Impact Of Data Breaches On Users Necessitated Emergence Of State And Federal Laws

Harris, S. (2006, November 5). Developing an information security program using SABSA, ISO 17799. Retrieved September 19th, 2015, from

“The Federal Information Processing Standards Publication Series of the National Institute of Standards and Technology (NIST) is the official series of publications relating to standards and guidelines adopted and promulgated under the provisions of Section 5131 of the Information Technology Management Reform Act of 1996 (Public Law 104-106) and the Federal Information Security Management Act of 2002 (Public Law 107-347)” ("FIPS PUB 199," 2004). In this paper, FIPS PUB 199 has been chosen as the security standard used by State of Maryland Department of information technology. This standard addresses to develop standards for categorizing information and information systems. On the other hand, ISO/IEC 27001 is the other standard not used by State of Maryland which has been discussed as a contrast standard.

Another step involves security checks upon implementation and describes agency-level threat to the business scenario or the mission. It similarly entails sanctioning the information system for processing and lastly constant monitoring of the security controls. FISMA and NIST's standards are aimed at offering the ways for agencies to achieve their identified missions with safety commensurate with the threat (United States Department of Agriculture, 2015). Together with guidelines from the Office of Management and Budget (OMB), FISMA and NIST create a framework for advancing and growing an information security scheme (SecureIT, 2008). Such framework includes control descriptions and evaluation, program development, and system certification and accreditation. The final objective involves conducting daily functioning of the agency and achieving the agency's articulated objectives with sufficient security commensurate with risk.

According to Whitman and Mattord (2010), The ISO 27000 series is one of the most widely referenced security models. Referencing ISO/IEC 27002 (17799:2005), the major process steps include: risk assessment and treatment, security policy, organization of information security, asset management, human resources security, physical and environmental security, communications and operations management, access control, information systems acquisition, development, and maintenance, information security incident management, business continuity management, and compliance

The guidelines of NIST 800-30 lay out a step-by-step process on how to ensure security measures for an organization. This very publication addresses information

The safeguard of patient health information and consumer information is effectively and sufficiently guarded is the upmost importance to any organization. Information security is important because it the law. Any deficiency of an effective information security program can be costly to an organization and be detrimental to patients and consumers. Organizations must be aware of the growing opportunities for breaches in security as technology is advancing is making the collection, maintenance, and dissemination of protected health information easier (Sayles, 2013). The following two security breaches will identify threats, and provide a security plan for the organization.

One of the biggest challenges for implementing to concepts of security policy framework in the healthcare industry is following the requirements of HIPPA. Under HIPPA regulations there are two principles that must be followed; Standards for the privacy of Individually Identifiable Health Information (HIPPA Privacy rule) and the Security Standards for Individually Identifiable Health

Cyber security, also referred to as information technology security, focuses on protecting computers, networks, software programs and data from unintended or unauthorized access, change or destruction. Post 9/11 and other terrorist attacks, the United States grows its endeavors to repulse cyberattacks, U.S. corporate organizations and the government agencies wind up in strife over how to adjust to new methods of security and privacy. The current state of security measure protocols and privacy policies placed by the US government in cyberspace raises concerns for the 99%. This is due to the recent cyber-attacks on American corporate organization systems and government alike, where their digital information and network infrastructures within the systems were compromised, and personal data was hacked and stolen.

Through the Federal Information Security Management ACT (FISMA) it was made mandatory that organizations would have to develop standards that would be in compliance with federal regulations that were put into place. Because of this the Federal Information Processing Standards Publication (FIPS) 199 and FIPS 200 were put into place in order to establish a set of standards for organizations so that they could determine what their category would be for their systems (NIST, 2012). In order to enforce the security categories from FIPS-200, the NIST SP 800-53 would be utilized in order to set in place a security control

“The cyber security landscape has changed in the past couple of years – and not for the better” (Steen, 2013). Banks are faced with attacks to retrieve customer account information, the military battles with attempts to obtain secrets. These attacks are not just committed by induvial hackers but entire countries. Data privacy rules differ from country to country. For example, Fisher, 2014 states individual search engine access is restricted in different ways depending on the country. China along with other countries restrict access to politically sensitive information, while the United States protects the free flow of information (Gonzalez-Padron, 2014). With companies relying more on technology such as cloud computing and virtual storage their level of vulnerability rises. IT personnel have the difficult task of protecting company data, this is why it is vital to have an ethical compliance program in place protect the organization from internal and external threats.

The analysis of 2,260 breaches and more than 100,000 incidents at 67 organizations in 82 countries shows that organizations are still failing to address basic issues and well-known attack methods. The (DBIR, 2016) shows, for example, that nearly two-thirds of confirmed data breaches involved using weak, default or stolen passwords. Also shows that most attacks exploit known vulnerabilities that organizations have never patched, despite patches being available for months – or even years – with the top 10 known vulnerabilities accounting for 85% of successful exploit “Organizations should be investing in training to help employees know what they should and shouldn’t be doing, and

A security administrator can look to the Information Technology- Code of Practice for Information Security Management, ISO 17799/BS 7799 as well as ISO 17799/BS 7799, the NIST Security Models including the SP 800-12, 14, 18, 26, and 30, and the VISA International Security Model are just a few of the established security frameworks available.

People across the world are becoming disproportionately dependent on modern day technology, which results in more vulnerability to cyber-attacks including cybersecurity breaches. Today, the world continues to experience inordinate cases of cybersecurity meltdowns. There is a rapid growth in complexity and volume of cyber-attacks, and this undermines the success of security measures put in place to make the cyberspace secure for users. Cyber-attacks on both private and public information systems are a major issue for information security as well as the legal system. While most states require government organizations and certain federal vendors to report incidences of data breaches, no equivalent legislation exists to cover private entities.

a significant amount of data security breaches are due to either employee oversight or poor business process. This presents a challenge for businesses as the solution to these problems will be far greater than simply deploying a secure content management system. Business processes will need to be examined, and probably re-engineered; personnel will need to be retrained, and a cultural change may be required within the organization. These alone are significant challenges for a business. A recent example of what is probably unintentional featured an Australian employment agency’s web site publishing “Confidential data including names, email addresses and passwords of clients” from its database on the public web site. An additional

Database security is vital for any and every organization which uses databases. Without proper security, the databases can be breached and the breaches can lead to confidential information being released. This has happened to many organizations whether they are large or small; for example, in the past few years Target and Sony both fell victim to database breaches. To make matters worse both Target and Sony were actually warned about the flaws in their security, but neither took any action to resolve the flaws. Looking into these breaches and how they were handled could lead to designing better databases. Organizations should also look within themselves to assure all employees know good security practices. Simply following regular procedures such as installing antivirus software and firewalls can help create more secure databases. An organization should look at all of their databases to ensure the same top level security is established for all of their databases.