Security Gaps and Mitigation

Security Gaps and Mitigations

Scenario

You are the newly hired chief information officer (CIO) for Premier University, a public university with 30,000 students and approximately 5,000 faculty and staff members.

Premier University experienced a data breach approximately six months ago. During that breach, a laptop owned by the institution was stolen from a staff members car. The staff member worked in the institutions financial aid office. The laptop was not password protected or encrypted, and data belonging to about 5,000 former students, including Social Security numbers (SSNs), name, and credit card information, was exposed.

Premier University did not have an at that time, so the universitys response to the breach was poor. After the staff member reported the stolen laptop to campus police, it took the institution almost 90 days to determine that personally identifiable data was stored on the device, and then another 30 days to inform affected individuals about the breach of their information.

The breach was reported in local news media, and the institutions press representative could not answer the reporters questions about how students should protect themselves and their data following the breach. After the news report, many Premier University alumni complained to Premiers president about the institutions poor breach response. As a result, donations from alumni have dropped slightly.

You were hired after the breach to help the institution improve its information security program.

Tasks