SBM4302 IT Audit Report: NAB Data Breach, Security and Cloud Computing

This IT audit report examines the 2019 data breach at National Australia Bank (NAB), caused by human error, which exposed the personal data of 13,000 customers. The report analyzes the breach's impact, including the potential for online fraud and identity theft, and evaluates NAB's response, highlighting the bank's prompt actions to contain the damage. It delves into common security issues, such as spoofing and inadequate access control, and recommends measures like cryptography, up-to-date network security, strong firewall protection, and regular monitoring. Furthermore, the report explores the role of cloud computing in enhancing information security, emphasizing its benefits in data storage, encryption, and protection against DDoS attacks, with the CEO of NAB planning to utilize cloud computing. The report underscores the need for a comprehensive approach to data security to prevent future incidents and maintain customer trust.

Running head: IT AUDIT AND CONTROLS
IT Audit and Controls
Name of Student
Name of University
Author Note

1
IT AUDIT AND CONTROLS
Table of Contents
1. Overview of the Problem Addressed by NAB................................................................2
2. Description of the Common Security Issues...................................................................3
3. NAB’s Response to Data Breach.....................................................................................4
4. Suggested Information Security Measures......................................................................5
5. Role of Cloud Computing in Information Security.........................................................7
References............................................................................................................................9

2
IT AUDIT AND CONTROLS
1. Overview of the Problem Addressed by NAB
The National Australia Bank, had faced an issue of data breach on July 26, 2019 due to a
human error. The breach resulted in uploading the personal data of 13,000 customer to the
servers of two data Service Company. The data breach proved to be a major issue mainly
because the uploaded data included personal information of the those customers, including their
name, date of birth, the personal contact details and in certain cases, the detailed of the
government issued identification number. These information could have been used by the
hackers, criminals or opportunist for their personal benefit or to execute an online crime such as
online fraud, identity theft and blackmail. However, the data breach did not adversely affected
the security of the customers’ account as the issue was quickly detected and all the uploaded data
was taken down within two hours. However, this particular incident questions the security
mechanism that are adopted by NAB.
The issues could be easily addressed and controlled mostly because it was not a cyber-
security issue. The data was uploaded in the servers of the Service Company and the company
was quick to take down those data when asked. However, the incident definitely affected the
customers’ trust to the security system offered by the 4th largest bank in Australia. This incident
indicates the need for the bank to evaluate the common security issues that are associated with
the internal network and the operations of the bank to ascertain that similar events does not occur
in future. The report provides an idea of the NAB’s response to the data breach along with the
suggested information security measures that are needed to be taken by the organization. The
data breach indicates that NAB is required to invest on strengthening the information security of
the bank and for that the CEO wishes to make use of cloud. The report will establish the benefits
of using cloud in protection of information security.

3
IT AUDIT AND CONTROLS
2. Description of the Common Security Issues
The data breach due to human error questions the security of the bank and the security to
the personal and confidential information of the customers. The issue could have been serious if
the data was uploaded in any public server or platform. The incident indicates there is a need of
auditing the security measures and the internal security system of the bank to recommend
effective solutions.
The use of technology have made banking quite convenient for the customers and at the
same time, it has increased the efficiency of providing banking services for the customers.
However, in the current situation, NAB requires to review the common security issue that can
risk the confidentiality of the customers’ data and information (Ahmad, Maynard and Park
2014). The auditor is required to investigate the storage process of the confidential customers’
information. The auditor needs to check whether the stored data is encrypted prior to upload to
any servers.
Another straightforward banking security issue is spoofing. This is a common security
issue that is needed to be investigate by the auditor. Spoofing incorporates development of fake
banking website by the fraudsters to rob the customers (Safa, Von Solms and Furnell 2016). The
employees and the customers of NAB needs to be aware of these type of threats and for that
investigation of this security issue becomes a necessity.
The data breach in NAB has occurred mainly because of human error, where an
employee might have unloaded the customers’ information without knowing or realizing its
repercussions. Hence, it is of foremost necessity for the auditor to investigate the security

