Cloud Security Report: Analyzing Privacy and Data Protection for DAS

This report provides an overview of cloud security, focusing on the Department of Administrative Services (DAS) in the context of the Australian State Government's shift towards a Shared Service approach. It explores the basic concepts of cloud security, including technologies and strategies for securing information and data. The report analyzes a case study of DAS, detailing a privacy strategy for personal data, covering management, collection, use, and security of digital identities, access, and quality control. It recommends privacy controls, such as encryption. Furthermore, the report outlines a personal data protection strategy, addressing protection, authorized access, de-identification, digital identities, and archiving. The report provides recommendations for both strategies to enhance cloud security and data protection within DAS, including the importance of encryption algorithms to secure sensitive information and mitigate potential risks.

Running head: CLOUD SECURITY
Cloud Security
Name of the Student
Name of the University
Author’s Note:

1
CLOUD SECURITY
Executive Summary
The main objective of this report is to understand the basic concept of cloud security. The wide
set of various technologies and strategies that are utilized to secure the information, data and
several applications are known as cloud computing security. This cloud security helps the users
to secure their data with basic encryption algorithms. The following report helps to understand
the basic case study of Department of Administrative Services or DAS. Two important strategies
are provided in the report. They are the privacy strategy for data and the personal data protection
strategy proposal. These two strategies are described with perfect details and description. Proper
recommendations are also provided for both the strategies.

2
CLOUD SECURITY
Table of Contents
Introduction......................................................................................................................................4
Discussion........................................................................................................................................5
DAS.............................................................................................................................................5
1. Privacy Strategy for Personal Data..........................................................................................6
1.1 Management of Personal Information...............................................................................6
1.2 Collection and Management of Solicited Personal Information........................................6
1.3 Use and Disclosure of Personal Information.....................................................................7
1.4 Use and Security of Digital Identities................................................................................7
1.5 Security of Personal Information.......................................................................................8
1.6 Access to Personal Information.........................................................................................8
1.7 Quality and Correction of Personal Information...............................................................8
2. Recommended Privacy Controls.............................................................................................9
3. Personal Data Protection Strategy.........................................................................................11
3.1 Protection of Personal Information..................................................................................11
3.2 Authorized Access and Disclosure of Personal Information...........................................12
3.3 De-identification of Personal Data..................................................................................12
3.4 Use of Personal Digital Identities....................................................................................12
3.5 Security of Personal Data................................................................................................13
3.6 Archiving of Personal Data.............................................................................................13

3
CLOUD SECURITY
4. Recommended Personal Data Protection Strategy................................................................13
Conclusion.....................................................................................................................................14
References......................................................................................................................................16

4
CLOUD SECURITY
Introduction
Cloud security is the wide range of approaches and strategies of securing data and
information with the help of cloud computing. Several technologies are utilized in this process.
These technologies and strategies are given to the user to secure their data perfectly and safely.
The infrastructure of cloud computing is also involved in this security procedure (Rong, Nguyen
& Jaatun, 2013). It is the sub part of information security and network security. The Department
of Administrative Services or DAS gives various services to the Australian State Government.
The services are procurement, payroll, human resource management, personnel management and
contractor management. Due to the recent changes in the policies of the government, Department
of Administrative Services is shifting to a new approach known as the Shared Service approach
(Almorsy, Grundy & Müller, 2016). This particular approach means that a fixed number of
services will be controlled by DAS for the benefit of the Whole of Government (WofG). DAS
has to follow various strategies and tasks.
The following report outlines a brief description about cloud security for the case study of
Department of Administrative Services or DAS. The report provides a privacy strategy proposal
for DAS. It includes the collection and control of applied personal data, utilization and security
of various digital identities, securing and accessing personal data, rectifying personal data and
proper recommendations to control and secure data with cloud computing (Liu, 2012). The
report also covers a strategy to secure and protect personal data with proper recommendations.
The description of the above discussion is given in the following paragraphs.

