JPMorgan Chase & Co. -Risk Assessment Report

JPMorgan Chase & Co.
Risk Assessment Report
Based on the 2014 Data Breach
University of Washington
IMT 552
(For educational purposes only)
Team Members:
Akshay Ajgaonkar
Daniel Kapellmann
Divya Kothari
Dustin Chiang
Manasa Chitiprolu
Sandeep T. Maregowda

Table of Content
I. Executive Summary
II. Information Security in the Financial Industry
III. JPMorgan Chase Data Breach
IV. Stakeholders
V. Identification of Main Assets
VI. Risks Identification
VII. Risk Assessment
VIII. Risk Normalization
IX. Control Planning and Risk Treatment
X. Recovery and Incident Response
XI. Communication and Monitoring
XII. Strategic Recommendations
XIII. Annexes
XIV. References

Executive Summary
The summer of 2014 saw the biggest data breach in American banking history which resulted in
the loss of 83 million records from one of the leading banks in the world, JPMorgan Chase. In the
light of this cyberattack, we as a part of this special assessment team guided by the Chief Cyber
Security Officer, performed an overall assessment. The objective of this assessment was to
identify, assess and evaluate potential risks in order to provide the senior management with
recommendations for actions to prevent future similar breaches. The exercise, based on the ISO
31000 framework, started with the categorization of the overall risks in four clusters: Operational,
Strategic, Financial and Legal Risk. Then, the main six risks were assessed, normalized and
provided with consistent mitigation strategies. Finally, controls were planned and strategic
recommendations were written to involve the senior management into effectively handling future
management of information assets. Through this paper we have evaluated and assessed this
large scale data breach and made effective recommendations to ensure the safety of bank’s data.
(Please not that for purposes of this assignment various assumptions have been taken into
consideration wherever data was not available.)

Information Security in the Financial Industry
Information security is currently one of the main challenges faced by firms in the financial sector
due to the significant losses that may occur due to any breach. Establishing a secure environment
for information assets is a topic of utmost relevance, yet highly convoluted when considering the
diversity of the threats, actors involved and the difficulties of being one step ahead of new potential
scenarios.
According to the Cost of Data Breach Study: Global Analysis study by the Ponemon Institute, the
average cost of an incident in 2015 achieved an amount of $3.8 million dollars, representing an
increase of 23% during only the last two years. This sum accounts for an average of $145 to $154
dollars for each stolen record. (Ponemon Institute, 2015)
In case of the financial industry, the constant increase in the frequency of breaches and negative
impacts over the last few years has led to the creation of the largest non-government
cybersecurity market. Its overall estimated value reached $9.5 billion dollars in 2015 with the
highest estimated growth rate for the 2015-2020 period. In 2014, PwC calculated that financial
organizations spent $4.1 billion dollars collectively in cybersecurity and would spend another $2
billion dollars during the next two years. (Morgan, 2015)
JPMorgan Chase Data Breach
The 2014 cyberattack on the biggest bank in the USA, JPMorgan Chase & Co., was by far the
most serious intrusion in the history of American corporations. This breach resulted in JPMorgan
Chase & Co. losing data associated with approximately 83 million accounts (CNBC, 2015). The
stolen records consisted primarily, names of the account holders, addresses, phone numbers and
email addresses which were compromised by unknown hackers (Kurane & Wills, 2014).
Fortunately for the bank, the hackers were not able to retrieve information on sensitive personal
information about customers, such as social security numbers or account balances. As a
consequence, the firm did not suffer any irreparable harm.
According to The New York Times, the bank’s weak spot was a rather basic one. The breach
could have been stopped had the bank installed a second security authentication measure to one
of its servers in the vast network. It was found that some Eastern European Internet addresses
were used for the attack, but the bank refused to share any further details on the incident (Perlroth,
2014). Bearing in mind the significant amount of money that giant firms such as JPMorgan invest
on security, the recent breach represented an enormous danger for the company in terms of
reputation, economic losses and customer trust.
To make matters worse, the breach was discovered by the bank somewhat accidentally. In the
month of July, security employees of the bank learned that the website for the JPMorgan
Corporate Challenge, a charitable race organized by the bank, had been hacked and
compromised. The website being run by an outside vendor pointed back to a bigger problem with

