How equifax neglected cybersecurity and suffered a devastating data breach

Case Study Data Breach At Equifax

Thoroughly read the case. It is recommended that you read 2-3 times. (Attached)
Prepare a 5-page report (12-point font, double spaced not including the title page or reference page), that addresses the following questions:
Identify the key factors that created the weak security situation in a company.
Discuss vulnerabilities that were exploited in Equifax incident. Provide assessment of appropriate organizational and security controls that were put in place by the company before the breach.
Consider the measures the company has taken to recover from the incident.
Evaluate post-attack security measures. Discuss and prioritise the risks.
Could have this incident been prevented
Evaluate the company’s response to this incident and the measures proposed by US government. Which of these measures can be adopted by other companies?

Reference Articles

GAO. (2018). Actions taken by Equifax and federal agencies in response to the 2017 breach. Retrieved from https://www.gao.gov/products/GAO-18-559

Singer, P. W., & Friedman, A. (2014). Cybersecurity and cyberwar: What everyone needs to know. New York, NY: Oxford University Press. Retrieved from https://is.muni.cz/el/1423/podzim2018/BSS469/um/P.W._Singer__Allan_Friedman_Cybersecurity_and_Cyberwar__What_Everyone_Needs_to_Know___2014__Oxford_University_Press_.pdf

Contemporary Issues in Business: A Case Approach

Various Professors

BUSI 4023

Yorkville University

Table of Contents

Student Guide to the Case Method: Note 2— Performing a Case Analysis.....................................5

Student Guide to the Case Method: Note 4—Preparing a Written Case Report............................15

Brand W: Strategizing for Omni-Channel Retail.............................................................................29

WestJet: A New Social Media Strategy..........................................................................................43

The Panic of 2008 and Brexit: Regional Integration versus Nationalism........................................55

Data Breach at Equifax...................................................................................................................75

OrganiGram: Navigating the Cannabis Industry with Grey Knowledge........................................103

Contemporary Issues in Business: A Case Approach BUSI 4023

Various Professors Yorkville University

2.

9B18M054

STUDENT GUIDE TO THE CASE METHOD: NOTE 2—PERFORMING A CASE ANALYSIS Susan J. Van Weelden and Laurie George Busuttil wrote this note solely to assist students with understanding and using the case method. The authors do not intend to illustrate either effective or ineffective handling of a managerial situation. The authors may have disguised certain names and other identifying information to protect confidentiality. This publication may not be transmitted, photocopied, digitized, or otherwise reproduced in any form or by any means without the permission of the copyright holder. Reproduction of this material is not covered under authorization by any reproduction rights organization. To order copies or request permission to reproduce materials, contact Ivey Publishing, Ivey Business School, Western University, London, Ontario, Canada, N6G 0N1; (t) 519.661.3208; (e) cases@ivey.ca; www.iveycases.com. Copyright © 2018, Ivey Business School Foundation Version: 2018-03-22

A case or case study is a real business story that requires you to step into the role of a manager or a member of the management team that faces a dilemma, or the role of a consultant assisting an organization that faces a dilemma. Acting in that role, you are tasked with resolving the issues or problems that the profiled organization is facing at a particular moment in time. Alternatively, you are asked to evaluate and choose among opportunities that exist for the organization at a specific point in time. Those issues and opportunities may be confined to a specific discipline in business, such as accounting, marketing, human resources, or strategic management. However, the challenges often involve several disciplines, reflecting the multi- faceted nature of business in practice. The case method involves learning by doing. It provides you with an opportunity to apply your knowledge and skills to real-life and realistic situations. Listening to class lectures, reading about various business subjects, and performing quantitative and qualitative analyses to solve well-defined problems are all valuable learning tools; however, management skills and knowledge cannot be developed by these methods alone. Management requires more than applying a storehouse of prepackaged solutions or standard answers. Each situation faced by management has its own variables unique to the situation. Using the case method provides you with valuable opportunities to develop and practise skills you will need in those situations. 1. INTRODUCTION TO PERFORMING A CASE ANALYSIS For all case assignments, you will be required to analyze the case by performing one or more of the basic steps of analysis (i.e., identify the issues, analyze the issues, develop and evaluate alternative solutions, and recommend a course of action). Analyze, in the broad sense, refers to the full process of applying the case method. Analyze can also specifically refer to the case analysis step of probing into and dissecting issues. In both contexts, analysis is a critical component of the case method. This note of the Case Guide Series guides you through the specific process of analyzing a case. This method for basic case analysis can be used for several purposes: discussing the case in class, writing a report, making a presentation, and writing a case exam.