4
IT AUDIT AND CONTROLS
knowledge of all the employees of the bank to reduce the chances of occurrence of similar
incident once again.
The data breach incident further establishes the need of enforcing access control so that
the confidential customers’ data can only be accessed by the intended individuals (Baskerville,
Spagnoletti and Kim 2014). The auditor therefore is required to investigate whether proper
access control are in place within the internal system of NAB. This will allow NAB to enforce
proper access control measures where it is required.
The security of the internal network is required to be audited as well to check for any
major security issues in the system. The presence of any botnets or malware or possible security
issues are needed to be audited to propose solutions to deal with the same. Presence of any
malware in the system will indicate a possibility of hackers trying to intrude into the internal
network of the bank, which is required to be addressed.
Furthermore, the auditor needs to investigate whether all the systems and Servers are
properly secured by firewall protection and antivirus (Peltier 2016). The presence of firewall
protection in the internal network and in all the systems of the bank is a necessity to reduce the
chances of any malware infection and the related cyber security concerns (Öğütçü, Testik and
Chouseinoglou 2016.).
The above discussed key concerns are needed to be audited by the auditor to ensure a full
scanning of the current security mechanism and the required security solutions in NAB. The
incident of data breach can pose an opportunity towards the hackers to address the key weakness
of the bank to carry on a cyber-security attack and therefore, it is of foremost necessity to address
the concerns and vulnerability at an earliest.

5
IT AUDIT AND CONTROLS
3. NAB’s Response to Data Breach
NAB has been quite responsive towards the incidents and took necessary measures to
reduce the effect of the incident on the customers. On identifying a probable data breach, NAB
was quick to take actions against the same and ensured that all the data was deleted. The
customers; were rightly informed about the breach so that they can take necessary actions or
report any unusual activities (Nazareth and Choi 2015). The bank promised to pay for fraud
detection and identification services, for the customers, whose data has been compromised. This
response was quite effective as to some extent, it has helped in regaining the trust of the
customers. Along with that NAB had ensured that the customers’ account are checked and
reviewed continuously to detect any unusual activities. Since it was not a cyber-security attack,
no unusual activities were detected. ANB took the full responsibility of the breach and promised
the customers to pay for their government issued identification number in case the ID was to be
reissued. NAB was quick to acknowledge their mistake and took all the necessary steps that
should have been taken to ensure that customers’ data are secured.
4. Suggested Information Security Measures
The data breach that has been faced by NAB indicates that the bank needs to further
strengthen their security measures to ensure that the data stored in the system is secured. In this
section, certain information security measures are suggested for NAB, that NAB should adopt to
eliminate or reduce the chances of occurrence of similar incident in future. The suggested
security measures that NAB should adopt are discussed in the following paragraphs-
Cryptography and Data Encryption: Cryptography is an essential security measure that
is needed to be adopted by NAB to ensure effective network security (Lebek et al. 2014).

6
IT AUDIT AND CONTROLS
Cryptography helps in creation of the written and generated codes that allow the information to
be kept secret and ensures that only the authorized individuals are able to decrypt that
information (Tripathi and Agrawal 2014). Along with cryptography, the data of the customers
are needed to be encrypted so that the hackers or any unintended personnel are not able to access
that data.
Access Control: The occurrence of the data breach due to human error indicate a lack of
proper access control in the exiting security system of the bank (Moro Cortez and Rita 2015).
Access control is needed to be enforced to ensure that only the intended individuals are allowed
to access the confidential customers’ data and information.
Up to Date Network Security: Another recommended security measures for NAB is up to
date network security. The security team needs to investigate the security essentials of the
current system to detect any out of date security components (Li et al. 2015). All the security
components are required to be updated to the latest path to ensure that the data stored in the
network are secured. All the software programs are required to be regularly updated to reduce the
chances of any cyber security attack in the internal network (Smith 2019).
Strong Firewall Protection: A strong firewall protection is needed in the internal
network of the bank and in all the systems to ensure that the data stored in the system are secured
from the intruders. The firewall protection prevent any malwares in entering the system (Bauer
and Bernroider 2017).
Regular Monitoring: Effective data monitoring would have prevented the occurrence of
this data breach. Therefore, it is of foremost necessity for NAB to ensure effective data