the bank's own network. (Goldstein, 2015) Had this not been discovered, 90 servers of the Bank
being hacked would have gone unnoticed for another extended period of time.
Right after the news of the breach was made public, JPMorgan shares went down by 0.4% during
the after-hours trading (Sam Ro, 2014). A few months later, in June 2015, the executive who was
in charge of protecting JPMorgan Chase’s computer network from hackers was reassigned.
Instead of hundreds of personnel that he managed in the cyber-security unit, he has now been
asked to build relationships with the government, law enforcement and the remaining big U.S.
banks to mitigate the possibilities of future risks. (Robertson & Riley, 2015) Find a detailed
assessment of the former case attached in Annex # 2.
It may also be pertinent to note that despite the immediate thought of capturing this data would
have been for financial fraud or identity theft, the Manhattan court has observed that the breach
may have been caused due to Russian gangs. As alleged by a United States attorney “The
defendants manipulated trading in U.S. securities from overseas, using fake identities to funnel
millions of dollars in unlawful proceeds through a web of international shell companies. Using
false and misleading spam emails sent to millions of people, these defendants allegedly directed
their pump-and-dump scheme from their computers halfway around the world” (Goldstein, 2015).
This may be a key factor in determining the true perpetrator given that being one of the largest
US banks, JPMorgan has played a major role implementing sanctions against Russian institutions
and officials imposed as a result of the conflict in Ukraine. (Robertson & Riley, 2015)
Based on the various sources of information available and further risk/security assumptions, this
paper will seek to identify, assess and evaluate further data breach risks following the Risk
Management framework provided by ISO 31000. The framework also encourages that we
recognize solutions and recommendations for future prevention and recovery. It is important to
mention that the text will mostly analyze the protection of information assets and will be addressed
with publicly available information.
Stakeholders
Main stakeholders related to the JPMorgan Chase breach will be divided in two categories:
internal and external. The first group consists on parties that either collaborate with the risk
assessment process or must get acquainted with it in order to make further related decisions. The
second one involves parties that are not affiliated to the company, but are ultimately interested in
the security of the organization’s information assets.
Internal
According to JPMorgan Chase’s corporate site, the Chief Risk Officer is mainly held accountable
for elaborating detailed assessments. With the support of Chief Cybersecurity Officer, this
executive has to eventually present his findings to the Risk Policy Committee, group organized to
evaluate the findings, make decisions and ultimately collaborate with other parties such as the
Audit and Corporate Governance Committees. (JPMorgan Chase & Co., 2015) It is mainly

important to recall that besides from performing an accurate assessment, communication plays a
primary role in the process thus enabling different stakeholders to correctly perform their duties.
The accountability model is shown in the following diagram.
Internal Accountability Model
External
Some additional stakeholders that may be considered are both the government of the United
States of America and the customers. In the first place, the public sector has supported powerful
financial institutions to recover against breaches and other additional crises due to their
importance for the overall economy. Besides, it is of the nation’s best interest to keep attracting
customers by maintaining a good reputation for the security and good practices of private
institutions.
External Stakeholder Matrix
In the second place, the customers are interested in being able to trust the institution in order to
safely invest or save money without being damaged by security breaches. Other possible
interpretations may consider other banks or competitors trying to learn from the breach and
probably even making an emphasis on security as their competitive advantage. Finally, external
service providers hired by the bank should also be considered as potential stakeholders with high
influence and interest in the bank’s security performance.

