Information Security Report for Woolworths Supermarket Analysis

This report provides a detailed analysis of information security for Woolworths Supermarket in Australia. It begins with an executive summary and introduction to information security concepts. The report then offers a brief description of Woolworths, followed by the research, formulation, and development of a strategic security policy tailored to the company's nature and stakeholders. The core of the report identifies and assesses various threats and vulnerabilities to Woolworths' organizational network, including malware, phishing, spear phishing, man-in-the-middle attacks, Trojans, ransomware, and distributed denial-of-service attacks. For each threat, the report outlines mitigation techniques. Finally, the report concludes with a summary of the findings and recommendations for enhancing Woolworths' information security posture. The report includes a table of contents and references for further study.

Running head: INFORMARTION SECURITY
Information Security for Woolworths Supermarket
Name of the Student
Name of the University
Author’s Note:

1
INFORMATION SECURITY
Executive Summary
The objective of the report is to know about security of information and data for Woolworths
Supermarket in Australia. It is a collection of few guidelines and procedures that are being
created for helping the respective company in a data breach scenario. After having a
formalized set of different guidelines, the businesses could easily minimize the risk and also
ensure better work continuity for staff change. Several larger enterprises have employed a
proper security group for successful implementation and maintenance of the organizational
information security program. It is responsible to conduct a risk management process, so that
every threat and vulnerability is being resolved successfully without much complexity. This
report has properly identified different threats to the network of Woolworths with mitigation
methods. Moreover, a security policy is also formulated for this supermarket.

2
INFORMATION SECURITY
Table of Contents
1. Introduction............................................................................................................................3
2. Brief Description of Woolworths Supermarket.....................................................................3
3. Research, Formulation and Development of a Strategic Security Policy for Woolworths
Supermarket based on the Nature of the Company and Stakeholders.......................................3
4. Identification and Assessment of Different Threats and Vulnerabilities of the
Organizational Network and Mitigation Techniques on the basis of the Security Policy.........5
5. Conclusion..............................................................................................................................8
References..................................................................................................................................9

3
INFORMATION SECURITY
1. Introduction
Information security is the tool or process that is being implemented for securing
confidential data from any type of modification, destruction and disruption. Different kinds of
InfoSec are present, which include security of applications, cloud, cryptography,
infrastructures, and IR as well as management of vulnerabilities (Peltier 2016). It is a type of
strategy that is needed to be implemented by all organizations to successfully manage the
processes, policies and tools, required for proper prevention, detection, documentation and
even countering the threats to distinct digitalized and non digitalized information. This report
would be providing a detailed analysis of information security for Woolworths Supermarket
with relevant description. A strategic policy will be developed for the organization and
threats of network will be identified with their mitigation strategies.
2. Brief Description of Woolworths Supermarket
Woolworths Supermarkets is a popular and significant chain of supermarkets in
Australia that is being run by the Woolworths Group. It was founded in the year of 1924 and
eventually accounts more than 80 percent of the Australian market. More than 100000
employees are working in the company (Woolworths Supermarket. 2020). They are
specialized in groceries like vegetables, packaged foods, meat and fruits. According to the
data of August 2019, there were 981 Woolworth’s supermarkets and 43 metro convenience
stores, present in Australia. One of the most basic feature of this distinct supermarket is that
they also provide online services and there is a click and collect facility for all customers.
Moreover, they also provide free home delivery services, hence making it one of the most
modernized and technology based supermarket in the entire Australia.
3. Research, Formulation and Development of a Strategic Security Policy
for Woolworths Supermarket based on the Nature of the Company and
Stakeholders
Woolworths Supermarket has been providing major advantages to their customers, by
ensuring that all customers do not have to visit to their stores and people can order online. For
this purpose, it is extremely vital and significant to make sure that their networks and systems
are free from any kind of threat and data security is maintained under any circumstance (Xu
et al. 2014). One of the most effective steps in maintaining information security is that the
organization would be able to reduce the issues associated with data management with the

4
INFORMATION SECURITY
help of a strategic security policy. This particular policy eventually outlines the
organizational information and assets from any kind of vulnerability, which can be quite
vulnerable for the company. Moreover, this specific security policy should also identify every
resource and asset that has the chance to get affected majorly. These policies should also be
updated on a periodical manner, so that every technological advancement is gained in the
business.
Woolworths is a supermarket and hence they would have different security policies
for their business, as compared to other organizations (Ifinedo 2014). Moreover, the
possibility of penetrating threats inside the company is also reduced to a high level and the
respective organization would be able to increase overall productivity subsequently.
Woolworths would have to circulate the policy to each and every employee of their company.
They are committed to compliance with subsequent privacy laws that are applicable to the
businesses, which eventually set out different standards for better management of the
personal data. The respective strategic security policy of Woolworths would outline the
practices of their personal information management, such as type of data they are collecting
and keeping, process to collect the information, main reasons of collecting, holding, using as
well as disclosing the information, right to access and seek correction of it, process of
complaining about privacy matters and finally sharing their information overseas (Conklin et
al. 2015).
Woolworths should collect persona information of the customers, like names,
addresses, gender, and age and telephone numbers. Moreover, they should also have the
access for customer reference number as well as loyalty card number with membership cards
and loyalty programs. The rewards and redemption details of the customers should also be
mentioned in the policy that are applicable to the loyalty programs. Survey results on
customer feedback should also be included in this particular policy (Fielder et al. 2014). The
information collected and held through the secure financial systems in Woolworths is
considered as one of the most significant and vital requirements in the business.
They can collect the information from different surveys or by interacting with
customers through their promotions, competitions, focus groups, surveys and testimonials.
Communication should be done online and a requirement of personal information would be
provided for every customer to ensure compliance and that only a registered user is accessing
the website of Woolworths. The management of this particular supermarket should check for

