Week2Discussion_post2_CYB100_2023

Inc myc case,c Ic choosec Microsoftc andc it’sc veryc interestingc becausec ofc thec numberc ofc

lawsc andc regulationsc theyc carryc withc themc butc it’sc alsoc interestingc becausec thec lawsc

andc rulesc arec vitalc toc ensuringc publicc safetyc andc companyc property.c Ic knowc thatc certainc

companiesc sellc users'c informationc butc neverc privatec information,c thisc comesc intoc ac

privacyc actc wherec companiesc cannotc sharec sensitivec userc informationc andc onlyc thingsc

likec pagesc visitedc orc thingsc youc like.c Thisc isc howc targetedc adsc workc whichc arec majorc

moneymakersc forc Microsoftc andc companiesc likec google.c Therec canc bec hugec impactsc onc

ac companyc thatc violatesc anyc rulesc orc lawsc inc place,c whichc includesc areasc suchc asc thec

lawc alsoc statesc thatc forc ac companyc toc stayc SOXc complient,c theyc mustc havec adequitec

standardsc andc securityc controlsc inc placec toc ensurec thec confidentiality,c integrity,c andc

avalibilityc ofc theirc financialc information.c Thisc lawc affectsc allc differentc businessesc thatc

storec financialc informationc soc thatc theyc mayc notc sellc thec informationc orc lackc securityc

protocolsc toc protectc thatc information.c Anotherc lawc thatc affectsc thec cyberc domainc isc thec

Electronicc Fundsc Transferc Act.c Thisc lawc statesc thatc anyonec electronicallyc transferringc

fundsc arec protectedc againstc errorsc andc fraud.c Thisc canc includec anyc companyc thatc isc

electronicallyc transferringc fundsc toc orc fromc anc account.c Thisc canc includec ATM's,c

telephonec billc payements,c andc POSc terminals.c Anotherc lawc thatc affectsc thec cyberc domainc

isc Healthc Informationc Technologyc forc Economicc andc Clinicalc Healthc Act.c Thisc lawc isc

thec medicalc communityc butc withc thisc bringsc majorc modificationsc toc thec wayc thatc

patientsc informationc isc storedc andc accessed.c Itc statesc thatc patientc informationc storedc mustc

bec securedc inc ac reasonablec wayc andc helpsc toc expandc thec scopec ofc thec patientc

confidentialityc ofc HIPAA.c Afterc doingc extensivec researchc onc thec lawsc andc regulationsc

providedc inc thisc discussionc Ic havec comec toc thec conclusionc thatc thec lawc thatc impactsc

informationc securityc professionalsc thec mostc inc myc opinionc wouldc bec thec Healthc

Insurancec Portabilityc andc Accountabilityc Actc (HIPAA).c Thisc lawc basicallyc protectsc thec

patient’sc personalc informationc fromc anyonec besidec thec personc whoc isc treatingc them.c

ofc myc arm.c Myc momc wasc notc allowedc toc getc anyc informationc aboutc thec accidentc orc

myc conditionc untilc Ic wasc consciousc andc gavec consent.c Shec wasc extremelyc upsetc aboutc

this,c butc Ic totallyc understoodc thec situationc becausec ofc thisc law.c Evenc thoughc shec wasc

myc mom,c someonec couldc havec actedc likec thatc justc toc getc myc information.c Therec isc ac

lotc ofc informationc thatc ac hospitalc receivesc whenc yourc beingc caredc for,c andc youc doc notc

wantc toc letc anyonec getc intoc yourc personalc information.c Notc everyonec hasc thisc security,c

butc Ic amc gladc Ic knowc myc informationc isc safec whenc Ic amc beingc caredc for.c Thec lawc

thatc affectsc myc organizationc thec mostc isc thec Fairc andc Accuratec Creditc Transactionc Actc

(FACTA).c Thisc isc becausec myc organizationc oftenc dealsc withc creditc applicationsc andc thisc

helpsc thosec customersc avoidc identityc theft.c Ifc wec followc thisc lawc asc ac company,c wec

familiarc withc thec lawsc Ic needc toc bec following.c Thec threec lawsc andc regulationsc thatc Ic

seec thatc fitc toc thec companyc Ic chosec arec Sarbanes-Sarbanes-Oxleyc Act,c Federalc Rulesc ofc

Civilc Procedurec andc also,c onec thatc originatedc inc thec EUc thatc affectsc usc herec inc thec

statesc asc well,c thec Generalc Datac Protectionc Regulation.c Thec Sarbanes-Sarbanes-Oxleyc

