Case Study #2: Data Security & Data Loss Prevention

Scenario

Congratulations on successfully completing your first briefing paper for Padgett-Beale! The management interns did so well that the Training Team has asked for your assistance in developing a second training module. The topic for this training module will be “Data Security and Data Loss Prevention for Travelers.”

This training topic was selected after two Padgett-Beale employees had sensitive corporate information and login credentials stolen from their mobile devices while they were traveling. One employee was traveling inside the United States. The other employee was out of the office for two weeks on a multi-country trip. In one case, it appears that the attackers gained access to both a company cellphone and a company-owned laptop. In the other, it appears that the active attack affected an employee’s personal laptop while she was using hotel provided Wi-Fi. This employee was using her personal laptop because her company laptop was in checked baggage (due to FAA and TSA restrictions) and was stolen while in the airline’s baggage handling system.

Fortunately, neither person had stored or accessed customer information from these devices. Both thefts were caught after attackers tried to exploit the stolen login credentials and could not get past the two-factor authentication requirement (security code generated an authenticator application on the employee’s corporate cell phone). During the after action reviews for these incidents, a training gap and a technology gap were identified. A policy gap, with respect to enforcing least privilege and separation of duties was also identified as a potential area of risk (too much access to sensitive data while traveling could exacerbate the risks of data loss).

Your deliverable for this assignment will be a briefing paper that identifies and discusses five or more major issues that employees need to be aware of about this topic (Data Security and Data Loss Prevention for Travelers). After you identify and describe each security or privacy issue, include two to three additional points that employees should know. Try to keep a neutral tone, that is, you should focus on solutions not blame. You should also address the importance of protecting both personal and company owned devices and data while traveling. After you address the issues, identify and discuss at least 5 recommended solutions (include at least one technology solution and one policy solution). See the instructions below for additional information about length, formatting, and citing of sources.

Research

• Review the Week 1, 2, and 3 readings.
• Read these articles about security tips for business travel (both US and foreign travel).
• https://insights.sei.cmu.edu/insider-threat/2017/0…
• https://www.datamotion.com/2015/12/best-practices-…
  
  • https://us.norton.com/internetsecurity-mobile-8-cyber-security-tips-for-business-travelers.html
  • https://www.calyptix.com/top-threats/7-tips-data-security-business-travelers/
  • http://www.redzonetech.net/blog/13-mobile-device-security-tips-foreign-business-travelers-china/
  • http://focus.forsythe.com/articles/55/Mobile-Device-Security-in-the-Workplace-5-Key-Risks-and-a-Surprising-Challenge
• Research how a data loss prevention solution can help prevent data thefts. Begin with these resources:
  • https://www.symantec.com/connect/articles/how-symantec-data-loss-prevention-mobile-works-how-implement
  • https://sierraware.com/blog/?p=212
• Research how two-factor authentication solutions can be used to prevent data thefts by attackers who have stolen a person’s login credentials. Begin with these resources:
  • https://docs.microsoft.com/en-us/azure/multi-factor-authentication/end-user/microsoft-authenticator-app-how-to
  • https://www.google.com/landing/2step/
  • https://www.rsa.com/en-us/products/rsa-securid-suite/rsa-securid-access/securid-software-tokens
• Include in your discussion 3 or more additional technologies that could be implemented to help prevent data thefts originating from a business traveler’s mobile devices.
  • Virtual Private Network
  • Whole Disk Encryption
  • Mobile Device Management (including remote wipe for stolen devices)

Write

Write a 2 page briefing paper in which you present a summary of your research about the topic and your recommendations as to what should be included in the training module. Be choosy about what you include – the total training time available will be 30 minutes. Don’t be too choosy however. Your recommended content should be comprehensive and fully address the training topic.

At a minimum, your briefing paper for this case study must include the following:

1.An introduction to the case scenario and the topic (use the information above)

2.An analysis of the security and privacy issues that includes five or more key points about the topic (“data security and data loss prevention”). Remember to stay focused on business travelers and mobile devices (laptops, tablet computers, cell phones, etc.)

3.Recommendations for 5 or more best practice based actions that managers and employees should take to address the identified security and privacy issues. Include at least one recommendation for a technology based solution (e.g. VPN, Mobile Device Management, Whole Disk Encryption, etc.) Include at least one recommendation for a policy based solution, i.e. implementing access controls based upon least privilege and/or separation of duties.

4.A closing section in which you restate the key issues and your recommendations.