Identification of Main Assets
As a first step for the assessment, the primary assets of the organization that could either be in
danger or play a role in data breaches, were grouped in four different categories:
● Physical Assets - Infrastructure and technology used to share, analyze or produce
information. Some examples are servers, networks, computers and other technology
devices either organizational or personal.
● Informational Assets - Refers to software and information stored in different formats. Some
examples are databases, Customer Sensitive Information such as Personal Identifiable
Information and further financial data.
● Human Assets - Personnel and human factors involved in the processes implemented by
the organization as well as external users and stakeholders. Some examples are vendors,
managers/employees and customers.
● Reputational Assets - Those factors that allow JPMorgan Chase & Co. to maintain or
increase its brand presence as well as the goodwill and demand by external parties. Some
examples are the share’s value, customer trust and credibility.
Assets Categorization Diagram
The above diagram shows the four different categories that enclose the organization’s main
assets that maintain a direct or indirect relationship with data breaches. Even though this
assessment is mostly centered on protecting the informational assets from data breaches, it is
important to recall that the four categories are deeply interrelated into the different processes and

procedures implemented by the institute`on. For this reason, protection of informational assets
will generate an impact on the safety of the other additional categories.
Risk Identification
The current exercise is mostly focused on the protection of informational assets in order to ensure
the safety of additional primary physical, human and reputational factors. Based on this premise
and public data related to the JPMorgan Chase breach 2014, the following main risks were
identified and categorized:
Operational
1) Inadequate controls and procedures (such as not implementing double authentication in
servers or not implementing secure network configurations) may lead to the exposure of
restricted data and systems to external malicious parties.
2) Failure to contemplate potential impact of human error when utilizing the informational
assets of the company could generate unintended disclosure of data and delude currently
implemented security controls.
3) Lack of substantial training for employees to protect informational assets of the company
may generate unintended disclosure of data and lower the effectiveness of currently
implemented security measures.
4) Failure to implement correct software flags to inform when an unauthorized party is
attempting to access the system may lead to the lack of adequate and timely incident
response against attacks.
5) Failure to implement adequate physical protection to the infrastructure of the company
may enable possible direct intrusions from external malicious entities.
6) Carelessness of employees may affect the company by enabling external access to its
information assets with the support of lost or stolen equipment, devices or credentials.
7) Impossibility to separate the protection of internal networks from that of external providers
hosting the websites of the company may lead to potential further data breaches and
external inclusion to the main systems of the organization.
8) Lack of regular monitoring of customer's information databases slows the bank’s actions
to respond against attacks, find and fix vulnerabilities thus enabling intrusions to last for
long periods of time.
Strategic
1) Failure to protect the bank’s information systems may generate the disclosure of private
data from users and customers thus damaging the reputation of the institution and its
overall financial performance.
2) Slow adaptation to technology advances from potential malicious actors leaves the
company vulnerable to diverse external threats from different origins.

3) Failure to protect sensitive information from the bank may lead to the disclosure of
confidential data about its customers and employees thus enhancing the competition’s
appeal in the market.
4) Inability to efficiently integrate the members from the security team may lead to cultural
conflict thus generating potential loss of productivity.
5) Failure to protect the information of customers and employees (such as contact details,
home addresses and further private information) may affect the company by losing the
trust and support of their human factors.
6) Inefficient communication strategies to include security in the overall culture of the firm
could increase the probability of threats impacting the informational assets of the
company.
Financial
1) Failure to implement efficient organizational policies to correctly manage information may
lead open the doors for further attacks or even encourage unintended disclosure thus
generating financial and reputational losses to the company.
2) Failure to protect the personal information of customers may lead to theft and incorrect
use of their resources through impersonation and other malicious methods.
3) Losing reputation as a consequence of information unsafety affects the company by
decreasing the demand of the users and inviting new entrants to reconsider working with
competing organizations.
Legal/Compliance
1) Failure to comply with government regulation related to data protection and unauthorized
disclosure could generate lawsuits against the bank and even strengthen government
intervention.
2) Lack of regular and thorough auditing may lead the company to experience further
breaches and/or get involved in legal disputes.
3) Failure to correctly protect information of customers and employee affects the company
by engaging them in legal disputes with further possible financial and reputational negative
impacts.
4) Lack of awareness of employees driving the destruction or deletion of documents related
to data breaches affects the company by exposing it to further legal discussions.
The following diagram summarizes the identified risks and categorize them according to their
nature:

