Read the Case study below and answer the questions the follow:

Question

A glitch in big-four bank First national Bank's (FNB's) mobile app has exposed personal information of customers applying for home loans using the digital platform. It was discovered that if an FNB client used the mobile app to apply for a home loan, they would easily see the personal details of other home loan applicants. The exposed data includes personal identifiable information, such as names, identity numbers and contact details. An FNB client who discovered the exposed data has since informed the Information Regulator, asking it to take the necessary measures against the big-four bank.
"I wish to lodge a complaint against First National Bank in respect to a breach of personal information through their banking application," the client reported to the regulator.
"Whilst applying for a home loan through the service,
I noticed that I was able to access other individuals' personal information, such as ID numbers, contact details and various financial information, which is visible to other applicants, including my personal information.
"I have documented this by way of screenshots and have evidence to support this data breach.
I believe my rights in terms of the POPI Act [Protection of Personal Information Act] have been infringed and poses a huge personal security risk," stated the client.
"Your e-mail contents have been noted and will be addressed with the responsible party," says a complaints and investigations officer of the Information Regulator in an e-mail..Under South Africa's data privacy law, the Protection of Personal Information Act (POPIA), organisations must inform the Information Regulator if they expose the personal information of data subjects to unauthorised third parties without their approval. FNB has acknowledged exposing the personal information of its clients, saying it is in the process of notifying the relevant authorities, as well as those who have been impacted.
While the financial institution has rushed to disable the app functionality in question, it did not disclose how many customers were impacted.
Says the bank in a statement: "FNB is aware of a technical error that made the information of certain home loan applicants, such as full names and ID numbers, visible to other home loan applicants who logged in via our digital channels.
FNB takes the privacy and protection of customer information very seriously, and the affected functionality has since been temporarily disabled to resolve the root cause of the issue.
We are in the process of contacting the affected customers and the appropriate regulator.
Customers requiring any assistance can contact us through Secure Chat on the FNB app."
FNB recently made sweeping changes to its brand, including a redesign of its popular banking app.
The FNB app, introduced more than a decade ago, saw its active transacting base exceed 4.7 million customers, based on results for the year ended 30 June 2022.
The data exposure comes at a time the Information Regulator is receiving an unprecedented number of reports about data breaches in South Africa.
Speaking during the Governance, Risk and Compliance 2023 conference last week, advocate Pansy Tlakula, chairperson of the Information Regulator, revealed that data breaches are a big problem in this country - much bigger than people think. "Every public body,
every private body that has suffered a security compromise or data breach has to notify us - there is no threshold. Even if one person was breached, they still have to notify us. If you look at 500 (it's 564 to be precise), it means that in a month, this country suffers about 56 data breaches - major and minor ones," she revealed. "I think we are one of the highest in the world with data breaches."..POPIA sets down firm frameworks that companies have to abide by to avoid fines, criminal persecution and potential reputation loss. Breaching the rules and regulations outlined by this Act can have serious financial implications for the business - repercussions that can cost a fortune and have long-lasting consequences, such as reputational damage.
The Act makes provision for fines of up to R10 million and a jail sentence of up to 10 years, depending on the seriousness of the breach..Based on the FNB study above, recommend the four (4) stages of the Deming (PDCA) cycle to assist with proper management of information risks..Write an answer for 15 marks

Answer 1

The Deming Cycle, also known as the PDCA (Plan-Do-Check-Act) cycle, is a systematic method for continuous improvement in processes and products. In the context of data management and risk mitigation, applying the PDCA cycle can significantly enhance data protection strategies and address issues such as those experienced by First National Bank (FNB) due to the recent data breach. Here’s how FNB can implement the four stages of the PDCA cycle to manage information risks effectively:

1. Plan (3 marks)

In this initial stage, FNB must identify and assess the potential risks associated with their mobile applications, particularly those that process sensitive personal information like home loan applications. The planning phase will involve:

• Risk Assessment: Conduct a thorough analysis to pinpoint vulnerabilities in the app that could lead to similar data exposure issues. This may include conducting penetration testing, vulnerability assessments, and reviewing existing security protocols.

• Compliance Review: Ensure that internal policies align with the Protection of Personal Information Act (POPIA). FNB should develop a strategic plan that outlines how to adhere to legal requirements, including preventive measures to mitigate information risks.

• Set Objectives: Establish clear, measurable objectives related to data security improvements, such as reducing vulnerabilities by a certain percentage within a specific timeframe.

2. Do (3 marks)

During the 'Do' phase, FNB should execute the strategies and plans developed in the first stage:

• Implementation of Security Measures: Update the mobile app’s security features by integrating encryption protocols, two-factor authentication, and access controls to ensure that personal information is safeguarded.

• Training and Awareness: Conduct training sessions for all staff, particularly IT and customer service teams, on data protection policies and best practices to create a culture of security awareness within the organization.

• Pilot Testing: Consider rolling out the updated app functionalities to a small group of users first to minimize risk while allowing for real-world testing.

3. Check (3 marks)

In the 'Check' stage, FNB should evaluate the effectiveness of the implemented measures:

• Monitoring and Reporting: Establish systems for continuous monitoring of the app's performance and security. FNB can utilize intrusion detection systems (IDS) to identify unauthorized access attempts.

• Performance Indicators: Use specific key performance indicators (KPIs), such as the number of reported incidents or breaches, to assess the effectiveness of the security enhancements. Regular audits and assessments against these KPIs will offer valuable insights.

• User Feedback: Actively gather feedback from customers using the app to identify any issues or concerns they experience, and assess whether their personal data remains secure.

4. Act (3 marks)

In the final stage, FNB should act upon the findings from the evaluation phase to ensure continuous improvement:

• Review and Adjust Policies: Based on the evaluation findings, FNB should update its data protection policies or measures accordingly. If specific vulnerabilities are identified during the review process, they should be addressed immediately.

• Incident Response Plan: Enhance the incident response plan based on lessons learned from the breach. This should include a clear communication strategy for notifying affected customers and regulatory bodies in the event of future breaches.

• Continuous Improvement Culture: Foster a culture of continuous improvement where regular updates and enhancements to security measures are part of the organizational ethos. This may involve annual reviews of risk management strategies and security software.

Implementing these four stages of the Deming (PDCA) cycle can help FNB effectively manage information risks, thus enhancing customer trust and compliance with data protection regulations. Each stage is crucial for creating a robust framework that not only addresses immediate concerns but also establishes a sustainable approach to information security.