5
CLOUD SECURITY
Discussion
DAS
Department of Administrative Services or DAS gives various services to the Australian
State Government. The services are procurement, payroll, human resource management,
personnel management and contractor management. Due to the recent changes in the policies of
the government, Department of Administrative Services is shifting to a new approach known as
the Shared Service approach (Behl & Behl, 2012). This particular approach means that a fixed
number of services will be controlled by DAS for the benefit of the Whole of Government
(WofG). DAS has to follow various strategies and tasks. DAS gives the integrated services to the
remaining agencies and departments of the government. There is another policy of the
government, which is the Cloud First approach. This is utilized for upgrading and obtaining
various services. The various tasks that are to be done by DAS are purchasing a personnel and
HR management application. This particular application will give a human resources suite,
providing a perfect management of performance (Lee, 2012). The employees of DAS will store
the information directly into this particular application with the help of a secured URL. A
secured application of transferring data will upload huge amount of data. It is the responsibility
of DAS to check whether the data entered in correct or not. There will be a new application
known as the Commercial Off The Shelf or COTS will control the public cloud section. All the
authenticated credentials of the authorized users are uploaded to enable the users to access the
payroll of the agency. It is noticed that authentication is done only by utilizing the agency ID
credentials of the users (Aljawarneh, 2012). All the agencies in the Whole of Government are
required to utilize the Active Directory Federated Services of ADFS for federation to the Azure
AD instance for authorization and authentication.

6
CLOUD SECURITY
1. Privacy Strategy for Personal Data
1.1 Management of Personal Information
Department of Administrative Services or DAS will have to secure their personal data
through a good quality of privacy strategy. There are various steps to protect their personal data
(Tsai et al., 2012). The most important step is to manage their personal information so that it is
not accessible by hackers or unauthorized people. The steps to secure the personal data of DAS
are as follows:
a) Secured Browser: Utilization of a safe and secured Web browser is the first and the
foremost step in managing the personal data (Tianfield, 2012). This can help to prevent from
entering into the unauthorized websites and all sorts of virus attacks.
b) Passwords: Utilization of several passwords is another important step to prevent all
types of data hacking (Kulkarni et al., 2012). DAS should keep specific passwords in all of their
private information and they should change those passwords on a regular basis.
1.2 Collection and Management of Solicited Personal Information
a) Logging Out: This is an important step to secure the data form hacking. Every time the
users should log out from the system so that other people are not able to access their data.
b) Anti Virus: This is the most basic and the easiest way to secure personal data. DAS
should install antivirus software in their cloud to protect their personal data from virus attacks
(Chou, 2013).

7
CLOUD SECURITY
1.3 Use and Disclosure of Personal Information
DAS can secure their personal information by blocking the access to the systems and
personal websites (Suresh & Prasad, 2012). The disclosure and utilization of personal
information can lead the organization into serious security problems.
1.4 Use and Security of Digital Identities
A digital identity is data of an organization that is utilized to depict an external
representative (Iankoulova & Daneva, 2012). This particular representative can be an individual,
an organization or an application. Digital identities has several advantages. The main advantages
of digital identities are as follows:
i) Security: The main advantage of digital identity is its security. The data is extremely
safe and secured with the help of digital identity.
ii) Data Integrity: The integrity of the data is not lost because of digital identity. This is
another important advantage of digital identity.
iii) Simple: Digital identity does not require many complexities and time to get
implemented (Salah et al., 2013). This is extremely simple and thus this is another important
advantage of digital identity.
iv) Fast: Digital identities are extremely fast and this is another important advantage of
digital identity.
However, implementing digital identities in DAS can sometimes turn to be risky. These
digital identities should be safe and secured so that there exists no loopholes of hacking in the

8
CLOUD SECURITY
data. The utilization and security of digital identities are the most important step to secure the
cloud.
1.5 Security of Personal Information
a) Pop up Blocking Software: DAS should install a pop up blocking software in their
systems (Suresh & Prasad, 2012). The pop ups are easily utilized to attract various hackers.
b) Not Saving Email and Passwords: DAS should not save their official emails and
passwords in the public cloud.
1.6 Access to Personal Information
a) Limited Access to Systems: All the users should not be allowed to use all the systems
(Malik & Nazir, 2012). DAS should allow and unauthorized users to access their computers and
systems.
b) Private WiFi Connection: DAS should install a private wireless connection for
internet access.
Security and access to personal information is another important step to save the privacy.
The information should be secured so that the unauthorized access to various information is
mitigated (Hamlen et al. 2013). Department of Administrative Services should secure their
personal information by limiting the access to their personal information from unauthorized
users.
1.7 Quality and Correction of Personal Information
The quality and the correction of personal information is another important step to keep
the privacy of the data. DAS should focus on the quality of their information so that there exists