7
IT AUDIT AND CONTROLS
monitoring, which would help in easier detection of any type of unusual activities or possible
human errors in the system (Adhie et al. 2018).
Disaster Recovery Plan: It is necessary for NAB to invest on a proper disaster recovery
plan that would help in better management of similar emergency situation (Srikanth et al. 2014).
Although it was not any cyber security issue, there is a possibility that the bank can face major
cyber security issues in future and for that, presence of a proper disaster recovery plan is
essential, which will allow the security team to take prompt action against the attack.
The above indicated security measures are needed to be adopted by NAB to ensure
effective information security and the security of the customers’ data.
5. Role of Cloud Computing in Information Security
Cloud computing offers an on demand availability of the resources, which include data
storage and computing power. The CEO of NAB has decided to make use of cloud computing to
ensure data security and therefore, the role of cloud computing in secure data storage is needed
to be evaluated (Yan, Deng and Varadharajan 2017). Cloud computing will offer a secure
platform to NAB to store the confidential data of the customers in an encrypted form, which will
reduce the chances of data breach.
Cloud computing provides an advanced threat model of endpoint scanning of the threats
at a device level, which in turn helps in increasing the security for the device that has an access
to the network. Therefore, the use of cloud can definitely help in increasing the information
security of the internal network of the bank. Apart from that, the use of cloud offer certain
security benefits, which include, enhanced protection against the DDoS attacks and data security
(Ali, Khan and Vasilakos 2015.). The use of cloud computing offers the needed flexibility in

8
IT AUDIT AND CONTROLS
storage and access of the data. Since the data is stored in an encrypted form, it is possible to
protect data from any sorts of unauthorized access. Therefore, the use of cloud computing can
definitely enhance the security level of NAB.

9
IT AUDIT AND CONTROLS
References
Adhie, R.P., Hutama, Y., Ahmar, A.S. and Setiawan, M.I., 2018, January. Implementation
cryptography data encryption standard (DES) and triple data encryption standard (3DES) method
in communication system based near field communication (NFC). In Journal of Physics:
Conference Series (Vol. 954, No. 1, p. 012009). IOP Publishing.
Ahmad, A., Maynard, S.B. and Park, S., 2014. Information security strategies: towards an
organizational multi-strategy perspective. Journal of Intelligent Manufacturing, 25(2), pp.357-
370.
Ali, M., Khan, S.U. and Vasilakos, A.V., 2015. Security in cloud computing: Opportunities and
challenges. Information sciences, 305, pp.357-383.
Baskerville, R., Spagnoletti, P. and Kim, J., 2014. Incident-centered information security:
Managing a strategic balance between prevention and response. Information &
management, 51(1), pp.138-151.
Bauer, S., and Bernroider, E. W. 2017. From information security awareness to reasoned
compliant action: analyzing information security policy compliance in a large banking
organization. ACM SIGMIS Database: the DATABASE for Advances in Information
Systems, 48(3), 44-68.
Lebek, B., Uffen, J., Neumann, M., Hohler, B. and Breitner, M.H., 2014. Information security
awareness and behavior: a theory-based literature review. Management Research Review.
Li, S. H., Yen, D. C., Chen, S. C., Chen, P. S., Lu, W. H., and Cho, C. C. 2015 Effects of
virtualization on information security. Computer standards & interfaces, 42, 1-8.

10
IT AUDIT AND CONTROLS
Moro, S., Cortez, P. and Rita, P., 2015. Business intelligence in banking: A literature analysis
from 2002 to 2013 using text mining and latent Dirichlet allocation. Expert Systems with
Applications, 42(3), pp.1314-1324.
Nazareth, D.L. and Choi, J., 2015. A system dynamics model for information security
management. Information & Management, 52(1), pp.123-134.
Öğütçü, G., Testik, Ö.M. and Chouseinoglou, O., 2016. Analysis of personal information
security behavior and awareness. Computers & Security, 56, pp.83-93.
Peltier, T.R., 2016. Information Security Policies, Procedures, and Standards: guidelines for
effective information security management. CRC Press.
Safa, N.S., Von Solms, R. and Furnell, S., 2016. Information security policy compliance model
in organizations. computers & security, 56, pp.70-82.
Smith, R.E., 2019. Elementary information security. Jones & Bartlett Learning.
Srikanth, B., Padmaja, G., Khasim, S., Lakshmi, P. and Haritha, A., 2014. Secured bank
authentication using image processing and visual cryptography. International Journal of
Computer Science and Information Technologies, 5(2), pp.2432-2437.
Tripathi, R. and Agrawal, S., 2014. Comparative study of symmetric and asymmetric
cryptography techniques. International Journal of Advance Foundation and Research in
Computer (IJAFRC), 1(6), pp.68-76.
Yan, Z., Deng, R.H. and Varadharajan, V., 2017. Cryptography and data security in cloud
computing.

11
IT AUDIT AND CONTROLS