Cloud Security and Privacy Report: DAS Personal Data Security

This report delves into the critical aspects of cloud security and privacy, focusing on the challenges faced by the Department of Administrative Services (DAS) in Australia as it transitions to a cloud-based, shared services approach. The report dissects various facets of personal data privacy strategy, including the management, collection, usage, and disclosure of personal information, alongside the utilization and security of digital identities. It emphasizes the importance of robust security measures such as password management, secure browsers, and access controls to safeguard sensitive data. Furthermore, the report provides detailed recommendations for privacy controls, data protection strategies, and the protection of personal information, authorized access, and disclosure of personal information. The report also highlights the need for de-identification of personal data, secure use of personal digital identities, and archiving of personal data, offering a comprehensive overview of best practices in cloud security and privacy.

Running head: CLOUD SECURITY AND PRIVACY
Cloud Security and Privacy
Name of the Student
Name of the University
Author’s Note:

1
CLOUD PRIVACY AND SECURITY
Table of Contents
Introduction......................................................................................................................................3
Discussion........................................................................................................................................5
1. Personal Data Privacy Strategy...............................................................................................5
1.1 Management of Personal Information...............................................................................5
1.2 Collection and Management of Solicited Personal Information........................................6
1.3 Use and Disclosure of Personal Information.....................................................................6
1.4 Use and Security of Digital Identities................................................................................7
1.5 Security of Personal Information.......................................................................................8
1.6 Access to Personal Information.........................................................................................9
1.7 Quality and Correction of Personal Information.............................................................10
2. Privacy Controls Recommendations......................................................................................11
3. Personal Data Protection Strategies.......................................................................................18
3.1 Protection of Personal Information..................................................................................18
3.2 Authorized Access and Disclosure of Personal Information...........................................19
3.3 De-Identification of Personal Data..................................................................................19
3.4 Use of Personal Digital Identities....................................................................................19
3.5 Security of Personal Data................................................................................................20
3.6 Archiving of Personal Data.............................................................................................20
4. Privacy Control Recommendations.......................................................................................20

2
CLOUD PRIVACY AND SECURITY
5. Interaction..............................................................................................................................27
Conclusion.....................................................................................................................................28
References......................................................................................................................................31

3
CLOUD PRIVACY AND SECURITY
Introduction
Cloud computing is a technique or tool that helps to transfer data and other services of
computing. The computing services are of many types like the networking, storage, analytics,
software, servers and many more (AlZain et al., 2012). These services transfers and delivers
these services on the Internet. This internet is also known as cloud. The organizations that
provide these types of services in the cloud are known as the providers of cloud or cloud
providers. They get money for providing these types of services. This charge is taken on the
basis of the amount of usage the other organization is incurring and the amount of time the
organization is using those cloud services. In modern world, cloud computing is one of the most
utilized technologies. It is not even realized when cloud computing is used. Cloud computing
delivers software whenever they are on demand (Chaisiri, Lee & Niyato, 2012). It analyzes data
and makes them secured. It streams several video and audio. The main advantage of cloud
computing is that it is extremely cost effective. The other advantages include the speed and
productivity of the services. It is extremely reliable and flexible, which makes it even popular for
all organizations. In spite of having so many advantages, cloud computing do have several
disadvantages. The main disadvantage of cloud computing is that it is completely dependent on
the Internet. When the Internet connection is not up to the mark or is not working, it is evident
that cloud would not work. The other disadvantage of cloud computing is its security and privacy
(Gampala, Inuganti & Muppidi, 2012). Though cloud is extremely reliable, however, there is
always a high chance that the data can get deleted or hacked in the cloud infrastructure. There are
normally three types of cloud services, which include Infrastructure as a Service, Platform as a
Service and Software as a Service.

