Task
Scenario
The Department of Administrative Services (DAS) provides a number of services to other departments in an Australian State Government. These services include HR and personnel management, payroll, contract tendering management, contractor management, and procurement. These services have all been provided from the Department’s own data centres.
As a result of a change in Government policy, DAS is moving to a “Shared Services” approach. This approach will mean that DAS will centralise a number of services for the whole of Government (WofG). This means that each Department or Agency that runs one of these services for its own users, will be required to migrate its data to DAS so that it can be consolidated into the DAS centralised database. DAS will then provide these consolidated services to all other Departments and Agencies within the Government.
Another Government policy mandates a “Cloud first” approach to the process of updating or acquiring software or services. Following these strategic policy changes from Government, DAS has decided to:
- Purchase a HR and personnel management application from a US based company that provides a SaaS solution.
- The application will provide DAS with a HR suite that will provide a complete HR suite which will also include performance management. The application provider has advised that the company’s main database is in California, with a replica in Dublin, Ireland. However, all data processing, configuration, maintenance, updates and feature releases are provided from the application provider’s processing centre in Bangalore, India.
- Employee data will be uploaded from DAS daily at 12:00 AEST. This will be processed in Bangalore before being loaded into the main provider database.
- Employees can access their HR and Performance Management information through a link placed on the DAS intranet. Each employee will use their internal agency digital ID to authenticate to the HR and Performance management system. The internal digital ID is generated by each agency’s Active Directory Instance and is used for internal authentication and authorisation.
- Purchase a Contractor management application from a German based company that provides a SaaS solution.
- This application will provide DAS with a suite of tools to on-board, manage, pay and off-board contractors who are contracted by DAS for specific work. The application provider has advised that the company’s main database is located in Heidelberg, Germany, with a replica in Dublin, Ireland. All configuration, maintenance, updates and feature releases are provided from the provider’s lab in Walldorf, Germany. The provider does not do any additional processing of data entered into the application.
- DAS employees enter the data directly into the application through a secure URL.
- Bulk contractor data can be uploaded daily through a secure data transfer application. DAS is responsible for ensuring that any data uploaded is correct and ready for use.
- Other Departments and Agencies can view and manage their own contractor data once it has been loaded by DAS staff.
- Move the DAS payroll to a COTS (Commercial Off The Shelf) application that it will manage in a public cloud;
- Move the DAS Intranet into a Microsoft SharePoint PaaS offering so that it can provide Intranet services to all agencies in the WofG.
Tasks
Your team has been engaged to provide a risk assessment for the two planned moves to SaaS application offerings.
Team Setup
This assignment is the first of the team assignments for this subject. The rationale for using a team approach is that most IT risk management assessments are normally done by teams of between 2-5 Architects, Information Security experts, Operations and Business leaders for each problem. You will be assigned to a team and the team, as a whole, will be responsible for the development of the risk assessment.
Team Member Responsibilities
Each team member will be assessed on:
- The final risk assessment presented by the team;
- The individual contributions that they have made to the risk assessment. This will be shown by the entries that they have made in the Team forum;
Team members should note that:
- A total of 20% of the total marks for this assignment are for individual contributions. These include:
- Selection of issues for risk assessment (10%), and
- Reasoning behind the risk assessment for the selected issues (10%)
- A team member without any individual contributions in the Team Forum will be regarded as having not contributed to the risk assessment. This will result in either reduced marks or no marks being awarded to that team member for this assignment.
The tasks:
Your team is to write a report that assesses the risk to DAS in the following areas:
- Consider the data and information that DAS holds on its employees in the current HR system.
- Establish the existing threats and risks to the security of that data and information contained in the in house HR database. (10 marks)
- Are there any other risks and threats to the employee data after migration to an SaaS application? (10 marks)
- Assess the resulting severity of risk and threat to employee data. (10 marks)
- Consider the privacy of the data for those employees who will move to an SaaS application.
- Establish the existing threats and risks to the privacy of that data and information contained in the in house HR database. (10 marks)
- Are there any other risks and threats to the privacy of the employee data after migration to an SaaS application? (10 marks)
- Assess the resulting severity of risk and threat to the privacy of employee data. (10 marks)
- What are the threats and risks to the digital identities of Government employees from the move to SaaS applications? (10 marks)
- Consider the operational solution and location(s) of the two SaaS providers for HR and Contractor management. Does either the operational solution, or the operational location, or both, increase or mitigate the threats and risks identified for the security and privacy of employee data? (20 marks)
- Are there any issues of data sensitivity or jurisdiction that should be considered? (10 marks)
The team is to provide a written report with the following headings:
- Security of Employee Data
- Privacy of Employee Data
- Digital Identity Issues
- Provider Solution Issues
- Data Sensitivity
As a rough guide, the report should not be longer than about 5,000 words. The report is to be loaded into the Team Resource area in Interact.
All risk assessment discussions in the team forum should be exported into a single document and loaded into the Team Resource area in Interact.
It is suggested that the report should be written using Google Docs. Google Docs allows multiple authors to contribute to a single document, and their individual contributions can be assessed.
Our Service Charter
-
Excellent Quality / 100% Plagiarism-Free
We employ a number of measures to ensure top quality essays. The papers go through a system of quality control prior to delivery. We run plagiarism checks on each paper to ensure that they will be 100% plagiarism-free. So, only clean copies hit customers’ emails. We also never resell the papers completed by our writers. So, once it is checked using a plagiarism checker, the paper will be unique. Speaking of the academic writing standards, we will stick to the assignment brief given by the customer and assign the perfect writer. By saying “the perfect writer” we mean the one having an academic degree in the customer’s study field and positive feedback from other customers. -
Free Revisions
We keep the quality bar of all papers high. But in case you need some extra brilliance to the paper, here’s what to do. First of all, you can choose a top writer. It means that we will assign an expert with a degree in your subject. And secondly, you can rely on our editing services. Our editors will revise your papers, checking whether or not they comply with high standards of academic writing. In addition, editing entails adjusting content if it’s off the topic, adding more sources, refining the language style, and making sure the referencing style is followed. -
Confidentiality / 100% No Disclosure
We make sure that clients’ personal data remains confidential and is not exploited for any purposes beyond those related to our services. We only ask you to provide us with the information that is required to produce the paper according to your writing needs. Please note that the payment info is protected as well. Feel free to refer to the support team for more information about our payment methods. The fact that you used our service is kept secret due to the advanced security standards. So, you can be sure that no one will find out that you got a paper from our writing service. -
Money Back Guarantee
If the writer doesn’t address all the questions on your assignment brief or the delivered paper appears to be off the topic, you can ask for a refund. Or, if it is applicable, you can opt in for free revision within 14-30 days, depending on your paper’s length. The revision or refund request should be sent within 14 days after delivery. The customer gets 100% money-back in case they haven't downloaded the paper. All approved refunds will be returned to the customer’s credit card or Bonus Balance in a form of store credit. Take a note that we will send an extra compensation if the customers goes with a store credit. -
24/7 Customer Support
We have a support team working 24/7 ready to give your issue concerning the order their immediate attention. If you have any questions about the ordering process, communication with the writer, payment options, feel free to join live chat. Be sure to get a fast response. They can also give you the exact price quote, taking into account the timing, desired academic level of the paper, and the number of pages.