Docsity
Log inSign up
Docsity
Prepare for your exams
Prepare for your exams

Study with the several resources on Docsity

Earn points to download
Earn points to download

Earn points by helping other students or get them with a premium plan

Guidelines and tips
Guidelines and tips
Sell on Docsity
Sell on Docsity
Log inSign up

Prepare for your exams

Study with the several resources on Docsity

Find documents

Prepare for your exams with the study notes shared by other students like you on Docsity

Search Store documents

The best documents sold by students who completed their studies

Search through all study resources
Docsity AINEW

Summarize your documents, ask them questions, convert them into quizzes and concept maps

Explore questions

Clear up your doubts by reading the answers to questions asked by your fellow students

Earn points to download

Earn points by helping other students or get them with a premium plan

Share documents
download point icon20 Points

For each uploaded document

Answer questions
download point icon5 Points

For each given answer (max 1 per day)

All the ways to get free points
Get points immediately

Choose a premium plan with all the points you need

Study Opportunities

Choose your next study program

Get in touch with the best universities in the world. Search through thousands of universities and official partners

Community

Ask the community

Ask the community for help and clear up your study doubts

University Rankings

Discover the best universities in your country according to Docsity users

Free resources

Our save-the-student-ebooks!

Download our free guides on studying techniques, anxiety management strategies, and thesis advice from Docsity tutors

From our blog

Exams and Study
Go to the blog

Data Security Assignment, Assignments of Cybercrime, Cybersecurity and Data Privacy

University of Petroleum and Energy StudiesCybercrime, Cybersecurity and Data Privacy

Assignment for Data Security regarding a case study

Typology: Assignments

2020/2021

Uploaded on 11/17/2021

NarayanMurali
NarayanMurali 🇮🇳

5

(3)

3 documents

1 / 5

Toggle sidebar

This page cannot be seen from the preview

Don't miss anything!

bg1
DATA SECURITY
ASSIGNMENT 1
Case Study: Chatter
Company Overview
Fledgling social media platform, ‘Chatter’ launched in September 2017. Its main users are 13-21 year olds.
Users can:
Share photos and post status updates
Send messages via a private chat
Play games with other users, and make in-app purchases
Their head office is in Birmingham, and they employ 30 people. All staff members have a staff pass to enter
the building, and have a company iPhone and laptop. All staff have received an email outlining the best
practice for cyber security but this was not read by everyone and staff have not undertaken any mandatory
training.
Background Information
Chatter’s recent cyber security incident
A staff member left their laptop on the train while commuting home. The laptop was picked up by someone
and they were able to gain access to it. Fortunately, the member of staff had reported it missing and the
laptop was remotely wiped. Chatter cannot be sure if any data was accessed before the laptop was remotely
wiped.
Important Government Regulations
GDPR - General Data Protection Regulation
As of Spring 2018, changes to GDPR came into force, designed to better protect consumer and personal data.
Any organization holding data must:
Gain consent from the consumer to process their data
Anonymize the data collected to protect privacy
Provide data breach notifications
Safely handle the transfer of data across borders. Transferring data outside Europe. The GDPR imposes
restrictions on the transfer of personal data outside the European Union, to third-party countries or
international organizations, to ensure that the level of protection of individuals afforded by the GDPR is
not undermined.
Require certain companies to appoint a data protection officer to oversee GDPR compliance
If these rules are not followed, then companies face hefty fines of up to €20million.
Simultaneously In the News
News 1: Facebook says almost 50 million of its users were left exposed by a security flaw.
pf3
pf4
pf5

Partial preview of the text

Download Data Security Assignment and more Assignments Cybercrime, Cybersecurity and Data Privacy in PDF only on Docsity!

