Question

For the Office of Personnel Management case study, identify examples of the following incident contributors:

• Technical concerns
• Human behavior
• Business decisions

Then explain which you think is the most significant factor.

After you have posted, you need to reply to at least 2 other students in their threads.

Answer 1

For the Office of Personnel Management (OPM) case study, examples of the following incident contributors are:
* Technical concerns: Examples are poor security protocols. They did not implement multi-factor authentication for employees and contractors. They had not upgraded their legacy systems to the new and latest ones.

* Human behavior: Examples are the office as a whole with the members or employees in it did not comply with the IT security program of the agency.

* Business decisions: Examples are of it lacking an effective managerial structure for the implementation of reliable IT security policies. Lack of user training and awareness that were provided to the employees, staff, or personnel.

The one I think is the most significant factor is the "technical concern" as there were poor security protocols that they followed and used. Hence, the technical concern is the core reason for the data breach. Most of the government offices, agencies, and entities are outdated in using technologies, especially Information Technology (IT) as compared to corporations and enterprises. This is the case in any country. Governments and related offices use legacy systems, applications, devices, software, etc. This is the main cause of attacks as these systems are vulnerable. Also, OPM had not upgraded their Intrusion Detection System (IDS) systems. Specifically, OPM's sensitive information such as Social Security Numbers (SSNs) was not encrypted as they had outdated and legacy systems with insufficient capabilities. Lack of security on the jump box that had access to virtually the entire OPM network. Many loopholes in the security process and OPM infrastructure, especially the IT infrastructure. They did not use the Two Factor Authentication (2FA) or Multi-Factor Authentication (MFA) mechanism.