations and objectives pertained to security within its organization. In addition to the head of IT, I...
Words: 826 - Pages: 4
... The organization information system is backbone of organizational operational and functional units, the malware can produce potential threat to organization image, the establishment of an effective security measures and reassessment of organizational risk management approaches in order to cater with latest implication trend in network security. This report is based on literature review, analytical analysis of case studies, news articles magazines to highlight vulnerability and implication of malware attack to an organization, highlights the salient features of malware attack, malware attacks that can significantly hurt an enterprise information system, leading to serious functional commotions, can result into destructing the basic IT security up to identity theft, leakage of data, stealing private information, corporate information system blue prints, industrial white papers and networks break down. The only constant in the world of technology is a change, report highlights the latest trends, dimension and implication of malware attack and new critical source of threats, within the perspective of constantly changing IT world (e.g. cloud services-integration) Enterprise may not effectively device and manage malware threat and 'risk assessment processes. This report highlight the malware propagation process, malware vulnerability, the types of malware, optimistic cost effective solution in order to minimize security risk for an Enterprise information systems. This Report...
Words: 3648 - Pages: 15
... The issue is patient privacy” previous regulations had required a practice to notify affected patients and the federal government only if it determined that a breach involving patient records had occurred and that it carried a significant risk of financial or reputational harm to patients”. “Which raised concerns from privacy advocates that practices should not have the discretion to determine those matters” (Lubell, Jenifer, HIPPA gets tougher on physicians, February 4, 2013 www.amednews.com/APPS/PBCS.DLL/PERSONALIA?ID=JLUBELL). This issue has had and impact on physicians, “under the new privacy rules doctors must assume the worst case scenario in the event of a possible privacy breach”. “Now any incident involving patient records is assumed to be a breach, unless a practice conducts a risk assessment that proves a low probability that any protected information was compromised the breach must be reported”(Lubell, Jenifer, HIPPA gets tougher on physicians, February 4, 2013 www.amednews.com/APPS/PBCS.DLL/PERSONALIA?ID=JLUBELL). The argument that is being used is that “some of the largest security breaches have involved business associates of plans, doctors, and other professionals”.” An analysis of large data breaches reported to the department of health and human services finds that personal health information may be most at risk when in the hands of a third party business associate hired to perform functions that require access to the patient data” (Dolan, Pamela, Blame...
Words: 1272 - Pages: 6
...Running head: CYBER-ESPIONAGE AND INTELLECTUAL PROPERTY THEFT 1 Cyber-espionage and Intellectual Property (IP) theft: An overview of the rising threat and the potential responses by both the U. S. Government and U.S. Businesses Matthew Doyal Kennesaw State University Spring 2014 IS 8200 – Legal & Ethical Issues in IS CYBER-ESPIONAGE AND INTELLECTUAL PROPERTY THEFT Abstract 2 Society and business have become increasingly dependent upon data in the constantly connected world where everything that is said and done online leaves behind a massive ever-growing bread-crumb trail of information. With this ever larger quantity of data being transmitted on a range of devices as well as third party service providers being increasingly relied upon to store it; the threat of loss of confidential and sensitive data continues to expand exponentially (Online Trust Alliance, 2014, p. 3). “Breaches and data loss incidents have become a fact of life for organizations of every size and throughout the public and private sectors” (Online Trust Alliance, 2014, p. 4) making no organization immune. Given the growth of data and, therefore, data breaches the threat to the U.S. economy and individual U.S. businesses from trade secret theft is real and growing, therefore; a multi-pronged approach must be implemented by the public and private sectors alike. “Businesses must do their part to harden their cyber defenses, but the “take-home message here is that protecting IP from ‘them’ is an...
Words: 2645 - Pages: 11
...qwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmrtyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmrtyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmrtyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnmrtyuiopasdfghjklzxcvbnmqwer...