5
INFORMATION SECURITY
their existing methods of online goods selling, so that the network and resources are
absolutely safe and secured under every circumstance (Lowry and Moody 2015).
Furthermore, strict rules would be undertaken against the employees, who would violate
rules, made by the organizational stakeholders. It would also help them in enhancing direct
marketing in a digitalized method. If any type of breach or cyber-attack is being identified,
the organization would take up proper legal actions, against the perpetrator, even if he or she
belongs to the organizational management.
4. Identification and Assessment of Different Threats and Vulnerabilities of
the Organizational Network and Mitigation Techniques on the basis of the
Security Policy
Although Woolworths belongs to the supermarket sector of Australia, they have
chances of cyber threat in their networks; since they are providing online services to the
customers. This type of threat is considered as a specific malicious activity, which eventually
seeks into the network for the purpose of damaging data, stealing data as well as disrupting
information (Montesdioca and Maçada 2015). It is extremely common for the organizational
networks that such threats and vulnerabilities would be present for stealing or damaging
confidential information successfully. Different threats and vulnerabilities of the
organizational network of Woolworths are provided in the following paragraphs:
i) Malware: This is the first as well as the most significant potential threat for the
network of Woolworths. The specific software, which performs a malicious task over the
target network or device. It is the software that is intentionally designed for causing damage
to the computers, servers, computerized networks and clients. Various programs are also
considered malware, when they can secretly act against the major interests of the
computerized user.
ii) Phishing: The second distinct potential threat or vulnerability for the network of
Woolworths is phishing (Tsohou et al. 2015). It is an email specified attack, which includes
deceiving the respective email recipients into disclosure of the sensitive data for transferring
malware after clicking on the hyperlinks within a message. It is a fraud attempt for gaining
confidential data like passwords, usernames as well as credit card details after hiding itself as
the most trustworthy entity.

6
INFORMATION SECURITY
iii) Spear Phishing: Another vital and noteworthy potential threat or vulnerability for
the network of Woolworths is spear phishing. It is a highly sophisticated formation of
phishing attack, in which the attacker eventually learns about the respective victim and then
impersonates as a trustworthy entity (Pachghare 2015). The cyber criminals have the
intention of stealing data for malicious purposes from the organizational network and hence
create major issues for the business.
iv) Man in the Middle Attack: The next vital and noteworthy potential vulnerability
or risk for this network of Woolworths is man in the middle attack. In the attack, the attacker
can establish a specified position within the sender as well as recipient of different electronic
message for intercepting them. These senders and recipients eventually think that they are
eventually interacting with each other. It is quite common for any organizational network.
v) Trojans: This is yet another popular and significant potential threat or vulnerability
for the network of Woolworths (Siponen and Vance 2014). It is a specific kind of malware,
which enters the targeted system that looks like 1 thing and then lets out the malicious code
within the host system. It is being designed for damaging, disrupting and stealing sensitive
data by the attacker. The malware and virus of Trojan are often utilized interchangeably. The
attacker can easily target the infected computer for the purpose of ensuring that maximum
vulnerability is present in the infected system and the user cannot save his or her data to be
lost.
vi) Ransomware: The sixth vital and noteworthy potential threat or vulnerability for
the network of Woolworths is ransomware. It is an attack, which eventually includes
encryption of data over the specific target system and also demanding heavy ransoms in
exchange to let that particular user having accessibility to the information once again. Such
distinct attacks subsequently take place from the lower level attacks to major incident, such
as locking the online data of Woolworths for every branch in Australia. Since, Woolworths
belongs to the supermarket sector, they would face major issues while paying ransom to their
attacker.
vii) Distributed Denial of Service Attack: Another significant and popular threat or
vulnerability for the network of Woolworths is distributed denial of service or DDoS (Flores
and Ekstedt 2016). It is a significant malicious attempt for disrupting the normal traffic of the
targeted servers, networks and services by overpowering this target as well as the surrounding
infrastructures with a series of the internet traffic. This particular cyber-attack is quite

