Reference no: EM133756685

Homework: Activity- Privacy Laws & Compliance Control

Overview

A major security breach that happened within the federal government is the Office of Personnel Management (OPM) data breach, which exposed a large amount of personally identifiable information (PII) of federal and state employees. The effects of this breach are still being explored, and the full extent is still not known. This breach has become an important learning experience. Examining laws that suggest controls to minimize the possibility of data breaches is a crucial part of developing an adversarial mindset and will help with future instances of data breaches. There are numerous articles and research papers on the OPM breach, but the article provided in the prompt explores the breach from the employee perspective and discusses the steps that could have been used to help minimize the possibility of a data breach.

The critical controls defined by the Center for Internet Security (CIS) are used as guidelines for processes that a company can incorporate for data security. The controls are used to determine compliance to a standard put forth by the organization. They are meant to be used as an adaptive tool that will allow an organization to evaluate compliance to a known risk-mitigation level.

You have been preparing for this homework by summarizing privacy laws and determining who is responsible for ensuring compliance to the law within an organization. It is important that you complete this homework in your own words. Express your own ideas on how the laws and controls can be applied to this breach. It is the responsibility of a security analyst to be able to explain breaches and the controls used to mitigate issues.

Listed below are the privacy laws you are familiar with and the critical controls you will be learning about to help you complete this activity.

1) Privacy Laws
2) Americans With Disabilities Act, Section 508
3) Cable Communications Policy Act (1984)
4) Census Confidentiality Act
5) Children's Internet Protection Act (CIPA)
6) Children's Online Privacy Protection Act (COPPA)
7) Computer Security Act
8) Driver's Privacy Protection Act (1994)
9) E-Government Act (2002)
10) Electronic Communications Privacy Act (1986)
11) Federal Information Security Management Act (FISMA)
12) Freedom of Information Act (1966)
13) Gramm-Leach-Bliley Act
14) Health Insurance Portability and Accountability Act (HIPAA)
15) Health Information Technology for Economic and Clinical Health (HITECH) Act
16) Mail Privacy Statute (1971)
17) Payment Card Industry Standards
18) Privacy Act (1974)
19) Red Flags Rule
20) Sarbanes-Oxley Act
21) State Data Breach Notification Laws
22) U.S. Constitution
23) USA Patriot Act
24) Wiretap Act (1968, Amended)
25) CIS Controls
26) Inventory and Control of Hardware Assets
27) Inventory and Control of Software Assets
28) Continuous Vulnerability Management
29) Controlled Use of Administrative Privileges
30) Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
31) Maintenance, Monitoring, and Analysis of Audit Logs
32) Email and Web Browser Protections
33) Malware Defenses
34) Limitation and Control of Network Ports, Protocols, and Services
35) Data Recovery Capabilities
36) Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches
37) Boundary Defense
38) Data Protection
39) Controlled Access Based on the Need to Know
40) Wireless Access Control
41) Account Monitoring and Control
42) Implement a Security Awareness and Training Program
43) Application Software Security
44) Incident Response and Management
45) Penetration Tests and Red Team Exercises

Prompt

Before you begin working on this homework, read the article Inside the Cyberattack That Shocked the US Government and review the CIS Controls website. Then address the following:

1) Briefly summarize (in one to two paragraphs) the major issues with the OPM breach and how it occurred.

2) Select two of the privacy laws provided above and describe how they relate to the OPM breach.

3) Determine to what extent jurisdiction plays a role in the application of your selected laws.

4) Identify which law or laws would have required OPM to report their breach, and the steps the organization needs to take to report the issues.

5) Select four of the CIS controls provided above that could have been monitored to help minimize the possibility of the breach. Explain why monitoring these controls would have helped minimize the breach.