Risk Assessment and Mitigation
Based on the list of risks identified in the former section, the following assessment will include the
six most relevant findings as well as an analysis of their probability and potential impact. At the
same time, risk drivers and mitigation strategies will be defined for each one of them:
Risk: # 1 Inadequate controls and procedures may lead to the exposure of
restricted data and systems to external malicious parties.
Risk Dimension:
Operational
Risk Drivers/
Contributing Factors
Probability Impact Current and Planned Mitigations
Overlooking security
controls for SDLC
processes on data
systems.
L H - Implementation of security controls quarterly
monitoring.
- Implementing the use of Flags to alert the
department lead executives of system breaches
and or non-compliance to main security
processes.
Lack of communication
with third party service
providers on
compliance with risk
mitigation controls.
M H - Establishment of regular meetings to coordinate
security measures with third party service
providers.
- Provide shared training sessions to share
information about compliance procedures
between both organizations.
Lack of sufficient
education and training
on controls and
procedures for
restricting data and
systems usage.
M M - Regular training sessions are required to be
conducted to make all employees aware about
the controls and policies in place in the
organization.
- Elaboration of the Data Management and
Control Procedures Manual to foster equal
practices between different departments.
Risk: # 2 Lack of periodic monitoring of customer's information slows the
bank’s actions to respond against attacks, find and fix vulnerabilities
thus enabling intrusions to last for long periods of time.
Risk Dimension:
Operational
Risk Drivers/
Insufficient robustness
of AAA
(Authentication,
Authorization, and
Auditing) process for
customers.
M H - Implementation of robust AAA processes for
customer data with reviewed by the Risk
Management and Audit Committees.
- AAA quarterly functional reports to ensure
about the efficiency and efficacy of currently
implemented mechanisms.

Reports on
vulnerabilities are
slowly processed.
L M - Forming a sub-unit to perform regular and
planned processing of vulnerabilities reports to
be performed by the Risk Management Team.
Exceptions against
systematic security
warnings are
consistently made.
L M - Strengthen the mechanisms required to validate
exceptions so that they take place only under
critical necessity.
- Case by case assessment of security exceptions
to supervise the correct management of this
resource.
Risk: # 3 Slow adaptation to technology advances from potential malicious
actors leaves the company vulnerable to diverse external threats from
different origins.
Risk Dimension:
Strategic
Risk Drivers/
Costs to migrating data
to new technology can
deter adaptation
H M - Promote the adoption of interoperable systems
that allow easily moving data from one to another
location.
- Hiring external agencies or consultancies that
can assist in migrating to new technologies.
Technology adaption is
delegated to external
consultants rather than
in-house experts.
M M - Hiring in-house experts that may supervise and
collaborate with external parties in order to
manage information.
- Promoting internal management of information
whenever it is possible.
Company culture may
not encourage
effective adaptation
with technology.
M L - Implement communication mechanisms to
embed technology adoption into the company’s
culture.
Risk: # 4 Inefficient communication strategies to include security in the overall
culture of the firm could increase the probability of threats impacting
the informational assets of the company.
Risk Dimension:
Strategic
Risk Drivers/
Lack of efficient senior
leadership in security.
L H - Foster and reward efficient leaders related to
security positions thus promoting long lasting work
relations with expert managers.
- Hiring an expert for the role of a chief information
security officer can be highly useful.

Marginalization of
senior leadership in
security.
M H - Incorporate senior security leadership in general
meetings with high executives.
- Promote strong communication security
strategies to get high executives involved in the
overall information risk management process.
Risk assessment team
may not be fully
funded and supported
by senior leadership.
M M - Enable transparency mechanisms between the
Risk assessment team and the senior leadership by
means of regular meetings or presentations.
- Enforce minimum security budget requirements
for senior leadership.
Risk: # 5 Failure to comply with government regulation related to data
protection and unauthorized disclosure could generate lawsuits
against the bank and even strengthen government intervention.
Risk Dimension:
Legal
Risk Drivers/
Noncompliance with
audit requirements
due to time or funding.
M M - Enforce internal auditing mechanisms to ensure
adequate compliance.
- Establish minimum time and budget
requirements to comply with external audits.
Reliance on external
audit relationships
rather than an internal
auditing team.
L H - Forming an internal audit team that performs
quarterly, half yearly and yearly assessments.
- Promote coordination between internal and
external auditing teams.
Internal processes and
audits do not align well
with government
regulation.
L M - Collaboration between legal department and
internal audit teams to ensure compliance with
government regulation.
Risk: # 6 Failure to implement efficient organizational policies to correctly
manage information may lead open the doors for further attacks or
even encourage unintended disclosure thus generating financial and
reputational losses to the company.
Risk Dimension:
Financial
Risk Drivers/
Organizational policies
do not align well with
business objectives.
L H - Coordinating organizational policies and
business objectives by analyzing through the lens
of information security and risk management.
- Establish strong monitoring mechanisms to keep
organizational security policies aligned with the
main business objectives.

