Pages: 101

No chapter abstract available.

Pages: 58

No chapter abstract available.

Pages: 6

The authors describe the April 2020 cyberattack on Nintendo and discuss three methods used by hackers - credential stuffing, phishing, and brute force. Nintendo is not alone in fielding such attacks; analysis of hacking into Sony PlayStation and Alibaba provides further insight into the Nintendo case study.

Pages: 7

This case is related to Target Corporation, which is one of the largest retail companies in the United States. It possesses many traditional features of stores, but the reasonable price is the greatest advantage of Target. 1,844 stores were operated by Target with nearly 360,000 employees in 2019. Although Target won various awards due to its efforts and ethical behaviors, it suffered a massive data breach in 2013, which adversely affected its customers and its operations.

Pages: 7

This case study will discuss and analyze the Ukrainian power grid cyber-attack and the importance of security and risk management to reduce cyber-attacks. The chapter concludes with the lessons learned from the power grid attack and the questions raised for power companies from this incident.

Pages: 6

The rapid advancement of the modern-day world has led IT to transition onto a virtual environment and cloud for backup and data storage; data is everywhere, and organizations need to focus more on the protection and security of the data because of the changing trends in cyber-attacks and the frequent updates in international regulations. Despite the frameworks, laws, standards, and best practices there is a significant increase in the number of data breach cases. This chapter discusses and analyzes the Capital One data breach incident.

Pages: 8

Within the social context of transnational cybersecurity-related crimes, this case examines the 2012 and 2016 hacks on LinkedIn and 600 to 117 million of its users, LinkedIn’s swift and apologetic responses, and users’ complaints. Access to the data was posted on an online password forum and sold by the hacker, named ‘Peace’. Although LinkedIn attempted to remedy the situation by prompting users to reset passwords, their password storage prior to the attack was weak and of improper design. LinkedIn would later adopt ‘hashing’ and ‘salting’, two data security measures. This case points to the importance of training company employees in legal and ethical practices to mitigate users’ concerns confidently and proactively after a disruption or cyber-attack. Dealing with past data breaches and managing password security is also addressed.

Pages: 5

This case study describes the malicious activity that hackers brought upon Zoom Video Communications Inc. and its users. Attackers not only stole from and made intrusions into users’ accounts, but also interrupted Zoom meetings with unwanted images and messages. These zoombombing incidents caused authorities to ban the use of Zoom in some places in America. The authors provide a critical analysis of the case, the company as well as user and hacker activities involved. Lessons to learn from the case highlight important practices toward secure Zoom use.

Pages: 5

This case is about a recent cyber-attack on the Information Technology Giant named Collabera, which acted as responsibly as its good reputation would indicate. Although IT firms like Collabera can seem to be well prepared to block hacking, the authors critique Collabera’s company system and emphasize lessons to be learned from this case.

Pages: 4

Technology has made humans cyborgs. Humans are constantly using devices such as laptops and mobile phones. However, the rate of data and speed of communication between humans and devices are too slow to be truly seamless. These limitations are to be addressed by Neuralink’s long-term goal to facilitate human-AI symbiosis through a brain–machine interface (BMI). While very futuristic and exciting, this technology comes with security concerns. By creating an interface between humans and computing devices connected to a network, a significant risk to a human’s brain is posed by potential attacks on the device.

Pages: 8

The Internet of Things (IoT) is a network comprised of mobile heterogeneous devices that can communicate wirelessly. Since IoT devices are not immune to security vulnerabilities, and because these devices are mobile, the attack surfaces of IoT networks can change. Therefore, it is crucial to enact appropriate security management measures for Information Systems (IS) that rely on the IoT.

Pages: 41

No chapter abstract available.

Pages: 20

The authors weave into this research case the market demand driven by the value perception of consumers who own or wish to buy connected vehicles, the vehicle manufacturers’ innovation and viewpoints, and finally the reality of vehicles’ interconnected technology which makes them vulnerable to cyberattacks. The vehicle manufacturers’ willingness to qualitatively address ethical concerns, security risks, legal matters, governance, and emerging technologies is key to companies’ reputation and growth. The research chapter includes an in-depth analysis of these topics and suggests lessons for vehicle manufacturers, connected vehicle consumers, and governments.

Pages: 19

This case reviews the company SilverPush and its entrance into the software market, the Federal Commission’s policies and its response to users’ privacy concerns, and finally SilverPush’s reply to accusations of intrusion and potential privacy breach. This research also explores how the dilemma for SilverPush and most companies dealing with data is to balance user convenience measures with users’ data privacy.