DATA SECURITY

ASSIGNMENT 1

Case Study: Chatter Company Overview Fledgling social media platform, ‘Chatter’ launched in September 2017. Its main users are 13-21 year olds. Users can:  Share photos and post status updates  Send messages via a private chat  Play games with other users, and make in-app purchases Their head office is in Birmingham, and they employ 30 people. All staff members have a staff pass to enter the building, and have a company iPhone and laptop. All staff have received an email outlining the best practice for cyber security but this was not read by everyone and staff have not undertaken any mandatory training. Background Information Chatter’s recent cyber security incident A staff member left their laptop on the train while commuting home. The laptop was picked up by someone and they were able to gain access to it. Fortunately, the member of staff had reported it missing and the laptop was remotely wiped. Chatter cannot be sure if any data was accessed before the laptop was remotely wiped. Important Government Regulations GDPR - General Data Protection Regulation As of Spring 2018, changes to GDPR came into force, designed to better protect consumer and personal data. Any organization holding data must:  Gain consent from the consumer to process their data  Anonymize the data collected to protect privacy  Provide data breach notifications  Safely handle the transfer of data across borders. Transferring data outside Europe. The GDPR imposes restrictions on the transfer of personal data outside the European Union, to third-party countries or international organizations, to ensure that the level of protection of individuals afforded by the GDPR is not undermined.  Require certain companies to appoint a data protection officer to oversee GDPR compliance If these rules are not followed, then companies face hefty fines of up to €20million. Simultaneously In the News News 1: Facebook says almost 50 million of its users were left exposed by a security flaw.

The company said attackers were able to exploit a vulnerability in a feature known as “View As” to gain control of people's accounts. The breach was discovered on Tuesday, Facebook said, and it has informed to the police. Users that had potentially been affected were prompted to re-log-in on Friday. “The flaw has been fixed”, wrote the firm’s vice-president of product management, Guy Rosen, adding all affected accounts had been reset, as well as another 40 million ‘as a precautionary step’. Facebook - which saw its share price drop more than 3% on Friday - has more than two billion active monthly users. The company has confirmed to reporters that the breach would allow hackers to log in to other accounts that use Facebook's system, of which there are many. This means other major sites, such as AirBnB and Tinder, may also be affected. The firm would not say where in the world the 50 million users are, but it has informed Irish data regulators, where Facebook's European subsidiary is based. The company said the users prompted to log-in again did not have to change their passwords. "Since we’ve only just started our investigation, we have yet to determine whether these accounts were misused or any information was accessed. We also don’t know who is behind these attacks or where they’re based. He added: "People’s privacy and security is incredibly important, and we’re sorry this happened." The company has confirmed that Facebook founder Mark Zuckerberg and its chief operating officer Sheryl Sandberg were among the 50 million accounts affected. News 2: XBOX Live and Play-station Attack: Christmas Ruined for Millions Millions of people could not use their games consoles for a second day as disruption on the Xbox Live and Sony Play-station networks continued after an apparent cyber-attack. A group calling itself Lizard Squad claimed responsibility for bringing down both networks on Christmas Eve, which could have affected nearly 160 million gamers. Even an intervention by eccentric internet entrepreneur Kim Dotcom, who offered the hackers free lifetime use of his file storage service, does not appear to have ended the attack. Known as a distributed denial of service, or DDOS, the attack is overloading the systems of both services by generating fake access requests….. ….Sony has not responded to requests for comment. Its official Twitter account repeatedly responded to users’ complaints with the same message, but did not acknowledge an attack: “We are aware that some users are unable to access at the moment. Our technicians are working to fix this issue.” The official PSN status was listed as “offline” at the time of writing, while Xbox Live is “limited”. Microsoft would not comment on the cause of network problems but a spokesman told the Guardian: “We are aware some users are unable to sign in to Xbox Live. Our teams are working to resolve the issue. Visit xbox.com/support for status updates.” The news is damaging for Microsoft but particularly for Sony, which suffered a high profile hack in early December by a group called Guardians of Peace. Stolen emails were leaked and published, revealing embarrassing exchanges between executives and celebrities, while stolen files and even film scripts left the company so exposed it has reportedly reverted to using fax machines and paper in its offices…. News 3: Superdrug Targeted by Hackers who claim to have 20,000 customer details Superdrug has advised its online customers to change their passwords after the high street chain was targeted by hackers claiming to have stolen the personal details of thousands of people. The health and beauty retailer told customers it had been contacted by a group on Monday evening claiming to have obtained the details of 20,000 customers, including names, addresses, date of birth and phone numbers. Superdrug said in the email to customers the company had only seen evidence so far that 386 of the accounts had been compromised. A spokeswoman said: “The hacker shared a number of details with us to try to prove he had customer information – we were then able to verify they were Superdrug customers from their email and log- in.”... ...Superdrug is the latest high street retailer to report a data breach. Last month Dixons Carphone said

