Use of Firewalls to prevent Intruders at Bibliofind
There are two types of firewalls that Bibliofind could have used. The two are hardware and software firewalls (Stewart 72). Software firewalls could have been used to protect individual computers that intruders’ means of attacking such as viruses and spyware. One such software firewall that Bibliofind could have used is the Cisco ProtectLink Endpoint, that is specifically for Microsoft Windows computer operating system. With such a firewall, a system administrator at Bibliofind could have monitored the traffic flow that was coming in and going out of the individual computer system so as to identify any suspicious behavior.This means that the intruder could have been detected before the extent of damage went out of hand (Stewart 72).
On the other hand, hardware firewalls are placed between an organization’s internal network and the rest of the external network. A hardware firewall filters all the incoming packets that are destined to a specific server or host. This means that Bibliofind could have used hardware firewalls to deny access to suspicious packets that were destined to its internal network (Stewart 72).
Firewall filter rules can be based on five conditions. The first condition is the IP Addresses where a range of IP addresses that are thought to be predatory are blocked from gaining access to a network. The second rule is the domain names where only specific domain names are allowed access to an organization’s systems. The third rule is the protocols where only certain systems are allowed to access certain protocols such as IP, FTP, Telnet, SMTP among others. The fourth firewall rules is based on ports where server ports are disabled or blocked. The final rule is based on the use of keywords to block unwanted data from getting into a network(PC Corporation Communication 101).
Use of Encryption at Bibliofind to minimize security Breach
As it has been indicated in the case, the some crackers gained access to the Bibliofind webservers and retrieved some customer information, including their credit card numbers. According to the case, this information was stored in plain text files in the company’s transaction servers. From this information, it is clear that Bibliofind had not encrypted its data. Failure to encrypt data can cause massive financial losses because intruders can use the stolen card information to transact as if they are the legal card owners.
However, Bibliofind could have minimized this loss if the company had encrypted the card and its data. Encryption of the card meant the card data that the attackers stole during the breach would have been meaningless. One method of encryption that Bibliofind could have used is the end-to-end encryption. End-to-end encryption protects a card holder’s data during the whole process of transaction at the point-of-sale, during the card tokenization process, and during the process of identification of valid cards and differentiating them from counterfeit ones. Another thing is that end-to-end encryption would have protected credit card data when it was shared among payment processing networks, and during storage. By intruders stealing the data, it could have been difficult to decrypt the card information for them to use it (Morana and Tony 249).
Law Requiring Customers be informed on Data Breach
In the California Civil Code s. 1798.29(a), Article 7 that is referred to as Accounting and disclosures requires all companies that experience data breaches to inform the affected customers (leginfo.legislature.ca.gov). Such a law is good because informing the affected customers has many benefits. The first importance of data breach notification to customers is that it can act as a protection measure against the misuse, loss, interference, and modification of the stolen information. Secondly, informing customers about a data breach is part of privacy principle. Customers have the right to be notified of what happened and the actions that an organization is taking to minimize potential harms.
Thirdly, informing customers on data breach is a way of rebuilding public trust. This is because when an organization reports of data breach to its customers, then these customers can view this organization as one that gives the security of personal information a top priority. It also shows that the organization is working hard in protecting the breached data so as to protect the affected persons. Such an act promotes trust and loyalty. Finally, informing customers of the data breach enables the affected individuals to make efforts so as to regain control of their personal information that is stolen in the data breach. Some of the ways that the affected persons can regain control of their personal information is through changing of passwords, changing of account numbers, or making a request for identifiers to be reissued (oaic.gov.au).
However, informing the affected customers about a data breach is not advisable in some instances and such a law should not be enacted. Informing customers can cause panic because of the worry that is associated with the financial losses as a result of their card information being stolen. Secondly, the affected organization can face many legal suits from customers who might feel that sound measures were not taken to protect their personal data. This would affect the public confidence in such a company. Finally informing customers can interfere with the process of investigation (Rodrigues 738).
Work Cited
California Legislative Information."Code Section."Law Section.Web. 11 Apr. 2016. <https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CI V>.
Morana, Marco, and Tony UcedaVelez.Application Threat Modeling. Oxford: Wiley-Blackwell, 2011. Print.
Office of the Australian Information Commissioner."Data Breach Notification Guide: A Guide to Handling " Web. 11 Apr. 2016. <https://www.oaic.gov.au/images/documents/privacy/privacy-resources/privacy- guides/data-breach-notification-guide-august-2014.pdf>.
PC Corporation Communication.Pc Magazine: The Independent Guide to Ibm-Standard Personal Computing. New York, N.Y.: PC Communications Corp., 2002. Print.
Rodrigues, Susana. The 2nd European Conference on Intellectual Capital: 29-30 March 2010. Reading: Academic Publishing, 2010. Print.
Stewart, James M. Network Security, Firewalls, and Vpns. Sudbury, Mass: Jones & Bartlett Learning, 2011. Internet resource.