4
CLOUD PRIVACY AND SECURITY
The following report outlines a brief description on the cloud privacy and security on a
given case study. DAS or the Department of Administrative Services provides all types of
services to the State Government of Australia. The services are of various types and categories
(Gellman, 2012). These services include payroll, personnel management, procurement
management, contractor management and human resources management. The government of
Australia has recently changed their policies. For this reason, the Department of Administrative
Services is moving and shifting to an innovative cloud approach. This approach is known as
Shared Service approach. The specialty of this approach is that the Department of Administrative
Services or DAS will manage and control a constant and fixed number of services. The report
describes about the personal data privacy strategy (Hamlen et al., 2012). This strategy includes
the management of personal information, collection and management of solicited personal
information, usage and disclosure of personal information, utilization and security of digital
identities, security of personal identities, and access to personal information, quality and
correction of personal information. Proper recommendations are also provided for privacy
controls of personal information. The second strategy is for the personal data protection, which
includes protection of personal information, authorized access and disclosure of personal
information, de-identification of personal data, usage of personal digital identities, security of
personal data, archiving or personal data (Jain & Paul, 2013). Proper recommendations are also
provided for protection of personal data.

5
CLOUD PRIVACY AND SECURITY
Discussion
1. Personal Data Privacy Strategy
1.1 Management of Personal Information
Department of Administrative Services or DAS is worried about their security and
privacy of data in the cloud (Liu, 2012). The quality of the strategy that is to be involved in DAS
should be of good quality. However, the first step for this strategy is to manage and control the
personal information. This will help in protecting the information easily. There are several steps
that can help the DAS to manage their personal information. This particular step is in their hand
only (Zissis & Lekkas, 2012). This management can stop other intruders to hack and intrude the
information. The several steps for securing the information are as follows:
a) Passwords: This is the most efficient and basic step for securing information.
Passwords should be present in all aspects of their cloud, so that there exists no loophole in the
security. Moreover, keeping passwords is not only enough (Jadeja & Modi, 2012). Changing and
altering these passwords on a regular basis is mandatory for the DAS. The passwords can easily
mange and secure the information from hackers.
b) Secured Browser: The second most important way of managing and controlling the
personal information in the Department of Administrative Services is utilizing a safe and secured
browser (Yu et al., 2013). The safe browser does not allow any spam or virus to enter through it
and even the hackers are unable to get into it. The personal information can be easily managed
through a safe and secured browser.

6
CLOUD PRIVACY AND SECURITY
1.2 Collection and Management of Solicited Personal Information
The second step in the privacy strategy is to collect and manage the solicited or requested
personal information. The collection of this data is easily done by following certain simple steps.
These steps include:
a) Reliable Source: Solicited personal information can be collected and managed only
when all the requirements are met and the information is absolutely necessary and are related to
every action and function (Iankoulova & Daneva, 2012). The main step is to collect, gather and
acquire the information from a reliable source.
b) Filtering of Information: This is the second most important step for secured collection
and management of personal information. Once the collection is done from a reliable source, the
information should be filtered (Yang & Jia, 2013). This includes the management portion. The
filtering of information will eradicate all the unnecessary information and thus only the required
information will be collected.
c) Review: The third step of this collection and management process is to review the
information. This review is extremely important once the information is filtered out (Zissis &
Lekkas, 2012). If the information is useful it will be kept and if the information is not useful, it
should be deleted on immediate basis.
The above steps would be helpful for collection and management of personal information
of DAS.
1.3 Use and Disclosure of Personal Information
This is the third step of the privacy strategy of personal information. The information
should be used and disclosed by authenticated users (Garrison, Kim & Wakefield, 2012). There