9
CLOUD SECURITY
no loopholes in the privacy (Liu, 2012). Moreover, the information should be corrected from
time to time to avoid all sorts of errors in the information.
2. Recommended Privacy Controls
DAS is dealing with several dangerous information that are highly confidential. There are
various ways to mitigate these risks (Von Solms & Van Niekerk, 2013). It is recommended that
Department of Administrative Services should focus on their security of personal information.
The three ways to mitigate the privacy risks of information are as follows:
a) Encryption: The procedure of encrypting or encoding a particular message to maintain
its security without changing the inner meaning is known as encryption. It encodes the entire
message into a cipher text, which is only readable by the receiver. When a sender sends a
message, he sends it in an encrypted form (Stallings & Brown, 2012). This saves the message
from getting theft and thus security is maintained. There are two main algorithms used for
encryption. They are the Symmetric Key Algorithm and the Asymmetric Key Algorithm. The
symmetric key algorithm is extremely simple. The sender and the receiver are provided with a
key. The sender while sending a message with encodes the message with the key. Once, the
receiver receives the message, he is able to decode the message with that particular key only. No
other unauthorized users will get the access of the data and thus the data is absolutely secured
through encryption (Van Tilborg & Jajodia, 2014). The unencrypted message is known as the
plain text while, the encrypted message is known as the cipher text. The main advantage of
encryption is that it is extremely secured. The second algorithm for encryption is the asymmetric
algorithm. Here, the case is different from symmetric key algorithm. Here the sender and the
receiver have two different keys to encode and decode the message. The sender encrypts the
message with a particular key and the receiver decrypts the message with a different key. The

10
CLOUD SECURITY
main advantage of symmetric key algorithm is that it is extremely simple as both the keys are
same. However, it has one disadvantage as well (Stallings & Brown, 2012). Both the keys are
same in symmetric key algorithm. Thus, if any one of them loses the key, there is a high chance
that the data cannot be recovered any more. This can lead to major problem for any organization.
The main advantage of asymmetric key algorithm is that the security is double than symmetric
key. Since, there are two keys; there is no need to exchange keys between the sender and the
receiver. This helps to keep the keys safe and secured. However, there is a disadvantage as well.
The main disadvantage of asymmetric key algorithm is its complexities. Both the keys are
different and this makes it much complex than the symmetric key (Buchmann, 2013). Another
disadvantage of asymmetric key algorithm is that the time consumption is more as the
complexity is higher. It is highly recommended for DAS to opt for encryption, as encryption
would secure their personal information.
b) Digital Authentication: This is the second most basic and important recommended
strategy to secure the data for DAS. The procedure of getting confidence in the identities of users
digitally is known as digital authentication (Hamlen et al. 2013). The word authentication means
to an electronic procedure, which enables any type of electronic recognition of a legal person.
Authentication also saves the integrity of the data and thus it can be claimed as another strategy
for privacy of data. The main advantage of digital authentication is that it mitigates the chance of
data theft and fraud. In a digital authentication, the identities of the user are given to a particular
information system electronically (Buchmann, 2013). There are three main factors of digital
authentication. They are as follows:
 Knowledge Factors: These factors are nothing but the confidential knowledge of a
user like the password, pin number.

11
CLOUD SECURITY
 Ownership Factors: These factors are those that the user possesses like a credit
card, one-time passwords.
 Inherence Factors: These factors are those factors that an user has got in inherence
like the biometric identifications (Stallings & Brown, 2012). Fingerprint and face
recognitions are two famous inherence factors.
c) Digital Signatures: This is the third important strategy to reduce the privacy risks is
the implementation of digital signatures. DAS can protect their data by implementing this very
safe and secured data security strategy in their organization. this is nothing but a digital code,
which is created by public key encryption and is utilized to verify an user’s identity (Kahate,
2013). It also verifies the contents of the message that are sent over the network. DAS should
implement digital signatures for their private cloud. The main advantages of digital signature are
the speed, cost, security, authenticity, imposter prevention, time stamp and tracking. These
advantages will help DAS to protect their data and thus the privacy should be secured. However,
digital signatures do have some disadvantages (Salomaa, 2013). The disadvantages of digital
signatures include expiry of the signatures, need for verification software, compatibility, need for
implementation of digital certificates. In spite of these disadvantages, digital signatures are one
of the famous strategies for privacy of data. It is highly recommended for DAS.
3. Personal Data Protection Strategy
3.1 Protection of Personal Information
Department of Administrative Services or DAS is having problems in securing their
personal data. This type of data should be secured and safe on immediate basis. There is a high
risk that the data will be lost and the hackers and the unauthorized users will be able to access