Cyber Security Report: SMS Security, University A, NSW, Australia

This report analyzes the cyber security considerations for University A's new Student Management System (SMS), focusing on legal and regulatory compliance. It addresses the Privacy Act of 1988 and the Privacy and Data Protection Act of 2014, outlining the requirements for data privacy, confidentiality, and secure storage of student information. The report also covers IT hardware and software acquisition policies, emphasizing the need for adherence to minimum standards and pre-qualification of vendors. Furthermore, it highlights the importance of IT security policies, risk assessments, and the implementation of a robust IT service management framework. The document emphasizes the importance of compliance to mitigate legal and financial risks, improve student experience, and protect the university's reputation. The report provides a detailed overview of the key components of a secure SMS, including data integrity, confidentiality, and the continuous monitoring of IT security.

Cyber
security
law
enforceme
nt
By [Student Nsme]

Outline Laws and Regulation Briefing
 Privacy Act of 1988 Debrief
 Privacy and data Protection Act of 2014 Debrief
 IT Hardware and Acquisition Policy Debrief
 IT Security Policy Debrief
 Obligations Debrief
 Compliance Debrief
 Other Concerns
2

and
Regulati
ons
 Privacy Act 1988
 Privacy and data protection
act of 2014
 IT hardware and software
acquisition policy
 IT Security policy
(Krausz, 2009)
3

Privacy Act
1988
 Private data must be private
 Use data for what it was
collected
 Protect data on storage and on
transit
 Systems and application must
adhere to the act
4

Privacy and
Data
Protection
act of 2014 Data must be confidential
 Data Integrity maintained
 Data must be readily available
 Citizens data kept in secure
storage
(Goucher, 2016)
5

IT Hardware
and
Software
Acquisition Follow National Laws on
procurement
 Software must meet minimum
standards requirements
 Vendors must be pre-qualified
by university
 Software must be scrutinized
for non compliance
6

IT Security
Policy
 IT risk assessment done
 Software Requirements met
 University security policy on
systems and application met
7

Obligations
 Put procedures for compliance
 Creates awareness and
Trainings
 Conduct due care and due
diligence
 Conduct risk assessments
(Awad and Fairhurst, 2018)
8

Importance
of
Compliance Mitigate Legal non compliance
risks
 Negotiate for more funding
 Collaborate with other
institutions
 Reduce project financial risks
 Competitive advantage
9

Other
Concerns Mitigate Legal non compliance
risks
 Negotiate for more funding
 Collaborate with other
institutions
 Reduce project financial risks
 Competitive advantage
(Anderson, Baskerville and Kaul,
2017)
10

Other
Concerns Con’t IT service management
framework
 IT Service management
standards
 Information Security Audit
 Risks Assessment Audit
11

12
References
Anderson, C., Baskerville, R.L. and Kaul, M., 2017. Information Security Control Theory:
Achieving a Sustainable Reconciliation Between Sharing and Protecting the Privacy of
Information. Journal of Management Information Systems, 34(4), pp.1082–1112.
Awad, A.I. and Fairhurst, M.C., 2018. Information Security : Foundations, Technologies and
Applications. IET Security Series. London, United Kingdom: The Institution of Engineering and
Technology.
Goucher, W., 2016. Information Security Auditor : Careers in Information Security. BCS Guides to
IT Roles. Swindon: BCS, The Chartered Institute for IT.
Krausz, M., 2009. Information Security Breaches : Avoidance and Treatment Based on ISO27001.
Ely: IT Governance Publishing.