As you write your briefing paper, make sure that you address security issues using standard terms and definitions. See the resources listed under Week 1 and under Course Resources > Cybersecurity Concepts for definitions and terminology.

Submit For Grading

Submit your research paper in MS Word format (.docx or .doc file) using the Case Study #1 Assignment in your assignment folder. (Attach your file to the assignment entry.)

Additional Information

• To save you time, a set of appropriate resources / reference materials has been included as part of this assignment. You must incorporate at least three of these resources into your final deliverable. You must also include one resource that you found on your own.
• Your briefing paper should use standard terms and definitions for cybersecurity. See Course Content > Cybersecurity Concepts for recommended resources.

3.You must include a cover page with the assignment title, your name, and the due date. Your reference list must be on a separate page at the end of your file. These pages do not count towards the assignment’s minimum page count. (An example and template file are available in the LEO classroom. See CSIA_Basic_Paper_Template(APA_6ed,Nov2014).docx file under Content > Course Resources.)

4.Your briefing paper should be professional in appearance with consistent use of fonts, font sizes, margins, etc. You should use headings to organize your paper. The CSIA program recommends that you follow standard APA formatting since this will give you a document that meets the “professional appearance” requirements. APA formatting guidelines and examples are found under Course Resources > APA Resources. An APA template file (MS Word format) has also been provided for your use CSIA_Basic_Paper_Template(APA_6ed,Nov2014).docx.

5.You are expected to write grammatically correct English in every assignment that you submit for grading. Do not turn in any work without (a) using spell check, (b) using grammar check, (c) verifying that your punctuation is correct and (d) reviewing your work for correct word usage and correctly structured sentences and paragraphs.

6.You are expected to credit your sources using in-text citations and reference list entries. Both your citations and your reference list entries must follow a consistent citation style (APA, MLA, etc.).

Follow Rubrics Assesment for grading.

Criteria

Provided an introduction or overview for the case study

20 points

Provided an excellent introduction / overview of the scenario and associated security and privacy issues. The overview was clear, concise, and accurate. Appropriately used information from 3 or more authoritative sources.

18 points

Provided an outstanding introduction / overview of the scenario and associated security and privacy issues. The overview was clear and accurate. Appropriately used information from 2 or more authoritative sources.

16 points

Provided an acceptable introduction / overview of the scenario and associated security and privacy issues. Appropriately used information from authoritative sources.

14 points

Provided an overview or introduction that was lacking in detail. Information from authoritative sources was cited and used in the overview.

9 points

Attempted to provide an introduction but, this section did not address the issues OR the introduction was not well supported by information drawn from authoritative sources.

0 points

The introduction and/or overview section of the paper was missing, off topic or failed to provide an overview of relevant issues as presented in the case.

/ 20

Identification and Analysis of the Issues

25 points

Provided an excellent analysis of 5 or more privacy and security issues relevant to the case study topic. Discussed the relevance of the issues to the case study company and its employees and managers (must incorporate information from scenario as provided in the case study assignment). Appropriately used information from 5 or more authoritative sources.

22.5 points

Provided an outstanding analysis of 4 or more privacy and security issues relevant to the case study topic. Discussed the relevance of the issues to the case study company and its employees and managers (must incorporate information from scenario as provided in the case study assignment). Appropriately used information from 3 or more authoritative sources.

20 points

Provided an acceptable analysis of 3 or more privacy and security issues relevant to the case study topic. Discussed the relevance of the issues to the case study company and its employees and managers (must incorporate information from scenario as provided in the case study assignment). Appropriately used information from authoritative sources.

17.5 points

Provided a discussion that mentioned at least one privacy or security issue relevant to the case study topic. Mentioned the relevance of the issue to the case study company and its employees and managers. Appropriately used some information from authoritative sources.

12.5 points

Attempted to discuss privacy or security issues relevant to the case study topic. But, the discussion missed major points OR the discussion was not well supported by information from authoritative sources.

0 points

Section was missing or not relevant to the case study.

/ 25

Recommendations for Resolving or Addressing the Privacy and Security Issues

20 points

Identified and discussed 5 or more recommendations for actions that the company and its managers / employees should take to address the identified privacy and security issues. The discussion was clear, concise, and accurately represented best practices for privacy and security. Appropriately used information from 3 or more authoritative sources.

18 points

Identified and discussed 4 or more recommendations for actions that the company and its managers / employees should take to address the identified privacy and security issues. The discussion was clear and accurately represented best practices for privacy and security. Appropriately used information from 2 or more authoritative sources.

