Information Assurance Plan for T-Mobile’s 2021 Data Breach

Overview of Goals and Objectives

T-Mobile’s Information Assurance Plan (IAP) aims to protect customer and corporate information by improving the security of information systems in terms of confidentiality, integrity, and availability. Since the implementation of the new data protection regulation, T-Mobile needs to enhance its cybersecurity measures even more owing to the 2021 leakage of data of over 40 million customers’ information (Safitra et al., 2023). The goals of this plan are to use effective methods in data encryption to prevent exposure of sensitive data, strict access to such data, and continuous monitoring of the computer network: Information Assurance Plan for T-Mobile’s 2021 Data Breach.

These steps are taken purposefully to reduce risks, adapt to industry standards and regain the consumers’ confidence. A good IAP not only minimises future attacks but also protects organisational operations and competitive edge (Von Solms & Van Niekerk, 2020). Furthermore, based on its plan, T-Mobile wants to follow recognized cybersecurity standards like ISO/IEC 27001 and NIST that would provide enhanced security against new threats. The company also aims to improve the response to incidents and promote security in the company’s employees.

Confidentiality, Integrity, and Availability of Information

T-Mobile safety systems fail to protect the CIA triad adequately within their existing framework. The failure to properly encrypt data combined with weak security protocols exposed private information such as Social Security numbers and driver’s license material to attackers (Pureti, 2021). For secure confidentiality, the organization needs to deploy AES-256 encryption beside MFA protocols with continuous data privacy policy training for staff.

The absence of complete audit trails and data validation checks puts customer data integrity at high risk because unauthorized data alterations become difficult to detect. Real-time logging systems with robust version control mechanisms and regular integrity checks serve as essential measures to preserve data accuracy and reliability (Cram et al., 2017).

System downtimes resulting from security incidents create availability issues that disrupt millions of customers’ services. Redundant systems combined with failover plans and consistent hardware maintenance allow T-Mobile to reduce service interruptions while ensuring availability (Samonas & Coss, 2014). T-Mobile can enhance its cybersecurity framework by implementing holistic measures to bring its structure in line with CIA triad principles.

At the moment, the data protection measures that T-Mobile has in place have major flaws in maintaining the CIA triad. Privacy was an issue because there were poor encryption standards and poor access control measures, and the data was exposed to attackers, including personally identifiable details such as Social Security numbers and driver’s licenses (Pureti, 2021). Customer data is now threatened by the lack of complete audit trails and data validation checks to identify unauthorized changes to customer data (Samonas & Coss, 2014). Further, the duration of system downtimes during security incidents poses risks to data availability in addition to disrupting services desired by millions of customers.

Mitigating these threats calls for the use of enhanced encryption mechanisms, integration of RBAC, and utilization of failover systems to ensure high availability (Cram et al., 2017). Moreover, the implementation of data loss prevention (DLP) tools and real-time threat intelligence feeds reinforces data confidentiality and integrity. Developing safe cloud-based storage systems and other backup service options will guarantee low impacts on services and the maximum availability of the system in case of similar calamities in the future.

Evaluation of Current Protocols and Policies

T-Mobile has already implemented fundamental controls in the field of cybersecurity, including firewalls, antivirus software, and intrusion detection systems. However, these controls have failed to be effective enough against cyberattacks of higher levels (Inayat et al., 2024). Adequate password standards are absent, and the use of multiple-factor authentication (MFA) makes it an easy target for credential attacks. Similarly, inadequate protection measures and an overall lack of a comprehensive incident response plan proved to hinder the early detection of the 2021 breach (Pureti, 2021).

Lack of preparedness at the organizational level is also evident in employee communication security training, where employees are not adequately prepared to notice and combat phishing attacks or other social engineering acts (Pureti, 2020). The organization also does not frequently undergo security audits and penetration tests, which are essential in ensuring that weaknesses are regularly reviewed and addressed. Also, ineffective and aging software and hardware are compromised by threats and hacker attacks resulting from open and uncontrolled entry points, which are seldom patched. These problems show the importance of ongoing security audits and the need to update security measures according to current threats.

