Cloud Security And Privacy

Posted on by

Task

 

back to top

 

Scenario

 

The Department of Administrative Services (DAS) provides a number of services to other departments in an Australian State Government. These services include HR and personnel management, payroll, contract tendering management, contractor management, and procurement. These services have all been provided from the Department’s own data centres. 

 

As a result of a change in Government policy, DAS is moving to a “Shared Services” approach. This approach will mean that DAS will centralise a number of services for the whole of Government (WofG). This means that each Department or Agency that runs one of these services for its own users, will be required to migrate its data to DAS so that it can be consolidated into the DAS centralised database. DAS will then provide these consolidated services to all other Departments and Agencies within the Government.

 

Another Government policy mandates a “Cloud first” approach to the process of updating or acquiring software or services. Following these strategic policy changes from Government, DAS has decided to:

 

  • Purchase a HR and personnel management application from a US based company that provides a SaaS application. 
    • The application will provide DAS with a HR suite that will provide a complete HR suite which will also include performance management. The application provider has advised that the company’s main database is in California, with a replica in Dublin, Ireland. However, all data processing, configuration, maintenance, updates and feature releases are provided from the application provider’s processing centre in Bangalore, India.
    • Employee data will be uploaded from DAS daily at 12:00 AEST. This will be processed in Bangalore before being loaded into the main provider database.
    • Employees will be able access their HR and Performance Management information through a link placed on the DAS intranet to the HR platform portal. Each employee will use their DAS digital ID to authenticate to the HR and Performance management system. The internal digital ID is generated by the DAS Active Directory instance and is used for internal authentication and authorisation.
    • It is proposed that the link to the HR platform on the DAS Intranet will be an SSO (Single Sign On) link to the HR platform portal. Authentication will be made using the user’s agency ID credentials. DAS will need to use Active Directory Federated Services (ADFS) to federate to an Azure AD instance for authentication and authorisation. This authentication process will be validated with a SAML 2.0 certificate.  

 

Tasks

 

After your successful engagement to provide a security and privacy risk assessment for the DAS, you have again been engaged to develop privacy and personal data protection strategies for DAS. 

 

You are to write a report that proposes appropriate policies for DAS in the following areas:

 

  1. Develop a Privacy strategy proposal for DAS. The strategy should include the following items:
    1. Management of personal information,
    2. Collection and management of solicited personal information,
    3. Use and disclosure of personal information,
    4. Use and security of digital identities, 
    5. Security of personal information,
    6. Access to personal information, 
    7. Quality and correction of personal information.
  2. The controls that you recommend that would:
    1. Mitigate the previously identified privacy risks,
    2. Implement the privacy strategy.
  3. Develop a personal data protection strategy proposal for DAS. This strategy should include:
    1. Protection of personal information,
    2. Authorised access & disclosure of personal information,
    3. Use of personal digital identities,
  4. The controls that you recommend that would:
    1. Mitigate the previously identified data security risks,
    2. Implement the personal data protection strategy.

 

You are to provide a written report with the following headings:

 

  • Privacy strategy for personal data
  • Recommended privacy controls
  • Personal data protection strategy
  • Recommended personal data protection controls.

 

As a rough guide, the report should not be longer than about 5,000 words.