Regardless of industry, organizations are responsible to protect and secure their customers' information. Information management is the process of protecting an organization's data in terms of:
Classification and handling.
Privacy.
Document and records management.
Sensitive physical information.
To reduce the risk of customer information being jeopardized, organizations often establish a separation of duties to ensure employees only have access to the information they need to do their jobs. Organizations need to abide by several U.S. privacy laws and regulations to be in compliance and to protect consumers.
write a 2-3 page paper in which you:
Research an organization that has violated U.S. privacy laws and regulations.
Diagnose how the system failed.
Examine how the organization rebounded from the violation.
Recommend measures to prevent the violation from occurring or to reduce the risk.
Determine key lessons learned.
Provide citation
Sample Answer
In the modern digital economy, data is a central asset. Organizations are tasked with managing this asset through rigorous classification, privacy controls, and records management. When these systems fail, the consequences are not merely financial but involve the compromise of sensitive physical and digital identities. The 2017 breach of Equifax, one of the three largest credit reporting agencies in the United States, serves as a landmark case of how a failure in information management leads to catastrophic violations of U.S. privacy standards.
The Equifax breach, which exposed the personal information of approximately 147 million people, was not the result of a sophisticated, "unstoppable" attack. Rather, it was a failure of proactive information management and a breakdown in the Separation of Duties (SoD).
Failure in Patch Management: The primary entry point for attackers was a known vulnerability in the Apache Struts web framework. Although a patch had been released months prior, Equifax failed to update their systems. This represents a failure in classification and handling, as the organization did not prioritize the security of the servers holding highly sensitive consumer data.