Case Study: Autopsy of a Data Breach (Case Study Sample)

Case Study: Autopsy of a Data Breach
Student’s Name:
Institution’s Name:
Course Title:
Instructor’s Name:
Date of Submission
Case Study: Autopsy of a Data Breach
1 Define the problem
Three key problems are evident throughout the case study. First, Target ignored multiple malware alerts. Second, prevention functionalities were turned off by administers, and this can be linked to the unfamiliarity of administrators with the FireEye system. The third problem was evident by the company actions, which resulted in the missing of early discovery of the breach. The final problem was observed when Target failed to offer an immediate public address notifying its customers of the breach. The range of problems experienced by the Target company indicates a culture of unethical practices towards data breach prevention and management strategies. This essay seeks to identify how Target can adopt a culture of commitment to data security and breach management.
2 Gather Pertinent Facts
Target was among the companies that have adopted massive IT solutions focusing on internet security. Dube (2016) notes that one strategy was the adoption of the FireEye system, which the CIA and Pentagon have also adopted. Nevertheless, following its adoption, the administrators turned off some prevention functionalities in the system. The turning of these functions is a result of non-awareness of the functionality of these systems. In addition, a team of experts in Bangalore tasked with monitoring the results generated by the FireEye system were able to identify suspicious activities prior to the first breached data transfer (Dube, 2016).
This information was sent to Target's security center at the headquarters; however, the center diagnosed the situation as irrelevant and did not require immediate attention. These alerts, which were level 1 alerts, were first sent on November 30 before the first data was transferred. The Target company was unaware of the breach until it was first reported to them by the law enforcement agencies. Dube (2016) explains that irrespective of the company receiving this information early, the company only announced the breach and data theft to the public on December 19, almost a week after gaining this vital knowledge.
3 Develop/ Propose alternative solutions
Alternative Solution 1: The turning off of the prevention functionalities in the FireEye system should have been reported to the manufacturers of the system.
Alternative solution 2: The IT team at Target headquarters should have investigated the breach alerts and adopted mitigation strategies to combat the challenge.
Alternative Solution 3: Following the immediate report of the breach, Target should have offered a public address indicating the breach and loss of data.
4 Analyze the Pros and Cons of each alternative solution
The reporting of the turning off of the prevention functionality to the manufactures of FireEye would have been critical in eliminating the problem for diverse reasons. First, the manufacturers were aware of the critical role played by these functions in preventing breach risks. Consequently, the manufacturer would have sought to offer training to the administrators on the need and usage of these functionalities. In an instance where the system's functionality was working efficiently, it is possible that the breach would have been identified early and prevented.
The second solution required that the IT team at Target headquarters investigate the allegations raised by the alert. This solution would have been key in identifying the extent of the breach and strategies to combat the attack. It is important to acknowledge that if this solution could have been adopted, no data breach could have occurred, hence no data loss.
The third solution required the immediate offering of a public address to all the customers affected by the breach. This solution was to be adopted immediately following the breach and would have allowed the customers to take up necessary prevention actions such as closing their credit and debit cards. Adopting the solution was disadvantageous in that it could have resulted in a decline in public trust in the company.
5 Make a decision and defe