7
INFORMATION SECURITY
common for any organizational network, as the perpetrator seeks in making the network or
machine unobtainable to the intended user either by indeterminately or temporarily disturbing
the service of the host, after being linked to the Internet.
These above mentioned cyber threats could be easily resolved after using some of the
most significant techniques of mitigation, which are provided in the following paragraphs:
i) Malware: The most effective technique to mitigate malware is using spam filters as
well as anti-virus program, so that the effect of malware is reduced or rather the impact is
stopped completely (Lee 2014). Updates are also required for this purpose.
ii) Phishing: One of the basic and the most efficient method to mitigate the chance of
phishing attack in the network of Woolworths would be providing proper training to the
employees. As a result, these employees would not click on any type of unsolicited emails or
links and the entire network would safe and secured.
iii) Spear Phishing: Providing training to the employees is the most significant
method of stopping spear phishing as the trained employees would be able to identify the
suspicious emails (Mahdi, Alhabbash and Naser 2016). Different security teams should
implement and also update the security processes majorly.
iv) Man in the Middle Attack: Encryption would be an important and significant
mitigation technique for man in the middle attack. Moreover, the respective setups of TLS
and SSL should be verified to ensure better effectiveness in reducing such distinct impacts.
v) Trojans: Antivirus programs cannot identify the Trojans as malicious attacks and
as a result, the attacker gets easier chance to get into the system and involve high
vulnerability (Grama 2014). Trojan rootkits are referred to as the most sophisticated methods
that help out in detecting the malware and any kind of malicious activities easily and
promptly.
vi) Ransomware: Installation of firewalls in the networks would be one of the most
important and noteworthy methods for treating issues related to ransomware. Moreover, the
security experts of Woolworths should also restrict code execution and any type of
administrative and system access for ensuring that the network is safe from these attacks.
vii) Distributed Denial of Service Attack: A properly designed network equipment
could be utilized for treating distributed denial of service attack for ensuring that such threats

8
INFORMATION SECURITY
are mitigated successfully without much complexity within the respective network of
Woolworths (Parsons et al. 2014).
5. Conclusion
Hence, it could be concluded that InfoSec is required to ensure that the respective
organization is absolutely free from any type of data theft or data loss and the information is
safe and secured. Credibility of the information is retained on a high level and business
operations are being executed successfully. Moreover, different aspects and considerations of
this information security program are being highlighted successfully and the business obtains
maximum benefits without much complexity. This report has provided a proper discussion on
information security for Woolworths Supermarket in Australia after making a proper strategic
policy and relevant threats in the organizational network.

9
INFORMATION SECURITY
References
Conklin, W.A., White, G., Cothren, C., Davis, R. and Williams, D., 2015. Principles of
computer security. McGraw-Hill Education Group.
Fielder, A., Panaousis, E., Malacaria, P., Hankin, C. and Smeraldi, F., 2014, June. Game
theory meets information security management. In IFIP International Information Security
Conference (pp. 15-29). Springer, Berlin, Heidelberg.
Flores, W.R. and Ekstedt, M., 2016. Shaping intention to resist social engineering through
transformational leadership, information security culture and awareness. computers &
security, 59, pp.26-44.
Grama, J.L., 2014. Legal issues in information security. Jones & Bartlett Publishers.
Ifinedo, P., 2014. Information systems security policy compliance: An empirical study of the
effects of socialisation, influence, and cognition. Information & Management, 51(1), pp.69-
79.
Lee, M.C., 2014. Information security risk analysis methods and research trends: AHP and
fuzzy comprehensive method. International Journal of Computer Science & Information
Technology, 6(1), p.29.
Lowry, P.B. and Moody, G.D., 2015. Proposing the control‐reactance compliance model
(CRCM) to explain opposing motivations to comply with organisational information security
policies. Information Systems Journal, 25(5), pp.433-463.
Mahdi, A.O., Alhabbash, M.I. and Naser, S.S.A., 2016. An intelligent tutoring system for
teaching advanced topics in information security.
Montesdioca, G.P.Z. and Maçada, A.C.G., 2015. Measuring user satisfaction with
information security practices. Computers & Security, 48, pp.267-280.
Pachghare, V.K., 2015. Cryptography and information security. PHI Learning Pvt. Ltd..
Parsons, K., McCormac, A., Pattinson, M., Butavicius, M. and Jerram, C., 2014. A study of
information security awareness in Australian government organisations. Information
Management & Computer Security, 22(4), pp.334-345.
Peltier, T.R., 2016. Information Security Policies, Procedures, and Standards: guidelines for
effective information security management. Auerbach Publications.

10
INFORMATION SECURITY
Siponen, M. and Vance, A., 2014. Guidelines for improving the contextual relevance of field
surveys: the case of information security policy violations. European Journal of Information
Systems, 23(3), pp.289-305.
Tsohou, A., Karyda, M., Kokolakis, S. and Kiountouzis, E., 2015. Managing the introduction
of information security awareness programmes in organisations. European Journal of
Information Systems, 24(1), pp.38-58.
Woolworths Supermarket. 2020. [online]. Accessed from https://www.woolworths.com.au/
[Accessed on 18 January 2020].
Xu, L., Jiang, C., Wang, J., Yuan, J. and Ren, Y., 2014. Information security in big data:
privacy and data mining. Ieee Access, 2, pp.1149-1176.