Organizational policies
hinder employee
performance with
everyday tasks.
M M - Elaborate a report based on employees
consultation regarding the flow of organizational
policies and how the facilitate or complicate their
daily tasks.
- Increase awareness about the necessity of
following organizational policies for the good
functioning of the firm.
Insufficient
performance tracking
and management for
organizational policies.
M H - Keep track on the performance of organizational
policies, where they fail and how to make them
better.
- Maintain constant communication with
employees to understand the impact of
organizational policies on their daily jobs and how
they follow these procedures.

Risks Normalization
After meeting with the main stakeholders and analyzing their interests, the following chart was
prepared. Based on the assessment, each of the below risk is identified with the likelihood of the
occurrence of the threat and the impact of the threat.
Main Risks Evaluation
ID Risk Stakeholders Involved Impact Likelihood
1
Inadequate controls
and procedures
Business Team, Government
Regulatory Body, IT Team
5 2.7
2
Lack of periodic
monitoring
External and Internal Audit
Committee, Governance
Committee
4.8 2.5
3
Slow adaptation to
technology
IT Team, Business 2.6 4.1
4
Inefficient
Communication
Strategies
CEO, Key business stakeholders,
External Vendors
4 2.2
5
Failure to implement
organizational policies
Key Business Stakeholders, IT
Team
3.9 1.7
6
Non-compliance with
government regulation
Legal Team, Technical Team,
External Vendors, Government
4.7 2

As part of Risk Normalization process, the below impact and likelihood have been accepted by
the stakeholders and a heat map visualizing the below information is presented.
Risk Heat Map

Control Planning and Risk Treatment
According to the results presented by the risk normalization process, risks 3, 4 and 5 may be
tolerated and managed by the team on a regular basis. In order to address them, the cybersecurity
and risk managers will be informed so that better communication, alignment with business
objectives and fast adaptation to technology will be addressed for the mediate future.
However, risks 1, 2 and 6 must be prioritized and immediately addressed based on the matrix of
probability- impact that shows the stakes are high enough to require the implementation of
immediate controls. The following activities will be implemented to resolve each of these
problems:
Risk Title: Inadequate controls
and procedures
Risk Description: Failure to implement efficient controls
and procedures to protect customer and bank’s
information
Associated Business Objectives: Customer trust and support, Information assurance,
Adaptation to changes in the industry
Risk Type: Operational Risk Category: Information Security, Policies and
Procedures, Incident Response
Impact Rating: 5 Likelihood Rating: 2.7
Management Activity and Controls Rating:
1. Implementation of alert Flags to inform department lead executives about system
breaches and or non-compliance to main security processes
2. Security controls quarterly monitoring and regular meetings to coordinate with internal
and external service providers
3. Shared compliance and policy training sessions involving main internal stakeholders
and external service providers
4. Elaboration of Data Management and Control Procedures Manual (DMCP) to foster
equal practices between different departments
Suggested Owners: Chief Risk
Officer, Chief Cybersecurity
Officer, Audit Committee
Metrics: Amount and duration of successful minor/major
data breaches, Number of employees with access and
approved evaluation in DMCP Manual, Quarterly
monitoring reports, Number of employees attending to
training sessions, Number of alert flags informing of non-
compliance with security processes