Pages: 127

No chapter abstract available.

Pages: 86

No chapter abstract available.

Pages: 11

Currently, where the world trades online and does most of its work online using cloud services, hackers have been working hard to expose the loopholes in security to their advantage to steal information for financial or social benefit. These cyberthreats include Viruses, Malware, spamware, spyware, Distributed Denial-of-Service (DDoS) attacks, social engineering, and online identity theft or phishing. Phishing, one of the oldest tricks used by cybercriminals is increasing and becoming so advanced today that detecting and discerning what is bogus and genuine is hard. Most of today’s cyberattacks start with a phishing email. This case discusses Microsoft’s efforts to fend off the attacks that threatened their users’ privacy and their business reputation. The Microsoft case informs the global internet community – companies, individual employees within them, customers, and private users – on the need to continually update safeguards and learn to discern convincing yet bogus messages, links, and websites.

Pages: 7

This case study discusses how vulnerable IoT networks can be if users do not take proper measures to safeguard themselves from malicious actors. To learn the behaviors of hackers, Trend Micro, a Cybersecurity firm, created a fake company called MeTech to lure attackers to its honeypot of data. This case discusses IoT, forms of attack, tools to safeguard information, and lessons learned from the case.

Pages: 6

The authors briefly summarize and discuss the 2014 eBay data breach, a malicious action which hackers brought upon the sales channel through various phishing attacks. This case study defines phishing attacks and presents techniques which one can use to avoid being a victim of them. Finally, the authors explain lessons learned by eBay through this breach event, including best practices that all companies should follow.

Pages: 8

This case examines the scams attackers implement when using the IRS as their legitimate front for making threats, penetrating personal and banking information, as well as stealing data from systems. The authors define these types of attacks – phishing, malware, malicious mobile applications, smishing, and insecure networks – and present safety practices and precautions to eliminate or minimize such attacks. Additionally, fraudulent examples and sources on how to secure data are shown, as well as a call made for constant vigilance of the IRS to best educate the public and manage information security.

Pages: 7

This case outlines the nefarious scams played on predominantly international and first-year students at Penn State University, U.S.A. Scammers gathered students’ personal information, contacted them by phone or emails, and used different techniques and scare tactics to collect money. This case discusses the problems inherent to Penn State and other university communities, namely, poor protection of private information, student frustration to report a scam, little to no investigation, lack of awareness of the scams, and the need for student support before any potential and after a scam.

Pages: 7

Robots are becoming an integral part of daily life. Apart from industrial use, they have an important role in medical, household, social, military, and space applications. Several types of research have shown substantial innovation in various fields as well, such as field robotics, social robotics, intelligent robotics, and sex-robotics. The widespread use of robots in social and personal life could be possible because of recent advancements in sensors development, artificial intelligence, robot learning, motion planning, decision-making, computer vision, and other relevant areas. However, robots also pose many threats to security and privacy. Security and privacy of one’s data is a fundamental human right, and individuals have the right to have control over their data. This case provides a critical analysis about the security and privacy concerns of social robotics which is a privacy-sensitive recent technological advancement.

Pages: 6

The authors introduce NCL Ltd, a construction company in India, and summarize one of its employee’s fraudulent activity. The poor choices made and NCL Ltd’s loosely held policies are analyzed as contributing factors that enabled illegal payouts to a nonexistent sub-contractor. The authors finish with what NCL Ltd learned from the breach and what actions and positions they should take in the future.

Pages: 6

Deepfakes are digital image or audio simulation, a type of manipulated video or audio that produces an overly realistic, synthetic replica of a human. The CEO of a UK-based energy company fell victim to a deepfake voice scam in March 2019. This was the first documented case of an AI-generated deepfake voice being used for fraud. Since no perpetrators have been named, little is known about what tools they used or how they obtained the voice data used to circumvent the German executive. This case highlights deepfake generation, its risks, and potential uses.

Pages: 5

Physical and social robots are used across many industries to replace human operators. Especially in the case of social robots, people are often unaware of the potential attack vectors they can become exposed to when integrating social robots into existing interactions. Appropriate safeguards, such as access control mechanisms and regular monitoring, are necessary to maintain the security of systems that utilize robots.

