Homework answers / question archive / Scenario The Department of Administrative Services (DAS) provides a number of services to other departments in an Australian State Government

Scenario The Department of Administrative Services (DAS) provides a number of services to other departments in an Australian State Government

Computer Science

Share With

---

Scenario
The Department of Administrative Services (DAS) provides a number of services to other departments in an Australian State Government. These services include HR and personnel management, payroll, contract tendering management, contractor management, and procurement. These services have all been provided from the Department’s own data centres.
As a result of a change in Government policy, DAS is moving to a “Shared Services” approach. This approach will mean that DAS will centralise a number of services for the whole of Government (WofG). This means that each Department or Agency that runs one of these services for its own users, will be required to migrate its data to DAS so that it can be consolidated into the DAS centralised database. DAS will then provide these consolidated services to all other Departments and Agencies within the Government.
The Government has now decided that they want to centralise the application and renewal of licences from a number of different agencies into one single portal. The portal will be branded as MyLicence. The Government’s strategy is that the process of licence application or renewal for virtually all licences follows an almost identical workflow, even though some of the data may differ for different types of licences. Their aim is to have a single workflow for all licences, with some additional steps in case of special requirements for a particular type of licence.
The Government also sees the opportunity to gain a better view of what licences each citizen holds, and wants to link that data to other data that they hold about each citizen. In order to achieve this, the Government plans to encourage citizens to register on the MyLicence portal and create their own informal digital identity. This will allow all the licences, renewal dates, and other associated information for that digital identity to be available for viewing on a single page. This data, particularly when linked to a citizen’s digital identity, can then be used for more effective planning and decision making by Government and other public agencies.
The plan also has the advantage of simplifying the process of acquiring and renewing licences for its citizens so that they only need to go to a single web portal to acquire the licenses that they require.
The Government proposes, in line with its “Cloud First” policy, to use a public cloud provider to host the MyLicence portal, processing and databases. The Government also wants to ensure that all data remains on Australian soil so that it can ensure that data sovereignty does not cause any issues with MyLicence.
Tasks
After your successful engagement to develop privacy and personal data protection strategies for DAS, you have again been engaged to develop a Personally Identifiable Information (PII) privacy and personal data protection strategy for the MyLicence portal.
You are to:

1. Develop a Threat and Risk Assessment (TRA) for PII data for the MyLicence portal. This TRA should consider both the privacy and data protection aspects of PII data in the portal. (30 marks)
2. Develop a PII strategy proposal for the DAS MyLicence portal. The strategy should consider the threats and risks to both Privacy and data protection for the PII data collected in the MyLicence portalas well as possible controls to mitigate the identified risks. (30 marks)
3. Develop a strategy to protect the informal Digital Identity that a user may create in the MyLicence portal. You should consider both the privacy and data protection aspects for a digital identity as well as possible controls to mitigate the identified risks. (40 marks)

Presentation
You are to submit the following documents to complete this assessment:

• A PowerPoint presentation that gives a comprehensive overview of the three (3) tasks.
  • The presentation should be a maximum of 30 slides, including introduction, conclusions and recommendations.
  • Each slide should have speaking notes in the Notes section which expand on the information in the slide.
  • The slides should give refer to the additional information contained in the appendices.
  • Images and quotations used in slides must be referenced on that slide.
  • The slide deck does require a reference list. References are to be included on a Reference list slide(s), but these are not counted as part of the slide deck limit.
• The TRA is to be attached in a separate Word document. The TRA can be presented in tabular format, but must be in Word format. This document title is to be:Appendix A, TRA for MyLicence.
• The PII strategy is to be attached in a separate Word document. This document should be fully referenced in APA 6^thedition format, and should not exceed 3 pages. This document title is to be:Appendix B: PII Strategy for MyLicence.
• The Digital Identity is to be attached in a separate Word document. This document should be fully referenced in APA 6^thedition format, and should not exceed 3 pages. This document title is to be:Appendix C: Digital Identity Strategy.
• All documents are to be submitted through Turnitin.

Rationale
This assessment task will assess the following learning outcome/s:

• be able to examine the legal, business and privacy requirements for a cloud deployment model.
• be able to evaluate the risk management requirements for a cloud deployment model.
• be able to critically analyse the legal, ethical and business concerns for the security and privacy of data to be deployed to the cloud.
• be able to develop and present a series of proposed security controls to manage the security and privacy of data deployed to the cloud.
• be able to develop and present a cloud governance framework to underpin the cloud operations for an enterprise.

Marking criteria and standards
back to top

Question	HD	DI	CR	PS	FL
Q1. TRA for PII data (30 marks)	Comprehensive evaluation and matching of threats to PII data with controls showing excellent logical analysis	Thorough evaluation and matching of threats to PII data with controls showing proficient logical analysis	Detailed evaluation and matching of threats to PII data with controls showing good logical analysis	Adequate evaluation and matching of threats to PII data with controls showing satisfactory logical analysis	Inadequate evaluation and matching of threats to PII data with few controls showing little or no logical analysis
Q2. PII strategy for MyLIcence portal (30 marks)	Comprehensive development of policy covering all aspects, with excellent discussion of threats and risks to PII data	Thorough development of policy covering most aspects, with proficient discussion of threats and risks to PII data	Detailed development of policy covering most aspects, with good discussion of threats and risks to PII data	Adequate development of policy covering some aspects, with some discussion of threats and risks to PII data	Inadequate development of policy covering few aspects, with little or no discussion of threats and risks to PII data
Q3. Digital Identity strategy for MyLicence (40 marks)	Comprehensive development of policy covering all aspects, with excellent analysis of digital identity issues	Thorough development of policy covering most aspects, with proficient analysis of digital identity issues	Detailed development of policy covering most aspects, with competent analysis of digital identity issues	Adequate development of policy covering some aspects, with some analysis of digital identity issues	Inadequate development of policy covering few aspects, with little or no analysis of digital identity issues
Referencing & Presentation	Up to 5 marks may be deducted for incorrect or incomplete referencing Up to 5 marks may be deducted for poor presentation, spelling and grammar

Presentation
You are to submit the following documents to complete this assessment:

• A PowerPoint presentation that gives a comprehensive overview of the three (3) tasks.
  • The presentation should be a maximum of 30 slides, including introduction, conclusions and recommendations.
  • Each slide should have speaking notes in the Notes section which expand on the information in the slide.
  • The slides should give refer to the additional information contained in the appendices.
  • Images and quotations used in slides must be referenced on that slide.
  • The slide deck does require a reference list. References are to be included on a Reference list slide(s), but these are not counted as part of the slide deck limit.
• The TRA is to be attached in a separate Word document. The TRA can be presented in tabular format, but must be in Word format. This document title is to be:Appendix A, TRA for MyLicence.
• The PII strategy is to be attached in a separate Word document. This document should be fully referenced in APA 6^thedition format, and should not exceed 3 pages. This document title is to be:Appendix B: PII Strategy for MyLicence.
• The Digital Identity is to be attached in a separate Word document. This document should be fully referenced in APA 6^thedition format, and should not exceed 3 pages. This document title is to be:Appendix C: Digital Identity Strategy.
• All documents are to be submitted through Turnitin.