IS - Case Study - Flayton Electronics

Information Systems
for BFSI
Flayton Electronics
Case Presentation
Akshat Deshmukh
Akhilesh Bajpai
Kunal Chawla
Pranjal Kala
Rahul Phulwani
Shivam Kalra
GROUP 2
Case Analysis
"Boss, I think Someone Stole Our Customer Data"
Problem Statement:
Company's customer data has been compromised

Potentially leading to financial losses
And damage to the company's reputation
Flayton Electronics
Background
Flayton Electronics discovered a possible breach
in their security.
Privileged customer information may have been
compromised.
Bank informed the firm that credit card
information of several customers had been
leaked.
Possible fraudulent transactions may have taken
place.
CEO of the firm, Bret Flayton is faced with the
challenge of making a tough decision.
The firm is exposed to various risks.
The firm needs to develop a risk management
plan to manage and mitigate potential risks.
Factors Contributing to
The Problem:
Incompetent Management
The company's management team
is unsure of how to handle the
situation and is at risk of making
decisions that could further harm
Lack of Proper the company's Image.
Security Measures
The company did not have
adequate security measures in
place to protect its customer data.
Customers at Risk
The company's customers are at
risk of identifying theft and other
financial crimes as a result of the
data breach.
Insufficient Technology
Requirements
The data breach was discovered
by accident, indicating a lack of
monitoring and detection systems.
What is PCI-DSS?
Payment Card Industry

Data Security Standard
Set of security standards created by the major credit card companies,
such as Visa, Mastercard, American Express, and Discover.
Designed to ensure that any company that accepts, processes, or stores
credit card information maintains a secure environment to protect
sensitive cardholder data from being accessed, stolen, or used
fraudulently.
PCI DSS compliance is mandatory for all merchants that accept card
payments.
Companies are required to be periodically assessed for compliance by
an independent Qualified Security Assessor (QSA) or an Internal
Security Assessor (ISA).
Non-compliance can result in fines, penalties and loss of ability to
accept credit card payments.
1) Was The Company PCI
Compliant?
As mentioned in the case:
The case study does not mention if Flayton Electronics was
compliant with PCI DSS at the time of the data breach.
The company had a list of complexities of recent improvements
and multiple high-priority tech projects in various stages of
implementation.
PCI compliance required regular scans by external auditors,
with penalties for failure.
If the company was not PCI compliant, it could have contributed
to the data breach and resulting problems.
The company did not pay enough attention to regularly
monitoring and ensuring PCI compliance.
Company met the compliance requirement 75% of the time,
which is better than average but still not enough to prevent the
data breach.
The authorities do not scan the company every day and
ultimately it is up to the management.
Disabled Firewall
Flayton Electronics had a wireless

inventory control system in place to
optimize inventory and reduce costs.
The system used real-time transaction
data to trigger replenishment and
automate reorders.
The wireless inventory control system
included a firewall for security.
The firewall was somehow disabled,
broadcasting internal company data
to unauthorized parties.
This vulnerability allowed data breach
to happen, by a person with right
equipment and wrong motive.
Different Approaches
Available
Forthright
Apology Do nothing
Approach
Holding a press Issue a Letter to Do nothing and
conference the customers that wait for law
putting Flayton there has been a enforcement's
Elctronics in the breach and directions
front situation is being
addressed
How would we respond to the crisis?
Contain the breach: The first priority should be to stop the breach from continuing and prevent
1
any further data from being compromised. This may involve taking systems offline or
disconnecting from the internet to prevent the perpetrators from accessing the data.
Assess the damage: The company should assess the extent of the data breach and determine
2
what data has been compromised. This will help the company understand the full scope of the
problem and take appropriate action.
Notify relevant parties: The company should notify relevant parties, such as law enforcement,
3
customers, and regulatory bodies, of the data breach. This will help ensure that the appropriate
authorities are involved and that the company's customers are made aware of the situation.
Implement additional security measures: The company should review and strengthen its
4
security measures to prevent future data breaches. This may involve implementing new security
protocols, updating software and systems, and training employees on data security best
practices.

IS - Case Study - Flayton Electronics

Uploaded by

Copyright:

Available Formats

IS - Case Study - Flayton Electronics

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

IS - Case Study - Flayton Electronics

Uploaded by

Copyright:

Available Formats

Information Systems

Company's customer data has been compromised

Payment Card Industry

Flayton Electronics had a wireless

You might also like