Pages: 4

Ransomware describes a type of malware designed to remove a system owner’s data access. Attackers remove access to sensitive data through encryption and gain funds from a system owner in exchange for the necessary decryption key that can reinstate access. In certain cases, system owners may be threatened with the dissemination of their sensitive data. Hollywood Presbyterian Medical Center is an example of an organization that fell victim to ransomware and needed to pay the ransom to reinstate access to critical health and organizational data.

Pages: 8

Phishing attacks are an attack vector for cyber espionage against governments, as can be seen in the case of a phishing attack launched against US government employees disguised as a fast-food marketing exercise. Cyber espionage involves the use of misleading information planted by the hacker to attract the user to click on attached links. Phishing is a scheme that makes the person who clicks on the email links or attachments do all the work for the hacker. This case explores the effect of phishing for cyber espionage on the US government, as well as the implications of security strategies that call for collaboration between the private and public sectors.

Pages: 9

There are many discussions and debates on whether robots are going to be threats to our jobs in the future. Nonetheless, it is unequivocal that robots will be involved in many shapes and forms. Focusing on the implications of robots in two areas, low-skilled workers and the healthcare sector, provides a strong overview of the role of workplace robots and their challenges. From this, we examine how robots can both empower and discourage workers in the workplace, highlighting the need for key decision-makers to find a balance between people and technology.

Pages: 39

No chapter abstract available.

Pages: 19

While facial recognition technology increases convenience, safety, and efficiency in different aspects, it has also raised controversies and concerns about privacy invasion, security threat, and the lack of legislation. This case study focuses on and analyzes an American technology company and its facial recognition software, which were both named after “Clearview AI.”

Pages: 18

India currently has one of the largest digital biometric systems in the world called Aadhaar. In response to the corruption that hampered the distribution of benefits, the government of India created Aadhaar to systematize the procedure to collect data and to make it easier to distribute government services to the public, especially to the people who are below the poverty line. In this case study’s writing, only a small percentage of citizen data has been leaked, but these breaches account for a violation of privacy. The research case also addresses the abuses of the Aadhaar system and its far-reaching potential for harm. The Literature Review consists of three sources which directly or indirectly comment on the research case’s problem statement. The Analysis Section explores several topics including Aadhaar’s role, abuses, and potentially disastrous effect on Indian citizens and the community as well as the historical context of the case. In relation to the Aadhaar system and its breaches, the authors suggest lessons to learn for any IT project in an organization.

Pages: 84

No chapter abstract available.

Pages: 71

No chapter abstract available.

Pages: 6

In the current circumstances of the COVID-19 pandemic and due to a lack of knowledge about the virus and its behavior, effectively managing this pandemic on a national or international level is very challenging, but the occurrences of unethical activities are also great. This case discusses the alarming threat of privacy breaches as governments, specifically the UK, and private players inadvertently or directly penetrate private medical data in efforts to manage the virus and possibly find a cure. Some researchers are purposely ‘covidizing’ their projects to acquire patients’ personal information and relying on relaxed or suspended privacy regulations to curtail patient consent. This case calls for the improvement of governing laws and regulations to protect personal privacy and outlines suggestions proposed by researchers.

Pages: 5

The authors describe the timeline of the data breach events that occurred at Marriot International and how their merger with a smaller company contributed to insufficient security and the use of outdated software. In addition to cyber insurance, lessons learned from the case center on data and network security.

Pages: 6

This is a case study of ChoicePoint, a data economy company that allowed a breach of confidential information and failed to inform appropriate parties of the leaks as well as their content. The authors review this case in light of state and federal guidelines which govern the use of individuals’ private information, provide critical analysis of ChoicePoint’s actions and omissions, and set forth lessons learned.

Pages: 7

The authors of this case study of TJX, a home fashion retailer in the US and supplier of inexpensive clothing, describe and analyze the breach of consumer information that this company allowed in 2006, and provide lessons to be utilized by TJX and other enterprises. The authors consider the role of the breach laws and the FTC Act, Payment Card Industry Data Security Standards (PCI-DSS), information privacy and ethics, and risk management in their analysis and discussion.

Pages: 5

This case concerns the data breach at the company Flipboard which occurred in 2018 and into 2019. The authors provide a description of the company, the data breach incidents, the investigation therein, as well as the lessons learned.

Pages: 7

The authors describe and summarize MGM Las Vegas, its umbrella company, and the 2019 data breach. An in-depth discussion of the hospitality industry, its threats from various cyber-attacks, and ways and tools to ward off such attacks follow with lessons learned by and cautionary steps to be taken by MGM and the hospitality industry as a whole.