Risk Title: Lack of periodic
monitoring
Risk Description: Thorough evaluation and periodic
monitoring of security policies, controls and procedures
Associated Business Objectives: Information Assurance, Operational Optimization, Risk
Mitigation and Critical Assets Management
Risk Type: Operational Risk Category: Information Security, Audit and
Monitoring
Impact Rating: 4.8 Likelihood Rating: 2.5
1. Implementation and revision of robust AAA processes and procedures to protect
customer data
2. Conformation of a separate monitoring sub-unit to perform regular reports over control
efficiency and effectivity as well as to track, report and fix vulnerabilities
3. Strengthen requirements to validate exceptions and assess case by case petitions in
order to supervise correct management of this resource
Suggested Owners: Chief
Cybersecurity Officer, Audit
Committee
Metrics: Half yearly AAA processes and procedures
revision report, Conformation of security monitoring sub-
unit and deriving performance metrics, Number of
approved exceptions, Number of petitions to perform
exceptions

Risk Title: Non-compliance with
government regulation
Risk Description: Failure to enforce the compliance with
government regulation while performing daily processes
and procedures
Associated Business Objectives: Operational Compliance, Business Continuity, Information
Assurance and Critical Assets Protection
Risk Type: Legal/Compliance Risk Category: Regulatory and Legal, Information
Assurance, Policy and Compliance
Impact Rating: 4.7 Likelihood Rating: 2.0
1. Evaluating complementarity between business objectives and risk/security
organizational policies and establish monitoring mechanisms to keep them aligned
2. Elaborate yearly reports based on employees consultation regarding the flow of
security policies and how they generate an influence on their daily tasks
3. Keep track on the performance of security organizational policies and implement
mechanisms to integrate them among main business processes
Suggested Owners: Policy and
Compliance Department, Chief
Risk Officer, Chief Cybersecurity
Officer
Metrics: Yearly security operations report, Business
Objectives and Security Assessment, Security policies’
performance monitoring, Increase in time consumption to
comply with security procedures
Most impactful risks were selected in spite of the low probability. As proven by the 2014 data
breach, it is of utmost importance to be prepared for this sort of events that are not only related
with daily tasks, but rather with unexpected crisis. For further information about the impact and
probability metrics, refer to the annex number 2.

Incident Response and Recovery
Incident management and recovery is a critical part of business continuity planning. In order to
effectively respond to the data breach at hand, we assume/propose the following key steps to
combat the same:
● Perform Disaster Recovery and Root Cause Analysis
● Segregating internal networks into separate segments to prevent further hacking
● Providing restricted access to critical assets by providing lesser privilege controls
● Quarantining the system that was breached
● Internal communication to create awareness
● Implementing proper training to cyber security personnel
Communication and Monitoring
As suggested by the ISO 31000 framework, the former analysis must continuously work next to
a robust strategy of communication and monitoring that evaluates the process and increases
awareness among the stakeholders. The previous risk assessment based on the 2014 data
breach shows that it is of significant importance to strengthen monitoring activities and enhance
the training of key employees in order to increase the security of the organization’s informational
assets. As well, these two actions will play an important role in engaging lead managers into
investing efforts and resources for further protecting the information of the institution.
However, internal communication should not be the only concern. Considering that the 2014 data
breach was covered through diverse media channels, the reputation of the bank was damaged
and it is now important to reinforce the conception of strong security actions implemented to
protect the information possessed by the organization. It is expected that by enhancing the
security-oriented image of the bank, less government intervention will happen and trust will
increase among both corporate and individual customers.

The main components of the communication plan should be:
Objectives Audience Strategy Evaluation Criteria
Increase customer’s
demand of the
organization’s services
Customers Increasing trust on the
organization’s safety
standards and promoting
JPMorgan Chase & Co.
as a security champion
institution
- Number of corporate
customers
- Number of individual
customers
- Customer’s security
perception
Educate employees to
effectively follow
security related policies
and procedures
Employees Promote major security
awareness among
employees by generating
communication
campaigns and training
that show them the impact
of information security in
their daily lives
- Reported incidents
caused by unintended
employees’ actions
- Average time
increase in procedures
due to non-compliance
with procedures and
human error
Engage lead managers
into the information
security process
Lead
Managers
Offer lead managers clear
and regular reporting
mechanisms in order to
increase awareness and
enhance the amount of
resources/efforts they
utilize to secure
informational assets
- Total expenditure
destined to information
security by department
- Amount of hired
employees dedicated
to information
assurance
- Information security
practices yearly survey
Gain authorities’
goodwill and support by
sharing the company’s
achievements related to
the protection of their
informational assets
Official
Authorities
Inform key government
stakeholders about the
success of the bank’s
information security
measures
- Number of addressed
key government
stakeholders
- Elaboration of
collaborative
workshops, events and
initiatives
The communication plan will address different stakeholders using diverse methods. While
government institutions will be invited to know more about information security achievements, the
customers will only know about the bank’s leading position as a safe institution. It must be taken
into consideration that the tone of the campaign must show that resources are being allocated to
protect information, however it should not show excessive confidence that may invite outsiders to
try and breach into the institution’s data assets as a challenge. Employees and risk managers will

