CSIA 300 University of Maryland Global Data Breach Incident Analysis Report Research Read / Review the readings for Weeks 1, 2, 3, and 4. Research the type

CSIA 300 University of Maryland Global Data Breach Incident Analysis Report Research
Read / Review the readings for Weeks 1, 2, 3, and 4.
Research the types of insurance coverage that apply to data breaches. Pay attention to the security measures required by the insurance companies before they will grant coverage (“underwriting requirements”) and provisions for technical support from the insurer in the event of a breach. Here are three resources to help you get started.
https://woodruffsawyer.com/wp-content/uploads/2019/06/40842_Woodruff-Sawyer-Cyber-Buying-Guide_Final.pdf
https://www.travelers.com/cyber-insurance
https://wsandco.com/cyber-liability/cyber-basics/
Read / Review at least 3 of the following documents about the Marriott International / Starwood Hotels data breach and liability lawsuits.

Autopsying the Marriott Data Breach: This is why insurance matters

Don't use plagiarized sources. Get Your Custom Essay on

CSIA 300 University of Maryland Global Data Breach Incident Analysis Report Research Read / Review the readings for Weeks 1, 2, 3, and 4. Research the type

For $10/Page 0nly

Order Essay

https://www.insurancejournal.com/news/national/2018/12/03/510811.htm
https://www.jlt.com/en-bh/insurance-risk/cyber-insurance/insights/marriott-breach-to-test-insurance-response
https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/statement-intention-to-fine-marriott-international-inc-more-than-99-million-under-gdpr-for-data-breach/
https://info.starwoodhotels.com/?gclid=EAIaIQobChMInfbpwazJ5AIV0gOGCh0J1wP_EAAYASAAEgIZQPD_BwE&gclsrc=aw.ds
http://starwoodstag.wpengine.com/wp-content/uploads/2019/05/us-en_First-Response.pdf
https://www.consumer.ftc.gov/blog/2018/12/marriott-data-breach
https://news.marriott.com/2019/07/marriott-international-update-on-starwood-reservation-database-security-incident/
https://www.hayesconnor.co.uk/marriott-data-breach/
Find and review at least one additional resource on your own that provides information about data breaches and/or best practices for preventing and responding to such incidents.
Using all of your readings, identify at least 5 best practices that you can recommend to Padgett-Beale’s leadership team as it works to improve its data breach response policy and plans.
Specific types of data involved in the Starwood Hotels data breaches and the harm
Findings by government agencies / courts regarding actions Starwood Hotels / Marriott International should have taken
Findings by government agencies / courts regarding liability and penalties (fines) assessed against Marriott International.
Write

Write a three to five (3-5) page report using your research. At a minimum, your report must include the following:

1.An introduction or overview of the problem (cyber insurance company’s audit findings regarding the company’s lack of readiness to respond to data breaches). This introduction should be suitable for an executive audience and should explain what cyber insurance is and why the company needs it.

2.An analysis section in which you discuss the following:

A review of best practices which includes 5 or more specific recommendations that should be implemented as part of Padgett-Beale’s updated data breach response policy and plans. Your review should identify and discuss at least one best practice for each of the following areas:people, processes, policies and technologies. (This means that one of the four areas will have two recommendations for a total of 5.)
A closing section (summary) in which you summarize the issues and your recommendations for policies, processes, and/or technologies that Padgett-Beale, Inc. should implement.
Submit for Grading

Submit your research paper in MS Word format (.docx or .doc file) using the Research Report #1 Assignment in your assignment folder. (Attach your file to the assignment entry.)