Pages: 7

When a data breach happens in a private business, the leak of Personally Identifiable Information (PII) may be unpleasant for customers and credibility-battering for the organization. Wider knowledge of PII can lead to further degradation of account integrity. However, when a security breach occurs in a healthcare provider’s system the consequences can be severe given the delicate nature of the information they store. According to a Black Book Industry Study, 96% of IT practitioners agree that cyber criminals outperform medical organizations' defense capabilities [ 1 ]. Even though one out of ten healthcare patients claimed to have been affected by healthcare data breaches over the past five years, only 21% of hospitals reported having a committed cybersecurity director and just 6% employed a Chief Information Security Officer (CISO). Given the importance of patient security, the value of healthcare data, and the inadequate safeguards currently in place, data breaches are a growing issue.

Pages: 6

Clearview AI is a privately owned facial recognition search engine. It has scraped over three billion photos from the Internet and has used this wide range of photographs to develop a facial recognition software that identifies faces with 99% accuracy, irrespective of the ethnicity of the face being searched. Access to this database was marketed as being sold and used only by law enforcement agencies. However, when Clearview AI’s client list was leaked, it was revealed that many organizations outside of the law enforcement area had also paid for access to this database. Clearview AI has subsequently stated that they will no longer provide access to their database for companies or organizations that are not affiliated with law enforcement. Clearview is currently involved in legal disputes with many large tech companies, and is banned in Illinois. Appropriate security measures, both technical and legal, are necessary to support the appropriate use of databases containing biometric data.

Pages: 5

There was a sudden global adoption of Zoom as the medium for online work in the wake of sudden measures necessitating remote work conditions. Undoubtedly, the use of Zoom brought convenience to people’s daily lives while working remotely. However, Zoom is not immune to security issues. One of these security issues is called Zoombombing, a novel cyberattack that harms user trust in Zoom. In brief, Zoombombing is a situation when an uninvited person joins a meeting. The uninvited person can then do unpleasant or disruptive things during the meeting. The emergence of Zoombombing attacks necessitated the implementation of appropriate enterprise-level security measures to limit the prevalence and recurrence of these attacks.

Pages: 4

In this modern world, technology plays a major role in almost every sector and is used in our day-to-day lives to make them better and easier. The healthcare sector has experienced many advantages from the adoption of technology. Transitioning from paper to electronic records has had a significant effect on the efficiency and effectiveness of medical services. The number of attacks designed to compromise healthcare sector data is increasing, and the compromised identities and private details of patients are on sale on the dark web. Attackers are driven by various motives and have access to different resources that can be used to obtain confidential information and login credentials. Successful attacks can grant hackers access to and complete knowledge of a healthcare provider’s information system.

Pages: 3

In e-commerce, there are several use cases that introduce vulnerabilities.

Pages: 8

Healthcare sectors are starting to adopt unseen aides. From improving patient diagnoses and treatments to clinical decision support, increasing investment in artificial intelligence (AI) is a testament to industrial confidence in AI’s potential to unlock major medical breakthroughs. The increasing adoption of AI has enabled better medical care in diagnoses and treatment, empowering healthcare professionals to make better decisions. However, due to the technological advancement in this sector, there has been an increase in cybersecurity attacks, with threats aimed at stealing personal information or disrupting the operations of the hospitals. As the healthcare sector becomes more digitalized, there are more Internet-connected devices deployed and integrated to share data between medical centers. As such, healthcare organizations are starting to adopt AI as a tool to protect these systems and devices from external hackers.

Pages: 10

No chapter abstract available.

Pages: 8

This work aims to discuss aspects of identity theft by deepfakes. Deepfakes are convincing videos digitally manipulated to present people’s speeches and actions that have never happened. A person’s behavior, facial expression, and voice can be mimicked by neural networks on which deepfakes depend. Deepfakes could become a threat to our identities. Cybercriminals can use deepfakes to steal our identities so that they can access or create online accounts and commit fraud in our names. A theoretical framework for addressing the identity theft by deepfakes problem comprises procedures of legislation enforcement, security policy revision, and security mechanism enhancement. Governments, such as the US and China, have enacted new laws that criminalize certain deepfakes. Security policies should be revised to add provisions on how to deal with requests or orders originating from phone calls and voice chats. Employees should be trained to realize that sharing lots of personal photos and voice snippets on social media makes them vulnerable to deepfakes. Appropriate access control and security mechanisms should be enhanced in organizations. Authentication services that use biometric facial recognition should be tested to verify that they can detect deepfakes.