Please see the direction and answer the questions

User Generated

gten

Computer Science

Description

Read the case study in the file below and answer those 4 questions below

Your answer should be only 4 paragraphs long (one paragraph for each question) (each paragraph should be more than half page)

Unformatted Attachment Preview

Read the case study below answer those 4 questions below Your answer should be only 4 paragraphs long (one paragraph for each question) (each paragraph should be more than half page) Don’t forget to cite your work Avoid plagiarism For assistance, use this textbook http://www.consciouskidsacademy.org/Principles%20of%20Information%20Security%204th%20 edition%20-%20Michael%20E%20Whitman.pdf See the link if you think that you need to cite something from the book Case Study: CardSystems Solutions CardSystems Solutions, a third-party payment processor, collected thousands of transactions of small and medium businesses. These transactions were then processed as batches and sent to credit card providers (such as Visa and MasterCard). The company’s collection and processing of private information and financial data made it a prime target of potential hackers. Because of this, the company had to meet the data security standards that federal, state, and industry standards required. Compliance is not optional for companies such as Card Systems Solutions. In June 2004, an external auditor certified the company as Payment Card Industry Data Security Standard – (PCI DSS) – compliant. The PCI DSS standards include installing a firewall and antivirus software and updating virus definitions on a consistent schedule. Companies must also encrypt privacy data elements. The company’s certification implied that it followed a high standard of security, meaning the company used encryption methods to store privacy data. However, after the breach, a security assessment was conducted. This assessment of the security measures used at the company proved that the company was not PCI DSS-compliant. The hacker who performed the attack used a basic exploit known as a Structured Query Language (SQL) injection, which allows the hacker to place a snippet of code into the application. The hacker gained access through Web application that customers used to access their data. With code inserted into the fields of the form, the hacker was able to send SQL commands to the backend SQL server. The hacker wrote a script that gathered credit card data from the database, put it in a compressed ZIP file, and sent the credit card data to the hacker community through a File Transfer Protocol (FTP) site. The impact of the attack almost caused the company to go out of business. It had to eventually be acquired by another business. • Federal Trade Commission Act (15 U.S.C. §§ 41-58, as amended) –Under this act, the commission is empowered, among other things, to (a) prevent unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce; (b) seek monetary redress and other relief for conduct injurious to consumers; (c) prescribe trade regulation rules defining with specificity acts or practices that are unfair or deceptive, and establishing requirements design to prevent such acts or practices; (d) conduct investigations relating to the organization, business, practices, and management of entities engaged in commerce; and (e) make reports and legislative recommendations to Congress. Answer the following questions: 1. How was CardSystems implicit in the breach of customers’ data? 2. Explain which PCI DSS requirements were not met and how these violate the FTC Act. 3. Recommend two or more mitigation remedies to prevent the same thing from happening at another organization. 4. Respond to one other classmate’s reply to #3. Be aware - for question, tomorrow I will give you one of my classmate answer for question 3 and then you have to respond to it
Purchase answer to see full attachment
User generated content is uploaded by users for the purposes of learning and should be used following Studypool's honor code & terms of service.

Explanation & Answer

hello buddy,Here you go please have a look. Feel free to invite me for more questions.Regards

Running head: CASE STUDY: CARDSYSTEMS SOLUTIONS

Case Study: CardSystems Solutions
Student’s Name
Affiliate Institution

1

CASE STUDY: CARDSYSTEMS SOLUTIONS

2

Case Study: CardSystems Solutions
How CardSystems was implicit in breach of customer’s data
CardSytems was implicit in in breach of consumer’s data in the sense that it improperly
held their credit data. Card processors re not supposed keeping a consumer’s data after any
transaction and thus violating the set policies. The company’s responsibility is pass on the
information to the customer’s respective bank and not store the information. The company ought
to have put in place strict measures that would guarantee the safety of the consumer’s data.
Through its operations, the company had veered of the compliance requirements and did not do
much to correct until when the company realized a mishap. Additionally, the company did not
employ ...


Anonymous
Really useful study material!

Studypool
4.7
Trustpilot
4.5
Sitejabber
4.4

Related Tags