Additional Information
To save you time, a set of appropriate resources / reference materials has been included as part of this assignment. You must incorporate at least five of these resources into your final deliverable. You must also include one resource that you found on your own

Please utilize the student example as an outline. It should be similar but not exactly the same. CSIA 300: Cybersecurity for Leaders and Managers
Research Report #1: Data Breach Incident Analysis and Report
Scenario
Padgett-Beale Inc.’s (PBI) insurance company, CyberOne Business and Casualty Insurance Ltd,
sent an audit team to review the company’s security policies, processes, and plans. The auditors found
that the majority of PBI’s operating units did not have specific plans in place to address data breaches
and, in general, the company was deemed “not ready” to effectively prevent and/or respond to a major
data breach. The insurance company has indicated that it will not renew PBI’s cyber insurance policy if
PBI does not address this deficiency by putting an effective data breach response policy and plan in
place. PBI’s executive leadership team has established an internal task force to address these problems
and close the gaps because they know that the company cannot afford to have its cyber insurance policy
cancelled.
Unfortunately, due to the sensitivity of the issues, no management interns will be allowed to
shadow the task force members as they work on this high priority initiative. The Chief of Staff (CoS),
however, is not one to let a good learning opportunity go to waste … especially for the management
interns. Your assignment from the CoS is to review a set of news articles, legal opinions, and court
documents for multiple data breaches that affected a competitor, Marriott International (Starwood
Hotels division). After you have done so, the CoS has asked that you write a research report that can be
shared with middle managers and senior staff to help them understand the problems and issues arising
from legal actions taken against Marriott International in response to this data breach in one of its
subsidiaries (Starwood Hotels).
Research
1. Read / Review the readings for Weeks 1, 2, 3, and 4.
2. Research the types of insurance coverage that apply to data breaches. Pay attention to the security
measures required by the insurance companies before they will grant coverage (“underwriting
requirements”) and provisions for technical support from the insurer in the event of a breach. Here
are three resources to help you get started.
a. https://woodruffsawyer.com/wp-content/uploads/2019/06/40842_Woodruff-SawyerCyber-Buying-Guide_Final.pdf
b. https://www.travelers.com/cyber-insurance
c. https://wsandco.com/cyber-liability/cyber-basics/
3. Read / Review at least 3 of the following documents about the Marriott International / Starwood
Hotels data breach and liability lawsuits.
a. https://www.thesslstore.com/blog/autopsying-the-marriott-data-breach-this-is-whyinsurance-matters/
b. https://www.insurancejournal.com/news/national/2018/12/03/510811.htm
1
Copyright ©2020 by University of Maryland Global Campus. All Rights Reserved
CSIA 300: Cybersecurity for Leaders and Managers
c. https://www.jlt.com/en-bh/insurance-risk/cyber-insurance/insights/marriott-breach-totest-insurance-response
d. https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/statementintention-to-fine-marriott-international-inc-more-than-99-million-under-gdpr-for-databreach/
e. https://info.starwoodhotels.com/?gclid=EAIaIQobChMInfbpwazJ5AIV0gOGCh0J1wP_EA
AYASAAEgIZQPD_BwE&gclsrc=aw.ds
f. http://starwoodstag.wpengine.com/wp-content/uploads/2019/05/us-en_FirstResponse.pdf
g. https://www.consumer.ftc.gov/blog/2018/12/marriott-data-breach
h. https://news.marriott.com/2019/07/marriott-international-update-on-starwoodreservation-database-security-incident/
i. https://www.hayesconnor.co.uk/marriott-data-breach/
4. Find and review at least one additional resource on your own that provides information about data
breaches and/or best practices for preventing and responding to such incidents.
5. Using all of your readings, identify at least 5 best practices that you can recommend to PadgettBeale’s leadership team as it works to improve its data breach response policy and plans.
Write
Write a three to five (3-5) page report using your research. At a minimum, your report must include the
following:
1. An introduction or overview of the problem (cyber insurance company’s audit findings regarding the
company’s lack of readiness to respond to data breaches). This introduction should be suitable for
an executive audience and should explain what cyber insurance is and why the company needs it.
2. An analysis section in which you discuss the following:
a. Specific types of data involved in the Starwood Hotels data breaches and the harm
b. Findings by government agencies / courts regarding actions Starwood Hotels /
Marriott International should have taken
c. Findings by government agencies / courts regarding liability and penalties (fines)
