Woolfson Eye Institute Security Consideration When Making Partnerships Discussion (3) discussions First – Chapters 18-22 in the textbook, IT Governance

Woolfson Eye Institute Security Consideration When Making Partnerships Discussion (3) discussions

First –

Chapters 18-22 in the textbook, IT Governance

https://www.owasp.org/index.php/SQL_Injection

https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-83r1.pdf

You head up compliance at BigBigBank. You have worked hard with the IT department and the General Counsel to set a standard for validating the security of business partners before you send non-public data to them.

One of your compliance team just called you to tell you that she was told that the Loan department has “improved” the way it analyzes personal loan applications. The department’s Senior VP was introduced to the CEO of www.LoanScoreRobot. That company offers a cloud-based application that applies a combination of machine learning and artificial intelligence to help customers reduce fraud. You upload your loan applications to LoanScoreRobot, and it returns a recommendation – reject or approve – within 24 hours.

This deal was not reviewed with counsel but was signed by the Senior VP of loans. You call and ask two questions:

What is the security that LoanScoreRobot provides for BigBig’s data? (Answer: “Well, they have important clients. It must be OK.”)
How do you know that the recommendations aren’t based on unlawful factors – could it be “redlining” some areas of the city? ( Answer: “They didn’t say, but I haven’t heard any of our competitors who use them for loan scoring complain!”)

For your primary post, tell the class your reaction. Is this acceptable? How do you view these two risks? What would you recommend be done? For your responses, critique at least 2 of your colleagues’ posts. Did they go far enough in their recommendations? Too far? Operationally, how would you implement their recommendations differently?