F or

u se

o nl

y in

th e

co ur

se C

on te

m po

ra ry

Is su

es in

B us

in es

s: A

C as

e a

t Y or

kv ill

e U

ni ve

rs ity

ta ug

ht b

y V

ar io

us P

ro fe

ss or

s fr

om O

ct ob

er 1

1, 2

01 9

to O

ct ob

er 1

1, 2

02 2.

U

se o

ut si

de th

es e

pa ra

m et

er s

is a

c op

yr ig

ht v

io la

tio n.

5

Page 2 9B18M054 2. IDENTIFY THE ISSUES The first step in analyzing the case is to identify the organization’s issues, problems, and opportunities (collectively referred to hereafter as “issues”) that you will attempt to resolve. A clear understanding of the issues is paramount; otherwise, your analysis and your generation of alternative solutions will lack the necessary focus. Although some cases will direct your attention toward specific issues (especially early in your business studies), a considerable degree of judgment is usually required to identify the issues. 2.1. Pay Attention to Questions Questions from three sources provide important clues about the key issues:  The principal actors or characters in the case. These clues are musings or direct questions raised by

the principal actors themselves. You can usually find these clues at the beginning and end of the case, but they might also be sprinkled throughout the case.

 Your instructor. Questions can often be found in the syllabus or course package, or on the course website. These questions are sometimes intended to limit your analysis to issues that fit within a specific topic of discussion. At other times, these questions are intended to focus your attention on the most important issues.

 The author of the case. In cases presented in textbooks, the case author sometimes provides attention- directing questions at the end of the case.

If, in your analysis of the case, you have not answered all of the questions posed in the case or in your course syllabus, you have likely either omitted an important issue or become sidetracked by minor issues. Moreover, even if you have resolved some issues, if you have not addressed all of the questions posed in the case or in your course syllabus, your analysis will likely fail to totally satisfy your instructor—and later, your supervisor or client. Especially in upper-level courses where the cases are, in general, more complex, your instructor could expect you to look beyond the more obvious issues or those suggested by the case principals to consider issues that people close to the situation could have overlooked. You should address these supplementary issues in addition to, not instead of, addressing the specific requests posed by principals in the case or by your instructor. 2.2. Distinguish Symptoms from Issues To correctly identify issues, it is important to distinguish between symptoms and underlying causes. Your goal should be to focus on the underlying causes. To uncover them, ask the question “Why?” until you can no longer provide a satisfactory answer. For instance, an organization might be suffering from low productivity. Asking why productivity is low might lead you to conclude that employee morale is low and that employees are not motivated to perform well. Probing further, you might find that both of these issues arise because the reward system does not adequately recognize good performance. Low productivity and employee morale are symptoms of the underlying cause. Alternatively, an organization might be plagued by low customer retention. Asking why customers are going elsewhere might lead you to conclude that customer service is poor, product defect rates are high,

F or

u se

o nl

y in

th e

co ur

se C

on te

m po

ra ry

Is su

es in

B us

in es

s: A

C as

e a

t Y or

kv ill

e U

ni ve

rs ity

ta ug

ht b

y V

ar io

us P

ro fe

ss or

s fr

om O

ct ob

er 1

1, 2

01 9

to O

ct ob

er 1

1, 2

02 2.

U

se o

ut si

de th

es e

pa ra

m et

er s

is a

c op

yr ig

ht v

io la

tio n.

