Assignment

HR And Performance Management System

back to top

Scenario

You are the principal consultant for a community based Charity. The Charity is involved in locating and providing accommodation, mental health services, training and support services to disadvantaged people in the community.  

The Charity currently runs a small data centre that has some 50 x86 64 bit servers running mainly Windows Server 2008 R2 for desktop services, database and file services. It also has 10 Red Hat Enterprise Linux 5 servers to service public facing Web pages, Web services and support. 

The Charity is considering joining a community cloud provided by a public cloud vendor in order to provide a number of applications to all 500 support staff and administrative users. A small number of the Charity’s applications are mission critical and the data that those applications use is both confidential and time sensitive. 

The community cloud would also be used to store the Charity’s 200TB of data. The data would be held in a SaaS database run by the public cloud vendor. The Charity’s data contains a considerable amount of confidential information about the people to whom the Charity provides services.  

The Charity collects PII data on the clients who use its services so that it can assist them to manage their different service requirements. This PII data also includes holding some digital identity data for some of the more disadvantaged clients, particularly if they also have mental health issues. 

The cloud vendor has made a presentation to management that indicates that operational costs will drop dramatically if the cloud model is adopted. However, the Board of the Charity is concerned with the privacy and security of the data that it holds on the people that it provides services to in the community. It is concerned that a data breach may cause considerable damage to substantially disadvantaged people in the community.

The Board asks that you prepare a report that proposes appropriate privacy and security policies for the Charity’s data. 

The charity has also decided to:

• Purchase a HR and personnel management application from a US based company that provides a SaaS application.
  • The application will provide the charity with a HR suite that will provide a complete HR suite which will also include performance management. The application provider has advised that the company’s main database is in California, with a replica in Dublin, Ireland. However, all data processing, configuration, maintenance, updates and feature releases are provided from the application provider’s processing centre in Bangalore, India.
  • Employee data will be uploaded from DAS daily at 12:00 AEST. This will be processed in Bangalore before being loaded into the main provider database.
  • Employees can access their HR and Performance Management information through a link placed on the charity intranet. Each employee will use their internal charity digital ID to authenticate to the HR and Performance management system. The internal digital ID is generated by the charity’s Active Directory Instance and is used for internal authentication and authorisation.
• Move the the charity payroll to a COTS (Commercial Off The Shelf) application that it will manage in a public cloud;
  • This application will provide the Charity with the suite of tools necessary to process and manage payrolls for all agencies within DAS. The application provider has advised that their software is distributed throughout the AWS cloud with instances in US East, US West, Europe, Asia Pacific, China and South America.
  • All configuration, maintenance, updates and feature releases are provided from the provider’s offices in San Francisco, Beijing, Singapore, Mumbai and Dublin.
  • The provider does not do any additional processing of data entered into the application.
  • The charity payroll staff may access the payroll application through a SSO (Single Sign On) link to a secure URL. Authentication is made using the user’s charity ID credentials. Each authorised user’s authentication credentials are uploaded to the application to allow them to logon and access the payroll.
  • Data is uploaded to the application by the charity's payroll staff for each agency staff member, but can also be uploaded in bulk using a CSV file. CSV files are uploaded using an upload link in the application.
  • Completed payroll files are sent to the appropriate banking institutions through a secure link provided by each bank.
  • Regular transaction and audit reports for each agency are available to the charity's payroll staff.
     
• Move the charity Intranet into a Microsoft SharePoint PaaS platform so that it can provide Intranet services to all users in the charity no matter where they are located.
  
  
  • This solution will provide the charity with the ability to provide Intranet services to all users with each charity location having its own site within the overall structure.
  • The PaaS offering has been chosen as it gives the charity administrators the ability to configure the sites for all separate charity locations, and still allow users to access any of those individual sites.
  • The application provider has advised that their software is distributed throughout the Azure cloud with instances in US East, US West, Europe, Asia Pacific, China and Australia.
  • It is proposed that users will be able to access the platform through an SSO (Single Sign On) link to the platform portal. Authentication will be made using the user’s charity ID credentials . The charity will need to use Active Directory Federated Services (ADFS) to federate to an Azure AD instance for authentication and authorisation. This authentication process will be validated with a SAML 2.0 certificate.
  • The charity’s web staff will be able to configure all the separate charity location sites to reflect their own internal news, along with a range of news provided by the charity.