assessed against Marriott International.
3. A review of best practices which includes 5 or more specific recommendations that should be
implemented as part of Padgett-Beale’s updated data breach response policy and plans. Your review
should identify and discuss at least one best practice for each of the following areas: people,
processes, policies and technologies. (This means that one of the four areas will have two
recommendations for a total of 5.)
4. A closing section (summary) in which you summarize the issues and your recommendations for
policies, processes, and/or technologies that Padgett-Beale, Inc. should implement.
2
Copyright ©2020 by University of Maryland Global Campus. All Rights Reserved
CSIA 300: Cybersecurity for Leaders and Managers
Submit for Grading
Submit your research paper in MS Word format (.docx or .doc file) using the Research Report #1
Assignment in your assignment folder. (Attach your file to the assignment entry.)
Additional Information
1. To save you time, a set of appropriate resources / reference materials has been included as part of
this assignment. You must incorporate at least five of these resources into your final deliverable.
You must also include one resource that you found on your own.
2. Your research report should use standard terms and definitions for cybersecurity. See Course
Content > Cybersecurity Concepts for recommended resources.
3. Your research report should be professional in appearance with consistent use of fonts, font sizes,
margins, etc. You should use headings to organize your paper. The CSIA program recommends that
you follow standard APA formatting since this will give you a document that meets the “professional
appearance” requirements. APA formatting guidelines and examples are found under Course
Resources > APA Resources. An APA template file (MS Word format) has also been provided for your
use.
4. You are expected to write grammatically correct English in every assignment that you submit for
grading. Do not turn in any work without (a) using spell check, (b) using grammar check, (c) verifying
that your punctuation is correct and (d) reviewing your work for correct word usage and correctly
structured sentences and paragraphs.
5. You are expected to credit your sources using in-text citations and reference list entries. Both your
citations and your reference list entries must follow a consistent citation style (APA, MLA, etc.).
3
Copyright ©2020 by University of Maryland Global Campus. All Rights Reserved
Data Breach Incident Analysis & Report
Revised Edition
Research Report #1: Data Breach Incident Analysis & Report
UMUC CSIA 300 Cybersecurity for Leaders and Managers
Olufemi Akinyemi
Professor Nedim Goren
December 7, 2019
1
Data Breach Incident Analysis & Report
Introduction
An audit is part and parcel of almost all companies. Following the recent audit review of
Padgett-Beale Inc.’s security plans, processes, and policies by the insurance firms known as the
CyberOne Business and Casualty Insurance Ltd, the report indicates that they were unpleasant
discoveries. Padgett-Beale Inc operation units lack dedicated plans to address its data breach.
Moreover, it was discovered that the company requires proper plans to respond or prevent the
event of data breaches that it may experience. The insurance company maintains that the firm’s
insurance policy will not be renewed if the discoveries are not handled through implementing
effective data breach response plans and policies. Companies are required to have cyber
insurance policies covering first and third party risks involved in conducting business online.
This policy covers, among other privacy issues, including intellectual property infringement and
virus attacks that are passed through internet connections (Floresca, 2016). The business that
operates a business online and in an event where the data breach is inevitable. Companies that
acquire and share customer information on an online platform are required to have cyber
insurance that covers third party liabilities.
Lack of cyber insurance implies that Padgett-Beale Inc will bear the responsibility of data
breach or any compromise that may be incurred by the company. These liabilities include paying
for investigations and loss of business as well as the loss of information due to legal retrieval
fees and crisis management (Floresca, 2016). However, these will be a sole responsibility to
Padgett-Beale Inc. having an insurance cover ensures that the insurance company shoulders such
liabilities. Therefore, this implies that cybersecurity is indeed another layer that ensures business
2
Data Breach Incident Analysis & Report
continuity and should be treated with great care to keep business operational. Importantly, the
company is aware that it needs such security measures and is working on getting the coverage.
Therefore, the different levels of management, including senior and middle management, should
understand issues or problems relating to findings from the insurance company, among other