But since news spreads like wildfire, Chatter’s reputation would be damaged and soon the company would have to be shut down because of the number of security issues that it would face, no one would use the application since they would have to take the risk of their data getting stolen. But in time, if Chatter manages to put in proper security regulations in place, train their employees to be aware about security issues, strengthen their application’s security, they can stand up against attacks from hacker groups. Q3. Based on News 3: What are the issues with hackers gaining personal details? Ans. The most prominent reason why hacker want personal information is for monetary gain. They gain access/hack the database of organizations and they have multiple ways of gaining money – either by leaking the information on the internet to scare the organization into giving them money or by selling the customer details on the black market sites to get money in return for the details. Black market sites sell this data to the highest bidder, the buyers of which can use this information to impersonate one or many of the customers to steal money from their personal bank accounts. There are many ways hacker groups utilize to gain money or even wage a personal vendetta against an organization - since they can be former employees who were wrongly done by the organization they are targeting. Q4. Based on News 4: Is this just a case of the individual customer making a mistake, or could it reveal a training need for Barclays’ staff? Ans. The aggrieved individual is at fault here since he posted private information online for the world to see, which for the eyes of a hacker or hacker group is what they require the most – information – which they can leverage to gain money or personal revenge. Personal information pertaining to your bank accounts and other information should not be posted on social media platforms so casually as it can be misused by hackers to send spam and phishing mails, which to an everyday person without much knowledge of cyber security and information security is a very risky move. That being said, the social media team of the bank is also to blame since they were not prompt at removing the customer’s public post about his grievance which also revealed his personal information. If it had been removed quickly, the damage done to the user could have been restricted till there. Q5. After a recent minor cyber security threat in Chatter, they are looking to improve their cyber security and are looking for a cyber security specialist to help. PwC (A Cyber Security Firm) are in competition with other firms to be selected by Chatter to help them. Consider that you are part of the PwC Cyber Team and have to prepare a pitch proposal to Chatter from PwC which could resolve their cyber security threats. You will have to prepare a pitch proposal to Chatter that outlines:

**1. Chatter’s cyber risks - which one of the threats do you think Chatter should focus on first?

  1. Which team you think Chatter needs to help them improve their Cyber Security and why.** (Team Choices that we have at PwC: Core Advisory Team; Ethical Hackers Team; Crisis Team; Cyber Threat Team; Identity and Access Management Team) Ans.

1. Chatter is a fairly new organization that has been facing security issues since they don’t have a proper framework, policies and procedures in place. End user security issues are fairly less as compared to employee related issues since the employees are not properly trained to handle company provided devices and following a basic standard of security protocols while using company issued or any device. So one of the threats that Chatter should focus on is employee awareness. Training employees on following a basic standard of security protocol while handling company issued devices and handling the data properly needs to be incorporated into the protocols of the organization. Being aware of spam, phishing and scam emails, social engineering and strong password rules is important for every employee so that any small loopholes are covered from the employee end. 2. The team needed to help improve Chatter’s cyber security is a Core Advisory Team : The services provided by the Core Advisory Team are:  Assessing and measuring their exposure to cyber security risk  Developing a strategy and vision for tackling cyber security  Designing and implementing the secure IT systems a client needs to be secure  Designing and putting in place security training and awareness programmes  Gaining experience of security operations and incident response Since such initial issues faced by Chatter are solved by the services provided by this team, it’s the most appropriate team to incorporate into the cyber security department of this company.