DAS: Security and Privacy Risk Assessment for HR Management Software

This report provides a comprehensive security and privacy risk assessment for the Department of Administrative Services (DAS), focusing on its transition to a shared services model and cloud-first approach for HR and personnel management. It examines the implementation of BambooHR, a SaaS application, and its implications for employee data security, operational location, and the mitigation of threats like phishing and weak passwords. The report delves into the security and privacy implications of data processing locations, the handling of trade secrets, and the challenges of data sovereignty in a cloud environment. It highlights issues related to data sensitivity and provides mitigation procedures, including the use of BambooHR for controlled access and data privacy. The report concludes with recommendations such as alerting, centralized logging, redundancy, and 2-factor authentication to further strengthen DAS's security posture and protect sensitive information.

DAS MANAGEMENT
SECURITY AND PRIVACY RISK
ASSESSMENT FOR THE DAS

Introduction
The topics to be discussed:
 The presentation is based on the Department of Administrative Service.
 The security assessment and the privacy risk assessment are discussed.
 A software named BambooHR is selected which is a SaaS application software
for HR management which is discussed in the presentation.
 The security implications and the privacy implications are also discussed in the
presentation.
 Issue related to data sensitivity of the organisation are also discussed in the
presentation and the issues which are related to data sovereignty are discussed
here.
 The presentation will provide a clear conclusion regarding HR management
software solution along with the security and risk assessment.

SaaS application- BambooHR
About BambooHR:
 BambooHR is a SaaS application which originates from a US based company.
 The application provides a solution for the HR department of an organisation
(Pugh et al., 2015).
 All the activities that are performed by HR can be managed by this
application. This application helps the HR to perform their tasks with more
focus and security.

Operational solution of
BambooHR
The solution provided by BambooHR are as follows:
 BambooHR handles a numerous number of operational solutions of HR activities in a
compact structure.
 The overall agility, efficiency of the organisation increases (Zhou & Guan, 2018).
 The problems that the HR faced in managing all the different activities which causes the
increase of data redundancy and it becomes complex for the HR to navigate. This is the
reason BambooHR provides a better support to the HR department.

Affect on security posture of DAS
due to operational solution
 As most of the data of the employees of the organisation are in the hand
of the HR department, it is the responsibility for the HR to secure the data
(Syed et al., 2019).
 The software helps to manage better all the data of the employees by
providing role-based access and by providing data encryption.
 The application of operational solutions of BambooHR software the
security posture of DAS can be managed.

Operational Location of
BambooHR
 Due to the security concern of the important data of the
organisation it is very important to have an update of the
location where all the operations of the organisation are
performed (Lovrić & Horvat, 2016).
 In case of the change in locations of the operation BambooHR will
give instant update of the changed location.

Affect on security posture of DAS
due to operational location
 As the operational location feature of BambooHR provides big
support to the HR department, the HR of the DAS management
uses the feature to get the location update (Maksymiuk, 2017).
 This will provide security of all the documents of the employees
and provide a good effect on the security perspective of DAS.

Threat on employee data
The threats are as follows:
 The security threat on employee data may occur due to certain cause such as
 Phishing
 weak password
 disabled security control
 unauthorised installation of application; and many other causes.
 In DAS the risk of the employee data may cause a big damage. Due to this
the HR department should manage the data with more care.

Operational solution & operational
location mitigate threat
1. The operational tools of BambooHR provides various type of operational solution
to the HR which benefits the HR to manage the employee data of DAS (Cherinka &
Prezzama, 2015).
2. The application provides various security gateways which makes the data much
secured.
3. Besides, the operational location helps the HR to manage the location very easily
which secures the data at higher extent.

Security implication of data
processing location
• To provide better security in the location of the organisation where the
data are processed is very important.
• With the implication of the application BambooHR the management
capacity of the location where the data are processed increases.
• The application provides a compact security support to the organisation
which if followed will give a secured environment for the location of data
processing.

Privacy implication of data
processing location
 To provide privacy of the data present in the data processing location and so that
the data of DAS do not go to wrong hands. DAS should use the BambooHR
application.
 In this case the data of the employees will be managed in a particular location in
the internet and can be accessed very easily by the authorised persons (Dyrda et
al., 2017).
 There will be high security that will help to keep up the privacy in the data
processing location of DAS.

What are Trade Secrets?
• Information of an organization that the owner considers to
protect as their sole property.
• Mainly comprised of the confidential and valuable information of
the organization.
• The trade secrets are governed by the legislative government
regarding the safe using of the trade secret policies.