multiple data breaches in the court and the competition that competition experienced by the
company.
Analysis
Specific Type of Data involved in the Wyndham Worldwide Data Breaches and the Harm
There are several data included in the Wyndham worldwide data breaches and harm.
Wyndham did not meet the cyber security standards set by FTC. According to FTC, Wyndham
did not implement information security procedures required prior to establishing connection with
the “local computer network” to “corporate-level networks” (King & Spalding LLP, 2015). The
Wyndham also failed to keep “reasonable security measures” to check access to its computers
that were deemed unauthorized and also did not conduct the necessary security investigation.
The FTC also claims that Wyndham failed to address security vulnerabilities on servers that they
were already aware of and that it also did not make use of readily available security measures,
for example, firewalls. Wyndham also failed to manage the devices and also “did not maintain an
inventory of computers connected to the network (King & Spalding LLP, 2015).” Therefore, the
type of data exposed by the hackers includes credit card information that was stored in the
readable text in the company servers. The data breach also exposed user passwords and login
details, as well as the company inventories stored in the servers and its network.
3
Data Breach Incident Analysis & Report
Wyndham stored payment card information using clear and readable text. The system
used by the company also allowed easily guessable passwords used in accessing property
management systems (SmithDebnam, 2019). The company also failed to implement security
measures that are readily available such as a firewall that is meant to limit or control access to its
property management system, its corporate network, and the internet at large (JimGroup, 2015).
Wyndham also failed its security oversight role of ensuring that the hotel has adequate
information security measures in place, including procedures and policies. Third-party vendors
had easy access to the company network and servers. They failed to implement measures that
will help in not only detecting but also preventing unauthorized access to the computer networks
or carry out security investigations (SmithDebnam, 2019). Moreover, the company failed to
implement procedures that would ease the incidence response. The company was unable to
implement routine checks of its system for malware, and evaluation of its security breach shows
that the three incidences of hacking used a similar method to access the company’s credit card
information.
Findings of the Court Regarding Actions Wyndham Should Have Taken
The above list shows that Wyndham worldwide hotel broke the inventory of violation as
“Section 5 of the FTC Act-“getting involved in deceptive or unfair trade practices. Wyndham
should have taken the following action, as revealed by the court. One, the Wyndham should have
made sure that “their managers and licensors follow the standards set by the FTC as part of their
duties, and bear the cost if they do not act according to these measures (King & Spalding LLP,
2015).” Secondly, “Wyndham should have had a data breach response plan in place and know
how to implement it (King & Spalding LLP, 2015).”
4
Data Breach Incident Analysis & Report
Also, Wyndham should have used strong passwords and login IDs rather than using
default passwords. They should also change the passwords periodically and, more
fundamentally, should not have shared login credentials with third parties or anyone. The court
also maintained that Wyndham should have encrypted their sensitive data and also installed
security measures such as “firewalls between their systems and networks and the internet (King
& Spalding LLP, 2015).” Finally, according to the court findings, Wyndham should have
correctly installed security patches, regularly updating their software and restricted as well as
monitored vendors or third – party access to their network.
Findings of the Court Regarding Liability and Penalties Assessed Against Wyndham
The court found the “Wyndham to have entered into consent decrees in administrative
cases raising unfairness claims based on inadequate data security (Federal Trade Commission,
2015).” Also, “the court concluded that Wyndham was not entitled to know with ascertainable
certainty that FTC’S interpretation of what the cybersecurity practices were required under the
Act (Federal Trade Commission, 2015).”
Wyndham challenged the FTC authority to implement data security by the end of 2014;
however, this plea was denied. In the subsequent year, the court of appeal upheld the ruling made
by the lower court, which reaffirmed the role that FTC plays in cybersecurity regulations,
particularly in the protection of consumer data. In the year 2012, FTC won the case against
Wyndham since the company failed to take adequate measures to address the security gap
following the data breach that occurred in the year 2008 (Federal Trade Commission, 2015). This