both be submitted to awareness campaigns and training, and the only differentiation will be related
to the sort of sensitive information that each of them may receive.
In general terms, the former plan will be launched with the support of an initial campaign that
shares the message: JPMorgan Chase & Co. cares about data security and has learned from
previous lessons. For this reason the company is now preparing to become a leader in
mechanisms and procedures for enhancing information assurance. Information stored in the
bank’s servers will now be more secure than ever before.” In order fully comply with the message,
success stories and good practices will be shared among the stakeholders thus promoting general
awareness about the relevance of the field.
Besides from the communication strategy, it will be of utmost importance to continue
implementing continuous monitoring initiatives defined by the risk management and security
teams. Both of these actions should closely watch over the entire process of managing risks in
order to allow JPMorgan Chase & and Co. to be sure about the efficiency of it policies and to
enhance the impact among the most relevant stakeholders.
Strategic Recommendations
Considering expected increase of cybersecurity spending to $500 million dollars in 2016,
JPMorgan and Chase is preparing for addressing further information security challenges.
Planning how the money can be appropriately distributed for the most important security
challenges is another issue. In the context of the aforementioned analysis, there are three clusters
of strategic improvements that can serve as the basis for recommendations that JPMorgan Chase
can move forward with. The three clusters of strategic improvements are improvements to
controls and procedures to technology adaptation, communication strategies for external groups,
and alignment between corporate and government policies for effective risk compliance.
Throughout our analysis, evidence suggests that technology adaptation is relatively slow
throughout the JPMorgan & Chase’s business operations. Three key risk drivers affecting this
process could be forced haste in proposing and implementing IT projects and leaving out crucial
monitoring functions, ineffective change management for the organization on new technologies,
and reliance on external consultancy without sustained internal experts. Based on these drivers,
there are top three recommendations for JPMorgan Chase to consider when improving upon
streamlined technology adaptation with effective controls and procedures:
1. Increase monitoring and detection of unauthorized access in information systems holding
sensitive data.
2. Provide consistent IT training sessions on technology use throughout JPMorgan Chase
internally and with third party providers on risk areas such as policies and compliance.
3. Promote internal information management through developing and enhancing in-house
experts’ proficiency with processing data and information systems.

In addition to ineffective technology adaptation, communication strategies with external groups
throughout JPMorgan Chase’s business operations may have affected the company’s response
to dealing with data breaches. Three key risk drivers affecting this process could be based on
isolating senior leadership from external affairs, having inadequate processing and response
measures for external groups, and encouraging loopholes on external access to information.
Based on these drivers, the top three recommendations to improve upon communication
strategies with external groups are outlined as:
1. Encourage inclusiveness of senior security leadership in the organization to discuss
security issues with external groups.
2. Promote better transparency of data and information usage by JPMorgan Chase for
external groups.
3. Reevaluate and develop policies enforcing unauthorized access to data and bolster
robustness of case-by-case evaluations.
Finally, evidence also suggests that JPMorgan Chase’s corporate policies for risk assessment
and compliance may not have fully aligned with government policies to protect stakeholder and
customer data. Three key risk drivers affecting this process could be constraints on time and
money to handle auditing internally, insufficient performance management for organizational
policies, and having organizational policies that hinder day-to-day operations for individual
branches. Based on these drivers, the top three recommendations to target these risk drivers
could be
1. Have a comprehensive and inclusive internal auditing program through auditing and legal
teams at individual company branches.
2. Have a program for encouraging cyclical compliance and feedback on organizational
policies and their changes.
3. Re-evaluate policies on balancing data and information access and security with
employees such as associates and managers.