6

Page 3 9B18M054 existing competitors have improved their product, and a new competitor has entered the market. The last two items are root causes because asking “why” will not lead to further answers. Therefore, they are issues to resolve even though they are not within the organization’s control. Asking “why” for the first two items might lead you to the third issue, namely that the company’s goals and reward systems emphasize efficiency rather than product quality. 2.3. Limit Issues to a Manageable Set Once you have identified the issues, you might need to reduce them to a manageable size to enable you to effectively carry out the subsequent steps in case analysis. For some cases, you might be required to resolve a single issue. However, you should still identify sub-issues, and decide which are most important and which you have the time and space to tackle. For example, the issue might be to set an admission price for a new museum. Possible sub-issues to consider include fit with the mission of the museum, customers’ ability and willingness to pay, the possibility of differential pricing (e.g., lower rates for students), competing forms of entertainment and their admission prices, costs that need to be covered by the admission price, and the break-even point. To identify the most important sub-issues, consider the information in the case, the questions discussed in Section 2.1, and the nature of the course. Other cases might present multiple issues. You might find it helpful to look for relationships among the issues and cluster them under one overarching issue. For instance, in an organizational behaviour case, you might be able to trace several issues—such as unclear decision making processes, inability to deal with job stresses, and inability to delegate—to the root issue of inadequate training of managers. Dealing with one issue is easier than dealing with three separate issues and will lead to better solutions. Other cases might not have an overarching issue; instead, you might face a seemingly unconnected set of distinct issues. You will then need to prioritize the issues, using the questions referred to in Section 2.1, and your judgment, so that you give adequate time and attention to the most important issues. 3. ANALYZE THE ISSUES Analysis involves examining the issues in detail. It requires that you dissect the issues and consider them closely to understand their nature and key elements. 3.1. Use Case Facts One aspect of analysis is using case facts to develop a detailed understanding of the issues. You can use the case facts to help build logical arguments, develop findings, and draw educated inferences rather than casual guesses. For instance, if the issue in an organizational behaviour case is inadequate managerial training, facts from the case should indicate that the training provided to managers did not sufficiently clarify decision making processes or how to delegate tasks, or both. Or, for a marketing case, an issue with increased competition might be supported by the case facts describing the entrance of new competitors into the market, new products introduced by competitors, or price reductions offered by competitors. Many important case facts are contained in a case’s figures and exhibits. These case facts could include data about the worldwide market size, the competition, the company’s revenues and profit, industry sales, product prices, or organizational charts. Study each figure or exhibit to determine the key insights it offers.

F or

u se

o nl

y in

th e

co ur

se C

on te

m po

ra ry

Is su

es in

B us

in es

s: A

C as

e a

t Y or

kv ill

e U

ni ve

rs ity

ta ug

ht b

y V

ar io

us P

ro fe

ss or

s fr

om O

ct ob

er 1

1, 2

01 9

to O

ct ob

er 1

1, 2

02 2.

U

se o

ut si

de th

es e

pa ra

m et

er s

is a

c op

yr ig

ht v

io la

tio n.