Tasks 

After your successful engagement to provide a security and privacy risk assessment for the charity, you and your team have again been engaged to develop privacy and personal data protection strategies for the charity.

Team Setup 

This assignment is the first of the team assignments for this subject. The rationale for using a team approach is that most IT policy formulations are normally conducted by teams of between 2-5 Architects, Information Security experts, Operations and Business leaders for each problem. You are already assigned to a team and the team, as a whole, will be responsible for the development of the policies.

Team Member Responsibilities

Each team member will be assessed on:

• The final privacy and personal data protection strategies presented by the team;
• The individual contributions that they have made to the policy formulation. This will be shown by the entries that they have made in the Team forum;

Team members should note that:

• A total of 20% of the total marks for this assignment are for individual contributions. These include:
  • Contributions to the development of privacy and data protection policies (10%), and
  • Reasoning behind the development of privacy and data protection policies (10%)
• A team member without any individual contributions in the Team Forum will be regarded as having not contributed to the risk assessment. This will result in either reduced marks or no marks being awarded to that team member for this assignment.

The task: 

Your team is to write a report that proposes appropriate policies for DAS in the following areas:

1. Develop a Privacy strategy proposal for the charity. The strategy should include the following items:
   1. Management of personal information,
   2. Collection and management of solicited personal information,
   3. Use and disclosure of personal information,
   4. Use and security of digital identities,
   5. Security of personal information,
   6. Access to personal information,
   7. Quality and correction of personal information.
2. The controls that you recommend that would:
   1. Mitigate the previously identified privacy risks,
   2. Implement the privacy strategy.
3. Develop a personal data protection strategy proposal for the charity. This strategy should include:
   1. Protection of personal information,
   2. Authorised access & disclosure of personal information,
   3. De-identification of personal data,
   4. Use of personal digital identities,
   5. Security of personal data,
   6. Archiving of personal data.
4. The controls that you recommend that would:
   1. Mitigate the previously identified security risks,
   2. Implement the personal data protection strategy.

The team is to provide a written report with the following headings:

• Privacy strategy for personal data
• Recommended Privacy controls
• Personal data protection strategy
• Recommended personal data protection strategy.

As a rough guide, the report should not be longer than about 8,000 words. The report is to be written in Word format and posted in the Team File Exchange area in Interact. 

The Privacy Strategy Group Wiki page in the Team area in Interact should be used to develop the strategy document and gather comments and suggestions from each team member. This Wiki should be exported as a single file and placed in the Team File Exchange area. 

Any strategy discussions in the team forum should be exported into a single document and loaded into the Team File Exchange area in Interact.

Each student is required to submit the following through EASTS when their group assignment is complete. This submission should contain the following:

• Student name
• Team name
• Assignment  number
• Assignment file name
• Copy of the student's answer to the question allocated to them by the team.

This will allow you to receive marks and feedback when your team assignment is marked.

Rationale

back to top

This assessment task will assess the following learning outcome/s:

• be able to examine the legal, business and privacy requirements for a cloud deployment model.
• be able to evaluate the risk management requirements for a cloud deployment model.
• be able to critically analyse the legal, ethical and business concerns for the security and privacy of data to be deployed to the cloud.
• be able to develop and present a series of proposed security controls to manage the security and privacy of data deployed to the cloud.  

Marking criteria and standards

Presentation

back to top

As a rough guide, the report should not be longer than about 8,000 words. The report is to be written in Word format and submitted in turnitin. 

The Privacy Strategy Group Wiki page in the Team area in Interact should be used to develop the strategy document and gather comments and suggestions from each team member. This Wiki should be exported as a single file and placed in the Team File Exchange area. 

Any strategy discussions in the team forum should be exported into a single document and loaded into the Team File Exchange area in Interact.