Annex # 1
Main survey questions:
1. What controls were in place before the breach and what are currently in place at
JPMorgan Chase?
2. How often are your webpages/systems monitored in order to be sure that there are no
security breaches taking place? Which mechanisms do you use for this?
3. Which are the most valuable assets that you would deem necessary to protect from
information security breaches?
4. According to publicly available information, the breach happened because of the lack of
a second authentication step in one of the servers. How are the rest of the servers
protected? Has anything been done yet in order to address this vulnerability? How is
relevant data from the users protected?
5. Any other potential vulnerabilities you would like to point out before we start with our
external assessment?
6. Has there been any history of non-adherence to any sort of information security related
compliances? (Such as PCI)

Annex # 3
1. Impact Rating Criteria

2. Likelihood/Probability Rating Criteria

References
JPMorgan Chase & Co. (2015, March). Risk Policy Committee. Retrieved from:
https://www.jpmorganchase.com/corporate/About-JPMC/ab-risk-committee.htm
Kurane, S., & Wills, K. (2014, Dec 22). JPMorgan data breach entry point identified: NYT.
Retrieved from Reuters: http://www.reuters.com/article/us-jpmorgan-cybersecurity-
idUSKBN0K105R20141223
Morgan, Steven C. (2015). Cybersecurity for Banks Report. Retrieved from Cybersecurity
Ventures: http://cybersecurityventures.com/cybersecurity-for-banks-report-q3-2015/
Three charged for largest-ever bank data breach. (2015, November 10). Retrieved from CBS
News: http://www.cbsnews.com/news/three-charged-for-jpmorgan-data-breach-the-largest-ever/
Perlroth, M. G. (2014, October 31). Luck Played Role in Discovery of Data Breach at JPMorgan
Affecting Millions. Retrieved from Deal Book:
http://dealbook.nytimes.com/2014/10/31/discovery-of-jpmorgan-cyberattack-aided-by-company-
that-runs-race-website-for-bank/?_r=0
Ponemon Institute, Ponemon Institute’s 2015 Global Cost of Data Breach Study Reveals
Average Cost of Data Breach Reaches Record Levels ( 2015, May 17). Retrieved from IBM:
https://www-03.ibm.com/press/us/en/pressrelease/47022.wss
Robertson, Jordan and Michael Riley, PMorgan Reassigns Security Team Leader a Year After
Data Breach (2015, June 30). Retrieved from Bloomberg:
http://www.bloomberg.com/news/articles/2015-06-30/jpmorgan-reassigns-security-team-leader-
a-year-after-data-breach
Goldstein M, “Arrested in schemes said to be tied to JPMorgan Chase Breach” CNBC. July,
2015 Retrived from: http://www.cnbc.com/2015/07/22/4-arrested-in-schemes-said-to-be-tied-to-
jpmorgan-chase-breach.html
Ro S, “JPMorgan Reveals Gigantic Data Breach Possibly Affecting 76 Million Households”
Business Insider (2014, October) Retrieved from BI: http://www.businessinsider.com/jp-morgan-
data-breach-2014-10
Robertson & Riley, “JPMorgan Reassigns Security Team Leader A Year After Data Breach”
Bloomberg Business (2015, June) Retrieved
from:http://www.bloomberg.com/news/articles/2015-06-30/jpmorgan-reassigns-security-team-
leader-a-year-after-data-breach
“A Structures Approach to Enterprise Risk Management and the Requirements of ISO 31000”
by airmic, alarm, irm; https://www.theirm.org/media/886062/ISO3100_doc.pdf

JPMorgan Chase & Co. -Risk Assessment Report

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to JPMorgan Chase & Co. -Risk Assessment Report

Similar to JPMorgan Chase & Co. -Risk Assessment Report (20)

More from Divya Kothari

More from Divya Kothari (11)

JPMorgan Chase & Co. -Risk Assessment Report