resulted in the other two subsequent breaches involving the loss of credit card data. Overall,
5
Data Breach Incident Analysis & Report
Wyndham failed to implement standards measures to detect or prevent unauthorized access to its
systems and had no incident response procedures in place.
Review of the best practices and recommendations
The company should work towards updating its data breach response policy and
strengthen its plan of maintaining cybersecurity insurance. Other recommended best practices
include implementing adequate cybersecurity encompassing technologies, processes, people, and
policies. Besides having an external information privacy policy for customers, the company
should implement an internal information privacy policy that will include procedures and
practices for its employees (JimGroup, 2015). These practices should focus on maintaining the
privacy of customer information. For example, the company should implement procedures and
practices that support authorized disclosures of customer information while discouraging
unauthorized access. Another recommendation towards ensuring data security is through
maintaining an inventory of the company’s computer system, have an updated list of employees
their access to sensitive data. This is important since it provides the data and information, the
internet system, and the person that can access such resources. Implementing an effective
monitoring process such as watermarking ensures easy tracking and control of information in
case of unauthorized access (Burke, 2019). The company should regularly update its software
and security systems and change its passwords frequently. Enforce regular change of password,
and meeting all the complex requirements coupled with a backup system that are scheduled often
will help to secure data, information, and network system (Federal Trade Commission, 2015).
It is also recommended that the company should focus on achieving security awareness
through the training program. This awareness targets explicitly the employees. In the case of
6
Data Breach Incident Analysis & Report
Wyndham Breach, it is evident that mistakes are more familiar to undertrained employees
(Burke, 2019). Therefore, training on employees should cover critical areas, including practices
and procedures, as well as security and privacy policies involved in collecting, processing,
handling, and storing of customer-related data (Burke, 2019). The company should also take
security training that integrates discussion on cyber risks and threats that the company faces.
It is also recommended that the company should implement data encryption. Currently,
there is a wide variety of encryption technology used to encrypt data in transition and that in rest
(Burke, 2019). Therefore, the company should consider implementing deferent levels of data
encryption at the database and storage level. In the event of a security breach, data or information
is not exposed in readable or plaintext format.
The company should minimize or stop collecting customer data and personal information
that they do not require for legit business purposes. It is essential to understand that businesses
should only collect and store data that they will guarantee security and access to control
(JimGroup, 2015). Accessing data and network security should only be allowed based on the
legitimate request and the requirement. The business should segment its network to ensure that
people only access a specific portion of data that is meant for their job (Federal Trade
Commission, 2015). Moreover, if employees can perform their job with the need to access data,
then such permissions should not be granted.
Conclusion
In summary, Padgett-Beale is under a significant problem to get its insurance policy
renewed. Due to the recent report on the audit report conducted on its security network that
7
Data Breach Incident Analysis & Report
revealed a significant network data breach. A review of the case study and other relevant works
shows that Wyndham did not have a cyber-insurance that lead to multiple consequences and
liabilities following the security data breach. However, the higher and middle management now
understands the need for cyber insurance and are working towards improving their policy and
prevention breach as insurance plans are underway.
The recommendations issued hints on potential benefits that will be realized through
implementing security policies and procedures as technology and programs that emphasize the
security best practices. The recommendation offered includes implementing security and privacy
policies as well as communicating security data requirements to the employees through such
initiatives, including policies, creating awareness through training programs, and identifying the
potential threat and risks that the company data faces. Creating effective awareness and security,
as well as training, helps to understand the information covered and creates awareness on risks
and potential data threats to the company and its data. Avoiding collecting data …
Purchase answer to see full
attachment