Actc isc ac 2002c lawc wasc ac responsec toc corporatec fraudc andc isc designedc toc improvec

corporatec disclosuresc andc transparency.c Forc ITc andc securityc folks,c thatc meansc

informationc controlc andc integrity,c businessc continuityc andc disasterc recovery,c andc

protectingc informationc (andc financialc performance)c fromc thec impactc ofc ac datac breachc orc

producec datac thatc isc relevantc toc ac case.c Company’sc thatc wouldc bec affectedc byc thisc

wouldc bec anyc companyc thatc isc —c orc couldc bec —c involvedc inc ac civilc lawsuitc withinc

thec federalc courts.c Inc addition,c becausec statesc havec adoptedc FRCP-likec rules,c companiesc

involvedc inc litigationc withinc ac statec courtc systemc arec alsoc affected.c Thec EU'sc Generalc

Datac Protectionc Regulationc (GDPR)c tookc effectc onc Mayc 25,c 2018.c Thec GDPRc isc

designedc toc protectc thec personalc datac ofc EUc citizens,c andc toc doc soc itc regulatesc howc

suchc datac isc collected,c stored,c processed,c andc destroyed.c Thec definitionc ofc "personalc

data"c isc extremelyc broad:c Itc includesc names,c addresses,c andc bankc details,c butc alsoc datac

relatedc toc religion,c race,c mentalc orc physicalc characteristics,c andc evenc IPc addresses,c webc

cookies,c contacts,c andc mobilec devicec IDs,c ifc theyc identifyc anc individual.

Ic haven’tc hadc toc dealc withc thesec firstc hand,c otherc thanc beingc thec personc whoc collectsc

datac andc sincec I’mc onc thec frontc lines,c Ic makec surec thatc Ic doc notc givec outc anyc datac ofc

anyonec toc anyc personc withoutc followingc thec properc channelsc toc verifyc thec personc whomc

perceptionc ofc exploitingc andc committingc crimec withc minimalc riskc toc thec threat.c Thec

companyc Ic chosec inc weekc onec wasc Applec andc theyc havec ac crossc functionalc approachc

toc conductc businessc onc thec cyberc domain.c Meaningc theyc havec theirc ownc setc ofc ethicsc

andc principlesc ofc howc theirc customersc shouldc bec treatedc inc personc andc inc thec cyberc

domain.c Theyc alsoc havec expectationc toc securityc andc privacyc asc wec trustc themc withc

muchc ofc ourc personalc informationc andc financialc information.c Thec ethicsc andc principlesc

Applec hasc fromc whatc Ic canc tellc developedc fromc mostc ofc societyc inc thec Unitedc Statesc

evenc thoughc theyc havec customersc acrossc thec world.c Theirc legal,c principlesc andc ethicc arec

remarkablyc similarc fromc countryc toc countryc onlyc changingc whatc isc mandatoryc toc bec ac

legalc corporationc inc thatc country.c Thisc allowsc themc toc keepc manyc ofc theirc corec

ofc informationc beingc handledc dependingc onc thec servicec thatc ac companyc mayc provide.c

Companiesc thatc dealc withc electronicc transactionsc havec toc complyc withc regulationsc likec

paymentc cardc industryc datac securityc Standardc (PCIc DSS)c andc thec Electronicc Fundc

Transferc Act.c Bothc ofc thesec regulationsc keepc consumersc electronicallyc storedc informationc

safe.c PCIc DSSc providesc anc enhancedc securityc levelc whenc itc comesc toc ac customer’sc

paymentc accountc data.c Thisc setc ofc requirementsc includec thingsc likec securityc

management,c policies,c andc otherc protectivec measures.c Electronicc Fundc Transferc Actc

protectsc consumersc fromc errorsc andc fraudc whilec conductingc electronicc fundc transfersc

susceptiblec toc illegalc practices.c Thec companyc alsoc operatesc inc Nevadac andc Massachusettsc

information.c Inc Nevada,c theyc enactedc ac datac securityc lawc toc encryptc customers’c personalc

informationc ifc itc isc toc bec storedc orc transported.c Thec statec ofc Massachusettsc requiresc thatc

companiesc thatc storec orc usesc residents’c personalc informationc developc ac regularc auditc

planc toc protectc thatc information.c Ic havec beenc ac victimc ofc identityc theftc backc beforec

manyc ofc thesec policiesc werec putc intoc place.c Nowadaysc thesec policiesc keepc usc protectedc

asc electronicc consumersc soc ourc datac isc betterc protected.c Thec rolesc andc responsibilitiesc

ofc thosec upholdingc thec lawsc likelyc include,c regularlyc testingc thec securityc ofc theirc

systemsc toc ensurec theyc cannotc bec breached.c Also,c updatingc whateverc securityc measuresc

Thec lawc thatc stoodc outc toc mec thec mostc inc regardc toc thec organizationc Ic chosec wasc thec

PCIc DSSc law.c Itc requiresc policiesc andc protectivec measuresc toc keepc customersc accountc

informationc safe.c Itc isc ac requirementc toc bec implementedc withc PCIc DSSc ifc youc acceptc

creditc cardsc noc matterc thec sizec ofc yourc business.c Whilec beingc implementedc isc ac

requirementc beingc compliantc isc not,c butc itc reducesc thec riskc ofc creditc cardc fraudc ifc youc

are.c Ifc yourc businessc isc notc complaintc withc PCIc DSSc andc youc experiencec ac securityc

breachc youc mayc havec toc payc fines.c Fromc whatc Ic havec beenc ablec toc findc itc seemsc

