Data Breach At The U.s. Office Of Personnel Management Essay

Towards the end of 2013, OPM began to upgrade their cybersecurity polices. They added new tools and capabilities to various networks throughout their agency. The results of the new security upgrades, OPM was able to identify two different cybersecurity incidents on its systems. May of 2015 OPM discovered that their system has been under attack. Information such as background investigation records of current, former, and prospective Federal employees and contractors were stolen. After an extensive forensics investigation, it was determined that the types of information in these records include identification information such as Social Security Numbers, educational history, employment history, information about immediate family and other personal

This case study, written in 2009 is not the only case where a major data breach has occurred within organizations. In the late 2011 Sony’s PlayStation Network (PSN) was breached impacting up to 77 million user’s accounts including data on names, address and possibly credit card details. In late 2013 Target had a cyber-attack that compromised a large quantity of its data and had 110 million accounts compromised. Finally in September 2014 Apple had their iCloud server breached by hacking that compromised all the users of the online server. These occurrences still have some unanswered questions and several experts have yet to decipher the actual reason as to why the security breach occurred.

Following the US and Israeli Stuxnet attack on Iran’s Nuclear program in 2010, enemy states have been targeting some critical infrastructures and federal government agencies. As the US interest in securing its borders against all threats both domestic and abroad continue to grow, several new threats and vulnerabilities colossus in its cyberspace. In a recent report by Bhattacharyya (2016), “Russian hackers attacked the State Department email system and the Office of Personnel Management reported that 5.6 million Americans’ fingerprints were stolen as

The Department of Homeland Security (DHS) is Incharge of shielding our country’s crucial infrastructure from physical and cyber dangers. Of the varied kinds of infrastructure, cyberspace is crucial constituting the information regarding the government and business operations, crisis management and readiness information, and our crucial digital and process control systems. Safeguarding these critical resources and infrastructure is

National Institute of Standards and Technology (NIST) and Federal Information Security Management Act of 2002 (FISMA) were established to provide a set of standards, guidelines to assist all federal agencies in executing the FISMA and to assist in managing cost-effective programs to protect organization’s information and information systems. NIST founded on March 03, 1901 and now headquartered Gaithersburg, Maryland. Founded by U.S. Congress, NIST was established to impose general measurement standards laboratory; it is a non-regulatory agency of the United States Department of Commerce. The fledgling agency quickly assembled standards for electricity, length and mass, temperature, light, and time, and created a system to transfer those

Cyberterrorism is a critical threat and is the most definitive characteristic of the U.S. contemporary security environment. For years, the American people have been victimized by cyber-attacks by having their personal information, emails, credit card, and banking information stolen by an invisible enemy named cyberterrorism. These types of attacks seem insignificant however; they are small examples of the vulnerabilities that our cyber world is experiencing. Our vulnerabilities are leaving our public officials in significant danger from cyber-attacks, as they are vulnerable to such things as the release of personal information and home addresses.

The Target data breach remains one of the most notable breaches in history, it was the first time a CEO of a major corporation was fired due to a security event. The breach received an enormous amount of attention, it caused corporations and individuals to change the way they think about information security and data protection. Between Thanksgiving and Christmas 2013 hackers gained access to 40 million customer credit cards and personal data of 70 million Target customers. The intruders slipped in by using stolen credentials and from there gained access to vulnerable servers on Targets network to launch their attack and steal sensitive customer data from the POS cash registers. All this occurred without a response from Targets security operations center, even though security systems notified them of suspicious activity. The data was then sold on the black market for an estimated $53 million dollars. However, the cost to Target, creditors, and banks exceeded half of a billion dollars. This report will review how the infiltration occurred, what allowed the breach to occur including Targets response, and finally who was impacted by the security event.

On December 15, 2013, Target released a statement confirming that malware had been installed and that most of it eliminated. Accordingly, reports indicated that Fazio computer approved the proposal of project management and the intruders’ compromised agreement publicizing to the company reportedly, the report reads. Besides, media reports indicated victimization of Fazio for phishing email comprising the malware Target used for installing another malware on the system of target, together with Target’s Point of Sale (POS) system used in recording transactions of cards and all payments. Cybercrime or internet hacking, according to Computer Crime Research Center Aghatise E. Joseph, is an internet crime committed using a computer as a tool or a victim targeted. Notably, it is much challenging to categorize general internet crimes into distinct groups since most cybercrimes evolve on a daily basis.

This report was due to the leak of classified document by Edward Joseph Snowden, a former contractor for the CIA (Central Intelligence Agency) and former worker of the NSA (National Security Agency) through subcontractor Booz Allen Hamilton, a tech consulting firm. Based in the NSA's Oahu office, Edward Snowden was a system administrator as described by intelligence officials. As a system administrator, Snowden action of whistle blowing can be analyzed from different angle with different perspective. The impact of his act on the intelligence gathering itself was devastating. According to Keith Alexander, former NSA director, what Snowden has uncovered has brought about irreversible and noteworthy harm to the United States and its allies (Ackerman and Rushe, 2013). By discussing the harm caused by Snowden leaking the classified documents, we will be evaluating the damage that can be caused by unethical act done by a system administrator. Later on, the impact and reform that Snowden whistle blowing brought to system administration will be

The first attempts to breach OPM’s network were recorded in March 2014 (Bisson). They were thwarted by intrusion detection systems on the network. No personally identifiable information was thought to be

Target to the Office of Personnel Management—the private sector and government equally feel the after-effects of data breaches. Data breaches can result in lawsuits from the affected victims. Lawsuits continue to harm a company’s finances and reputation long after the data breach occurs.

People across the world are becoming disproportionately dependent on modern day technology, which results in more vulnerability to cyber-attacks including cybersecurity breaches. Today, the world continues to experience inordinate cases of cybersecurity meltdowns. There is a rapid growth in complexity and volume of cyber-attacks, and this undermines the success of security measures put in place to make the cyberspace secure for users. Cyber-attacks on both private and public information systems are a major issue for information security as well as the legal system. While most states require government organizations and certain federal vendors to report incidences of data breaches, no equivalent legislation exists to cover private entities.

Cyberterrorism, cyber campaigns, and cyber-warfare are all considered forms of cyber-attacks. Therefore, the spectrum of cyber-attacks will employ the gamut from computer viruses to data hacking targeting individual computers to organizations infrastructures and networks. These attacks have become more sophisticated and dangerous. McLaughlin (2011) Portends that international concern has intensified due to recent cyber-attacks. McLaughlin (2011), Stated that governments that known for being hostile could launch computer-based attacks on critical systems which are national and regional (McLaughlin, 2011). These systems include energy distribution, telecommunications, and financial services (McLaughlin, 2011).

This paper examines the Office of Personnel Management (OPM)’s widely reported data breach and the mismanagement leading up to the breach. Explains how adhering to the fundamental principles of security practice: the Confidentiality, Integrity and Availability (CIA triad), combined with risk management policies we have learn in the previous weeks, as well as incorporating the importance of organizational culture that could lead to a path of preventative cybersecurity. Later in the paper we will examine further on the fundamentals of security practice that would create strong cyber defense posture.

Security breaches and incidents cost business an average of $2.7 million each year (White, 2014). With this we see a giant financial impact of breaches also increase. Since 2013 the financial impact has increased 34% up until 2014 (White, 2014). While attacks on national stats were also increase by 86% in 2014 with the targets primarily focusing on gas and oil, aerospace and defense, technology, and telecommunications sector (White, 2014). While attacks on these targets are usually the result of competitors within their fields.