Some of the challenges that may come along with the new IAP implementation may include budgetary constraints, organizational resistance to change, and the fact that it may be necessary to train the employees extensively. Lack of capital to fund buying security technologies and hiring trained employees may be an issue. Moreover, it is often difficult for organizations to come out of these fixed ways of functioning and implement new security protocols because of organizational lock-in; training and ensuring compliance from the employees cost time and resources (Mulder et al., 2023).

The practical implementation of these advancements may also complicate their integration into existing security frameworks, thereby affecting operational capabilities if extensive planning and resource expenditure is needed. Compliance requirements can add more pressure and limit the flexibility of setting security controls, thus requiring a good understanding of the compliance and security needs of your business and the industry.

References

Cram, W. A., Proudfoot, J. G., & D’arcy, J. (2017). Organizational information security policies: A review and research framework. European Journal of Information Systems, 26(6), 605-641.

Inayat, U., Farzan, M., Mahmood, S., Zia, M. F., Hussain, S., & Pallonetto, F. (2024). Insider threat mitigation: Systematic literature review. Ain Shams Engineering Journal, 103068.

Mulder, V., Mermoud, A., Lenders, V., & Tellenbach, B. (2023). Trends in data protection and encryption technologies (p. 262). Springer Nature.

Pureti, N. (2020). Implementing multi-factor authentication (MFA) to enhance security. International Journal of Machine Learning Research in Cybersecurity and Artificial Intelligence, 11(1), 15-29.

Pureti, N. (2021). Incident response planning: Preparing for the worst in cybersecurity. Revista de Inteligencia Artificial en Medicina, 12(1), 32-50.

Safitra, M. F., Lubis, M., Fakhrurroja, H., & Yekti, Y. N. D. (2023, April). Lessons from the past: A historical literature review on cyber resilience. In World Conference on Information Systems and Technologies (pp. 47-56). Singapore: Springer Nature Singapore.

Samonas, S., & Coss, D. (2014). The CIA strikes back: Redefining confidentiality, integrity and availability in security. Journal of Information System Security, 10(3).

ORDER A PLAGIARISM-FREE PAPER HERE

We’ll write everything from scratch

---

Assignment Information

IT 549 Milestone One Guidelines and Rubric

Overview
For this course project, you are to select a large data breach that has occurred within the past four (4) years, containing more than 1 million records exposed. You will use this data breach to apply information assurance research and incorporate industry best practices into your recommendations for specific strategic and tactical steps. These skills are crucial for you to become a desired asset to organizations seeking industry professionals in the information assurance field.

Directions
In Module Two, you will submit your introduction to the information assurance plan. This section of the plan will provide an overview of the current state of the organization.

Provide a brief overview of the goals and objectives of your information assurance plan, including the importance of ensuring the confidentiality, integrity, and availability of information.

Your submission should answer the following questions: What are the benefits of creating and maintaining an information assurance plan around those key concepts? Are there current protocols and policies the organization has in place? Additionally, what deficiencies exist within the organization’s current information assurance policies? What are the potential barriers to implementation of a new information assurance plan?

Specifically, you must address the following rubric criteria:

I. Introduction
a. Provide a brief but comprehensive overview of the goals and objectives of your information assurance plan, including the importance of ensuring the confidentiality, integrity, and availability of information. What are the benefits of creating and maintaining an information assurance plan around those key concepts?

b. Assess the confidentiality, integrity, and availability of information within the organization.
c. Evaluate the current protocols and policies the organization has in place. What deficiencies exist within the organization’s current information assurance policies? What are the potential barriers to implementation of a new information assurance plan?

What to Submit
Your paper must be submitted as a 1- to 2-page Microsoft Word document with double spacing, 12-point Times New Roman font, one-inch margins, and at least three sources cited in APA format.