1. MIS 5121: Real World Control Failures: USIS
By Lezlie Jiles

2. Control Failure: SAP Hacked
Background:
The company was founded in 1996 during the privatization of the executive branch of United States Office of Personnel Management (OPM)
USIS provided security-based service solutions to organizations as well as the government.
In 2007 the Carlyle Group sold USIS to Providence Equity Partners, which was a private equity firm, for US $1.5 billion.
A few years later USIS received a OPM contract for $253 million
They became the US Government’s lead background check provider.
Control Failures: 2013 to 2014
USIS employee claimed that USIS management formulated a strategy to intentionally circumvent OPM’s mandated processes and protocols with regards to conducting background investigations.
In 2014 USIS was accused of not following all OPM-mandated procedures and protocols in its background investigation.
In July of 2014 USIS reported that they were hacked via their SAP system, which was managed by a third party.

3. Control Failure: SAP Hacked
Control Failures continued:
 Attackers gained to access to USIS SAP system and then pivot to their network.
The breach may have been caused by SAP not fixing the loophole, or USIS failure to update the system.
The breach on SAP left financial information, corporate trade secrets venerable, as well as the ability for the attackers to modify master data, steal money and create fictions vendors.
Results:
PII of more than 27,000 federal employees were stolen
USIS’s reputation was destroyed
USIS lost their governmental contract
Ultimately filed for bankruptcy  

4. Control Failure: SAP Hacked
What Could / Should those in Authority Have Done Different?:
They should have lockdown the SAP security system.
USIS should have had better directive, detective and preventative controls.
There should have also been a process in place to implement system updates regularly.
Reference:
USIS SAP failures: info security, ERP Scan, Forbes
ever/#250b3e9da010