Words: 1570 - Pages: 7
...Anti-monopoly Analysis of Tencent QQ vs. 360 Dispute Weiwei Hu and Yimeei Guo School of Law., Xiamen University; 361005, China helusi420hw@163.com, ymguo@xmu.edu.cn Abstract. Anti-monopoly concerns are becoming more and more frequent for Internet industries competiting all over the world. This paper makes a case analysis of Tencent QQ vs. 360 dispute, then has some further thought from such dispute.Finally, it is hoped by this paper that China’s Anti-monopoly Law be healthily and perfectly enforced in the future. Keywords: Anti-monopoly, Internet industries, Case analysis. 1 Introduction Anti-monopoly concerns are becoming more and more frequent for Internet industries competiting all over the world.For example, in February 2011,Apple launched a new service that allows for magazine and newspaper subscriptions for its popular devices, might draw claim from publishers that Apple dominates the market for consumer tablet computers and that it has allegedly used that commanding position to restrict competition.[1] Also in February 2011,Hudong.com, an online encyclopedia, is alleging that Baidu unfairly blocks its Web pages from search results in favor of its own encyclopedia service, Baidu Baike.[2] On April 1,2011, Microsoft plans to file a complaint with the European Commission demanding action against competitor Google on competition law grounds. Microsoft claims that Google stops other companies from accessing the information needed to run effective search operations.[3]...
Words: 4229 - Pages: 17
...Jenkins, J. L., Grimes, M., Proudfoot, J. G., & Lowry, P. B. (2014). Improving Password Cybersecurity through inexpensive and minimally invasive means: Detecting and deterring password reuse through keystroke-dynamics monitoring and just-in-time fear appeals. Information Technology for Development, 20(2), 196-213. doi:10.1080/02681102.2013.814040 This study attempts to create an algorithm to detect password reuse and determine if warning messages concerning their dangers will deter password reuse. The researchers created a test website where 135 students were asked to create a password. Then randomly selected students were shown a warning message about the dangers of password reuse. Their keystroke timing was recorded. They were asked to complete a questionnaire to determine if they created unique passwords initially and after receiving the warning. The researchers found they could detect unique passwords. They also found that only 4.45% of users created a unique password initially while 88.41% created a unique password after receiving the warning message. The article is well written with sound research. However, the premise of the research is troubling. The authors cite a study of over 500,000 users showing they have on average...
Words: 1948 - Pages: 8
...$55 Million Dollar Data Breach at ChoicePoint Abstract Personal data breaches have become epidemic in the U.S. where innocent citizens sensitive information is being left unprotected and subsequently disseminated between hackers. ChoicePoint is an organization that is a premier data broker and credentialing service in the industry. The company was guilty of failing to fulfil their own policy of thoroughly evaluating prospective customer organizations which resulted in a major breach. The source of this failure will be evaluated as well as possible solutions. The punishment and repercussions will be evaluated for appropriateness and the reactions of the organization will be scrutinized for potential effectiveness. The root cause of the ChoicePoint data breach stemmed from the organizations failure to enforce their own policy of verifying the legitimacy of customers. The direct failure involved an inadequate background check which provided hackers with customer accounts. The hacker’s then utilized the accounts to illegally access databases and steal confidential data. There is a personal-data-loss database that contains data on regarding more than 900 breaches in the U.S. which is made up of more than 300 million personal records. Analysis of this database illustrated that 81% of the breaches were committed by malicious outsiders. This value relates specifically to records that were vulnerable to being stolen by identity thieves. Further this value illustrates...
Words: 1067 - Pages: 5
...HIPPA: Security and Privacy Audits | MIS565 | | | | Abstract Companies who work with patient health care information are required to comply with the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). As such, the HHS rolled out a new audit initiative to assess compliance across the nation with the privacy and security standards for protected health information This paper focus on how the audit program of HIPPA works, what the covered entity can do to prepare for the audit, and what happens once the audit is complete. Introduction Ever since implementation of the HIPAA privacy and security standards, entities have been required to establish and maintain a variety of compliance mechanisms, including written policies and procedures, training of responsible workforce members, business associate agreements, relevant notices to patients or plan participants, and health plan document amendments. Until now, most compliance actions have been complaint-driven investigations arising from alleged violations of the HIPAA privacy or security standards (Arant, 2011). Pursuant to the HITECH Act, a more robust enforcement program was created to make a more ???? The U.S. Department of Health & Human Services' Office for Civil Rights (OCR) administers HIPAA (including the HITECH amendments) by investigating complaints, enforcing rights, promulgating regulations, developing policy and providing...
Words: 1705 - Pages: 7
