CMIT320 Week 4 Discussion Ethics An IT administrator for Acme Inc

Password Security Breach

The Acme Company failed to institute access control privileges to sensitive company employees' files created by its IT administrator leading to the cloud-based work account security breach risk. Since the IT administrator used her email and password to create cloud work-based accounts and access the Acme Company's files, her termination led to employees' risk of an information security breach (Moore& IGI Global, 2017). Access control refers to security privileges that allow users to be positively identified and granted permission to access company data. Most companies handling highly sensitive data for their users' utilize access control as a selective method of restricting data access. Access control constitutes user authorization and authentication. System access authentication is a technique that verifies an individual's identity. However, authentication does not protect data sufficiently without using authorization as an additional layer of protection. The Acme Company had failed to use system access authentication and authorization as two-factor authentication.

The Acme Company failed to separate employees' highly sensitive information files’ password from the IT administrator's email password. For instance, the Acme Company was unable to implement administrative controls that allow employees to sign confidentiality and non-disclosure agreements to prevent exposure of the company's data when an employee loses their job (Tehan, 2008). Moreover, the company failed to utilize technology control tools such as DLP tools and logging databases and network activities. Further, the company did not remove the IT administrator's access to its network before the employee leaves the organization.

              The IT administrator working for the Acme Company made the mistake of using her email to create cloud-based work accounts risking invasion of employee privacy. Instead, the IT administrator should have used the organization’s email or an email specified by the company (Tehan, 2008). Furthermore, the IT administrator failed to disclose the password used to access the company’s cloud-based work accounts before leaving the company. As such, the IT administrator risked exposing the company employee's data to the public by not disclosing password credentials.

References

Moore, M., & IGI Global, (2017). Cybersecurity breaches and issues surrounding online threat protection.

Tehan, R. (2008). Data security breaches: Context and incident summaries. New York: Novinkna Books.