Europec usesc PCIc DSSc however,c Ic wasn’tc ablec toc findc ac fullc listc ofc countriesc itc isc usedc

informationc securityc policiesc are.c Afterc researchingc throughc thec internationalc lawsc andc

regulations,c theyc focusc mainlyc onc protectingc disclosurec ofc personalc informationc fromc

businessesc andc organizations.c Myc experiencec withc thec lawsc andc regulationsc wouldc mostc

likelyc relatec toc thec Fairc andc Accuratec Creditc Transactionc Actc (FACTA),c includingc Redc

Flagsc Rule.c Ic workc inc anc officec buildingc thatc receivesc applicationsc fromc consumersc whoc

wouldc likec toc repairc orc retirec theirc vehicle.c Inc orderc toc determinec ifc theyc qualifyc forc

ourc program,c theyc havec toc bec incomec eligiblec andc providec proofc ofc theirc income.c Byc

law,c wec arec responsiblec forc upholdingc thec consumersc confidentialityc andc properlyc

disposec ofc theirc personalc informationc afterc processingc themc inc ourc database.c Ic amc onec

ofc thec fewc employeesc responsiblec forc properlyc disposingc thec consumersc applicationc afterc

obtainingc thec cardc datec forc whatc everc process,c isc responsiblec forc thec data.c thec ITc guyc

isc responsiblec forc maintainc thec systemsc andc loggingc vulnerabilitiesc alongc withc testingc

andc monitoring,c andc ifc Ic understandc correctlyc PCIc securityc standardc councilc isc

responsiblec forc enforcingc thec standard.c Thisc affectsc System76c byc thec wayc theyc collectc

paymentc forc customersc purchases,c theyc doc practicec somec transferencec ofc liabilityc byc

allowingc customersc thec optionc toc financec theirc purchase,c whichc atc thatc pointc thec creditorc

carriesc thec responsibilityc ofc maintainingc thec data.c Thisc processc isc wellc practicedc acrossc

thec boardc allc over,c itc seemsc toc mec likec mostc everyc retailerc onlinec hasc ac veryc similarc

servers,c mobilec devices,c electronicc systems,c networks,c andc datac fromc maliciousc attacks.c

It'sc alsoc knownc asc informationc technologyc securityc orc electronicc informationc security.c

Today,c therec isc noc consensusc onc whoc isc responsiblec forc datac privacy.c Somec consumersc

agreec thatc thec responsibilityc liesc withc them,c butc othersc thinkc governmentsc orc businessesc

arec betterc equippedc toc dealc withc thisc complexc issue.c Datac breachesc havec becomec bothc

morec commonc andc morec severe.c Cyberc attacksc thatc werec previouslyc consideredc large-

scalec arec todayc seenc asc normal.c Hackersc arec morec agile,c Thec threatsc arec becomingc morec

sophisticated;c hackersc arec increasinglyc agilec andc arec usingc advancedc technologyc toc

launchc attacks.c Inc recentc years,c numerousc issuesc havec arisenc aroundc thec wayc enterprisesc

treatc theirc users’c information.c Personalc datac isc processedc forc politicalc andc economicc

sector,c statec orc datac type.c Recently,c Californiac implementedc ac newc lawc thatc governsc

IoTc securityc onc ac statec level.c Technologyc leaders,c meanwhile,c arec pushingc forc federalc

privacyc laws,c andc arec beginningc toc seec privacyc asc ac humanc right.c Afterc doingc somec

researchc onc thec lawsc andc regulationsc thatc mostc impactsc informationc securityc

professionalsc therec wasc onec thatc stoodc outc toc mec andc thatc isc thec Healthc Insurancec

Portabilityc andc Accountabilityc Actc (HIPAA).c Thec Healthc Insurancec Portabilityc andc

Accountabilityc Atc isc intendedc toc improvec thec efficiencyc andc effectivenessc ofc thec healthc

carec system.c Itc doesc soc byc protectingc thec patientc identifiablec healthc informationc andc byc

alsoc importantc becausec ac lotc ofc informationc isc locatedc onc anc EMRc whichc isc anc

Electronicc Medicalc Recordc andc ifc itsc digitalc thec therec hasc toc bec somec sortc ofc cyberc

securityc ofc elsec allc ofc thosec patientsc informationc canc bec stolenc isc thec systemc isc hacked.c

Whenc itc comesc toc thec cyberc domain,c allc employeesc arec responsiblec forc upholdingc thec

law,c butc thec informationc securityc professionalc hasc thec biggestc rolec dealingc withc thec

responsibilityc andc liabilityc forc privacyc andc securityc risks.c Thec professionalc mustc maintainc

upc toc datec withc lawsc andc regulations,c inc doingc soc theyc canc educatec managementc andc