16 points

Identified and discussed 3 or more recommendations for actions that the company and its managers / employees should take to address the identified privacy and security issues. The discussion included some best practices for privacy and security. Appropriately used information from authoritative sources.

14 points

Mentioned actions that the company and its managers / employees should take to address the identified privacy and security issues. Appropriately used information from authoritative sources.

9 points

Mentioned actions that the company and its managers / employees should take but the discussion missed major points OR, the discussion was not well supported by information from authoritative sources.

0 points

This section was missing or not relevant to the case study topic.

/ 20

Summary and Conclusions

10 points

The closing section provided an excellent summary of the privacy and security issues and the best-practice based recommendations for this case. Appropriately used information from authoritative sources.

8 points

The closing section provided an outstanding summary of the privacy and security issues and the best-practice based recommendations for this case. Appropriately used information from authoritative sources.

7 points

The closing section provided an acceptable summary of the privacy and security issues and best-practice based recommendations for this case. Appropriately used information from authoritative sources.

6 points

The closing section provided a summary of a few issues and at least one recommendation for this case. Appropriately used information from authoritative sources.

4 points

The closing section failed to provide a summary of issues and recommendations for this case. OR, the summary was not well supported by information from authoritative sources.

0 points

Summary or closing section was missing or not relevant to this case study.

/ 10

Professionalism: Use of Cybersecurity Terminology

5 points

Demonstrated excellence in the integration of standard privacy, security, and/or cybersecurity terminology into the briefing paper.

4 points

Provided an outstanding integration of standard privacy, security, and/or cybersecurity terminology into the briefing paper.

3 points

Integrated standard privacy, security, and/or cybersecurity terminology into the briefing paper.

2 points

Used some standard privacy, security, and/or cybersecurity terminology.

1 point

Misused or misdefined standard terminology for privacy, security or cybersecurity.

0 points

Did not integrate standard privacy, security, or cybersecurity terminology into the discussion.

/ 5

Professionalism: Consistent Use and Formatting for Citations and Reference List

5 points

Work contains a reference list containing entries for all cited resources. Sufficient information is provided to allow a reader to find and retrieve the cited sources. Reference list entries and in-text citations are consistently and correctly formatted using an appropriate citation style (APA, MLA, etc.).

4 points

Work contains a reference list containing entries for all cited resources. Sufficient information is provided to allow a reader to find and retrieve the cited sources. One or two inconsistencies or errors in format for in-text citations and/or reference list entries.

3 points

Work contains a reference list containing entries for all cited resources. Sufficient information is provided to allow a reader to find and retrieve the cited sources. No more than 5 inconsistencies or errors in format for in-text citations and/or reference list entries.

2 points

Work has no more than three paragraphs with omissions of citations crediting sources for facts and information. Work contains a reference list containing entries for cited resources. Work contains no more than 10 inconsistencies or errors in format.

1 point

Work attempts to credit sources but demonstrates a fundamental failure to understand and/or consistently apply a professional formatting style for the reference list and/or citations.

0 points

Reference list is missing. Work demonstrates an overall failure to incorporate and/or credit authoritative sources for information used in the paper.

/ 5

Professionalism: Organization & Appearance

5 points

Submitted work shows outstanding organization and the use of color, fonts, titles, headings and sub-headings, etc. is appropriate to the assignment type.

4 points

Submitted work has minor style or formatting flaws but still presents a professional appearance. Submitted work is well organized and appropriately uses color, fonts, and section headings (per the assignment’s directions).

3 points

Organization and/or appearance of submitted work could be improved through better use of fonts, color, titles, headings, etc. OR Submitted work has multiple style or formatting errors. Professional appearance could be improved.

2 points

Submitted work has multiple style or formatting errors. Organization and professional appearance need substantial improvement.

1 point

Submitted work meets minimum requirements but has major style and formatting errors. Work is disorganized and needs to be rewritten for readability and professional appearance.

0 points

No work submitted for this assignment.

/ 5

Professionalism: Execution

10 points

No formatting, grammar, spelling, or punctuation errors.

8.5 points

Work contains minor errors in formatting, grammar, spelling or punctuation which do not significantly impact professional appearance.

7 points

Errors in formatting, spelling, grammar, or punctuation which detract from professional appearance of the submitted work.

6 points

Submitted work has numerous errors in formatting, spelling, grammar, or punctuation. Work is unprofessional in appearance.

5 points

Submitted work is difficult to read / understand and has significant errors in formatting, spelling, grammar, punctuation, or word usage.

0 points

No work submitted for this assignment.

/ 10