7

Page 4 9B18M054 Go beyond the specific facts highlighted in the body of the case; figures and exhibits usually include additional facts that can be interpreted in other ways to enhance your analysis. 3.2. Use Business Concepts, Models, and Tools Another aspect of analysis is the use of business concepts, models, and tools to analyze the issues. For example, in an organizational behaviour case, you could use equity theory or expectancy theory to explain why an organization’s reward system has been unsuccessful in motivating employees. In a marketing case, you could apply the model of a product life cycle or the concept of a target market; you could also calculate market share and changes in market share. To analyze issues in an accounting case, you could use tools such as contribution margin analysis or capital budgeting. In an integrated strategic management case, you might apply the concepts of value chain and competitive advantage, compute financial ratios, and apply tools such as a competitive position matrix and Porter’s five forces framework. You will sometimes be given directions to apply specific concepts or tools; other times, you are expected to use your discretion in selecting the most relevant concepts or tools to apply. For some cases, the analysis will largely rely on qualitative models and tools. However, many cases will involve both qualitative and quantitative elements. Note 7 of the Case Guide Series—“Using Common Tools for Case Analysis,” No. 9B18M059—describes some common qualitative and quantitative tools for analyzing issues and possible courses of action. 3.3. Use Outside Research Sparingly Analysis might also include conducting and integrating outside research—for example, researching the industry and competitors—to supplement the information provided in the case. However, for many cases you will encounter in your studies, you will not be asked to obtain outside research beyond any background knowledge required to understand the facts of the case. This approach is consistent with the requirement that you put yourself in the role of either the manager or a member of the management team making the decision. You are asked to make that decision based on the same information the actual managers in the actual organization had at that actual point in time. 4. DEVELOP AND EVALUATE THE ALTERNATIVES In this step of a case analysis, you first identify alternative solutions to address the issues you previously identified and analyzed, and then evaluate the advantages and disadvantages of each alternative. The best alternatives will resolve more than one of the identified issues. 4.1. Develop Alternative Solutions When identifying alternative solutions, go beyond the status quo (which might or might not be a viable solution, depending on the company’s situation) and beyond identifying a poor alternative and a very good one. Strive to develop multiple viable alternatives that are not chosen with a bias toward or against a particular course of action. Creative thinking will enable you to develop novel approaches. Avoid a premature evaluation of the alternatives, and try to develop as many alternatives as possible.

F or

u se

o nl

y in

th e

co ur

se C

on te

m po

ra ry

Is su

es in

B us

in es

s: A

C as

e a

t Y or

kv ill

e U

ni ve

rs ity

ta ug

ht b

y V

ar io

us P

ro fe

ss or

s fr

om O

ct ob

er 1

1, 2

01 9

to O

ct ob

er 1

1, 2

02 2.

U

se o

ut si

de th

es e

pa ra

m et

er s

is a

c op

yr ig

ht v

io la

tio n.

8

Page 5 9B18M054 Even if you know the course of action the organization ultimately chose, resist the temptation for that knowledge to bias your development and evaluation of alternatives. This topic is further discussed in Section 5.3. 4.2. Evaluate the Alternative Solutions Assessing the advantages and disadvantages of each alternative solution represents another form of analysis, as is quantifying the financial impact of an alternative solution. Some of the case analysis tools described in Note 7 can be used to analyze alternative solutions, in addition to being used to analyze issues. When you evaluate your alternatives, present a balanced assessment of both the advantages (pros) and disadvantages (cons). Use of biased or one-sided arguments undermines both the usefulness of your analysis and its credibility. Where possible, suggest how to overcome any significant disadvantages. If you have difficulty generating pros and cons, establish a set of criteria for decision making and use those criteria to identify pros and cons. For example, in a strategic management case, decision criteria might include the degree to which the action:  fits with the organization’s mission, value proposition, and goals;  fits with stakeholder preferences;  is profitable;  increases market share;  enhances the organization’s brand;  capitalizes on specific external opportunities;  helps to mitigate external threats;  uses internal strengths;  avoids or mitigates internal weaknesses;  builds on an existing competitive advantage or helps to create a competitive advantage;  requires additional resources and competencies;  can be accomplished within the organization’s existing structure; or  mitigates or increases risks, including environmental and reputational risks. The principal in the case or the questions in your syllabus or course pack might have alerted you to some of the decision criteria to be applied. If so, be sure to use those as your starting point in establishing a set of decision criteria. Measuring alternatives against decision criteria also helps to keep the analysis consistent, reducing bias. For instance, by applying the criteria, you avoid citing a loss of market share as a disadvantage of one alternative but overlooking the same disadvantage in another alternative that is your implicit favourite. When identifying pros and cons, be as specific as possible. For instance, instead of stating that an alternative will be unprofitable, indicate that the alternative will result in net losses of $72,800 and $52,500 in years one and two, respectively. Instead of claiming that an alternative will increase market share, indicate that it will increase market share by an estimated three to four per cent by year five. Rather than arguing that an alternative will capitalize on an organization’s strengths, indicate the specific strengths that will be capitalized on and how they will be leveraged. Fo