Case Project 7-6: Community Site Activity

Case Project 7-6: Community Site Activity

Take a look at Case Project 7-6: Community Site Activity. You do not need to logon to the Information Security Community site to complete this assignment. Read through the narrative regarding Vendor A and Vendor B, then answer the questions. Provide examples to support your answers. You might also find guidelines for a suggested timeline, and cases where penalties were applied for non-compliance. You might do a little research and determine if there are regulations regarding disclosure for different industries, such as health care. No more than two pages.

Vendor A was successfully attacked on Monday night and personal customer

information was compromised. The next day, Vendor A sent an e-mail to its customers

that it was the victim of a successful attack that occurred“recently”in

which“certain information”was stolen. Vendor A did not detail what information

was stolen, what direct impact it may have on its customers, or what customers

should do about it, other than some generic statements. Vendor B was also

successfully attacked on Monday night. However, Vendor B waited 10 days

before revealing the attack to its customers, but they included detailed information

about the attack, its consequences, and how customers could protect themselves.

In both cases, clear and immediate information was not distributed. Should

vendors be obligated to inform customers when attacks occur and how to protect

ourselves? What should be the time line for doing so? What should be the

penalties if vendors do not follow such guidelines?