According to the authors, privacy and security go hand in hand; and hence, privacy cannot be protected without implementing proper security controls and technologies. Today, organizations must make not only reasonable efforts to offer protection of privacy of data, but also must go much further as privacy breaches are damaging to its customers, reputation, and potentially could put the company out of business. As we continue learning from our various professional areas of practice, its no doubt that breaches have become an increasing concern to many businesses and their future operations. For this discussion, find an example of a security breach which compromised data records at a company(Netflix which we have used) in the same industry as you will be using in your final paper. Summarize the breach, discuss the data that was lost and identify security controls that you would recommend be in place (be certain to remember to cite sources) that could have prevented this breach from occurring.  .Post-1:LinkedIn Data BreachSome of the organizations in the technology industry that have suffered data breach include Yahoo, Dropbox, and LinkedIn (Thomas et al., 2017). In this discussion, I will discuss LinkedIn’s data breach. LinkedIn is a major social network used by many business professionals. That aspect has turned LinkedIn into an appealing proposition for hackers who use sophisticated social engineering techniques (Swinhoe, 2020). In 2012, LinkedIn announced that attackers stole 6.5 million unassociated passwords and posted them on a Russian forum for hackers.It took the company until 2016 for the company to determine and reveal the full extent of the breach incident. The stolen data stayed in private hands to later appear on the dark web in 2016. The company revealed that the attacker accessed email addresses that were connected to the LinkedIn member ID numbers and hashed passwords (Swinhoe, 2020). LinkedIn announced that the hacker who was selling MySpace’s data offered the stolen email addresses and passwords of about 165 million LinkedIn users to buyer. The hacker was asking for 5 bitcoins (equivalents to $2,000 in 2016).The company acknowledged its awareness concerning the breach. The invalidated company invalidated passwords of LinkedIn accounts that were created prior to the 2012. The company used automated tools to both identify and block all suspicious activities on the accounts while engaging with law enforcement agencies. LinkedIn could have prevented the data breach by introducing 2-step verification using SMS on time (Gune, 2017). LinkedIn should have focused on the existence control measures such as two-step verification. The company should have enables users to configure 2FA.Post-2:Macy's is a famous American retail chain that sells fashion and beauty merchandise. It has been in business for over 160 years and is headquartered in New York City, NY. Merchandise is sold in its physical stores and via its online store. Macy's also operates the brand names Bloomingdales and Bluemercury.In October of 2019, Macy's notified its customers about a cyber-attack against its website, macys.com. In particular, two web pages were affected: the Checkout page and the My Wallet page. According to the notice, hackers injected web skimming malware into the website. The injected malware collects sensitive customer data such as names, addresses, phone numbers and email addresses, credit card numbers, security codes, and expiration dates (O'Donnell, 2020, September 16).Although Macy's believed that only a small number of customer accounts were affected, the damage was already done. In 2018, Macy's and Bloomingdale were impacted by a data breach in which hackers accessed user accounts stolen from 3rd party websites to access private customer data, including credit card numbers but not CVV security numbers or Social Security numbers (Mangla, 2020, June 15).In both incidents, Macy's provided identity theft protection services for the affected customers, which incurs a cost. Security breaches can significantly impact a company's brand image and even affect their stock prices. According to one researcher, Macy's stock saw a 10% dip in its stock price (NYSE) in November 2019, the month following the data breach disclosure (Islam, 2020).The following recommendations could reduce the risk of another attack. First, web servers should use professional-grade antivirus technology with automatic updates to stay current. The malware identified in the 2019 attack was well-known as "Magecart" (O'Donnell, 2019, November 19). An antivirus suite with an updated database may have been able to detect its signature and alert the security teams of the infection.Since antivirus software is not a guaranteed protection against new and unknown threats (Zero Day threats), another step that Macy's should take is to perform cybersecurity assessments, such as web application penetration tests. A penetration test is an assessment where information security professionals play the role of an attacker and use similar tactics, techniques, and procedures to discover weaknesses and provide recommendations to fix them before the real hackers do. In a web application penetration test, security professionals attempt to abuse web technologies using methodologies such as the Open Web Application Security Project (OWASP) to determine the most common risks (Smallwood, 2019). Penetration tests that demonstrate the exploitability of security flaws provides an accurate measure of risk.

Consumer profiling may be ethical if it results in beneficence for the group being studied (i.e., prior studies that concentrated on a source of infection in a designated area), or it can be unethical if it results in nothing but big profits for the big data broker, using somebody else’ personal data. Consumer profiling at the grocery store, at least results in a quid pro quo, but consumer profiling in general, results in nothing valuable gained, at the loss of your personal data – for which you get nothing in exchange. Consumer profiling data that is scoffed up by the government is a reminder of Big Brother! The third participation assignment concerns consumer profiling! The attached article “What do firms know about you? FTC would pull back the curtain,” by Craig Timberg from the Washington Post of 5-28-14 has some details. There are three questions of ethical interest:What is your take on consumer profiling?Should consumers be able to totally “opt-out” of consumer profiling – would a law be helpful?Should consumers be able to correct erroneous data, held by brokers? Please feel free to provide additional comments as you see fit! In order to receive full participation credit (i.e., one point) for this Discussion Topic, students must provide an initial response to the week's discussion topic by midnight, Eastern time, on Thursday (9-28-17) of the coming week, AND respond to at least two postings from other students to the current week's discussion topic by the end of the class week (midnight, Eastern time, Sunday (10-1-17)). The initial response is worth 1.00 points and the two replies to the other students’ posting are worth .50 points each. Please see the Grading Rubric for Class Participation in the Syllabus.Responses to Discussion Topic 3 will not be accepted after Midnight of 10-1-17Participation is open-ended and has no holds barred (mechanics are not evaluated and objectivity is not required, although this is a perfect opportunity to practice). When preparing a response to a discussion topic in a Conference Session, the following suggestions apply: Indicate the student (s) your response is intended for or the subject of your response by altering the title in your response appropriately – this action will also facilitate threading.Initial responses should demonstrate critical thinking and comprehension of the conference topic. These are strengthened when supported by additional research. Responses to classmates' postings should be constructive, expand upon points made, ask additional questions, and contribute to the dialogue. A simple "good posting" or "I agree" is not a sufficient comment.After submitting the response, check its content to make sure that it is accurate, what you want to say, and that any WWW references cited are clickable. If need be, edit the response appropriately.Click here to access fileClick here to access file