7
CLOUD PRIVACY AND SECURITY
are various ways to secure and block the access of unauthenticated users. The ways are as
follows:
a) Logging Out: This is most basic way of securing personal information from
unauthenticated users (Gupta, Seetharaman & Raj, 2013). When a user logs in into an account
that contains all the confidential data, there is always a chance that the data can be lost. The
hackers and the intruders will be easily able to get the information if he does not log out from
that account or of he closes the system without logging out (Jadeja & Modi, 2012). This
phenomenon stops the hackers from using the information to some extent. Even, the information
is not disclosed easily.
b) Limited Access to Systems: This is the second way of securing the personal
information from being used and disclosed in front of the unauthenticated users (Pearson, 2013).
The access should be limited so that the hackers are not able to track them down. Passwords play
a significant role in this phenomenon.
The above ways would be extremely helpful for DAS to stop the use and disclosure of
their personal information.
1.4 Use and Security of Digital Identities
The data of an organization, utilized to portray or represent an external representative is
known as a digital identity (Yang & Jia, 2013). This digital identity can either be an
organization, an application or a person. These identities have various advantages and benefits.
The important benefits of digital identities are as follows:
a) Data Integrity: Digital identity helps to maintain the integrity of the data. It is
extremely beneficial for DAS.

8
CLOUD PRIVACY AND SECURITY
b) Security: The first and foremost thing that comes into mind in case of data is its
security (Wu et al., 2012). Digital identities help to secure the data completely and thus data does
not get lost.
c) Fast: The third advantage of digital identity is that it is extremely fast and the speed of
this identity makes it popular amongst all.
d) Simple: Digital identities do not have many complexities and is extremely simple. This
simplicity makes it easier to implement and use.
In spite of having many advantages, there always exists a chance of hacking in such
identities (Iankoulova & Daneva, 2012). The security should be extremely high while
implementing these digital identities. DAS should focus on their security and use of the digital
identities in the privacy control strategy of personal information.
1.5 Security of Personal Information
This is the most important step in the strategy. The personal information contains all the
necessary and confidential data that an organization wants to preserve (AlZain et al., 2012). This
information cannot be leaked at any cost as it will increase vulnerabilities and cyber threats.
There are several ways to secure the personal information. They are as follows:
a) Anti Virus: This is the simplest way of securing any system. If the system will be
protected, it is evident that the information will also be protected (Hashizume et al., 2013). Each
and every system should be secured with antivirus so that there exists no loopholes in security.
b) Passwords: This is the most efficient and basic step for securing information.
Passwords should be present in all aspects of their cloud. Moreover, keeping passwords is not

9
CLOUD PRIVACY AND SECURITY
only enough (Yang & Jia, 2013). Changing and altering these passwords on a regular basis is
mandatory for the DAS. The passwords can easily mange and secure the information from
hackers.
c) Pop up Blocking: This type of software helps to block the pop up windows and thus
the information cannot be hacked or intruded (Behl & Behl, 2012). The pop up windows are
always attracting various hackers for phishing purposes.
These several ways will be helpful for the Department of Administrative Services in
designing their personal information privacy strategy.
1.6 Access to Personal Information
The personal information should not be accessible to everyone especially for the
unauthenticated and unsanctioned users (Yu et al., 2013). There are various ways to stop these
types of users from accessing the personal information. DAS have to take certain measures for
securing the information. These security measures are as follows:
a) Access Control: The access to the system should be controlled and managed so that the
personal information is accessed by all the users. This measure is needed and required for all the
systems in the Department of Administrative Services.
b) Using Special Characters in Passwords: Passwords should be set in such a way that
they could not encrypted easily (Ryan, 2013). This type of passwords is used by almost
organizations for security purposes.
c) Limited Access to Systems: This is the third way of securing the access of the personal
information from being used and disclosed in front of the unauthenticated users. The access

10
CLOUD PRIVACY AND SECURITY
should be limited so that the hackers are not able to track them down. Passwords play a
significant role in this phenomenon.
d) Private WiFi Connections: Most of the security issues arises because of the open
access of the Internet or most precisely the WiFi connections. These types of connections allow
multiple users to access the information easily (Srinivasan et al., 2012). Department of
Administrative Services or DAS should restrict the access of the Internet so that everybody is not
able to access the WiFi connection. It should be absolutely private and only the authenticated
users would be able to access them.
These security measures would help DAS for securing and preserving their personal
information and their privacy strategy would be completed.
1.7 Quality and Correction of Personal Information
The quality of any information should be up to the mark to ensure that the organization is
not securing and storing wrong information. Department of Administrative Services should
preserve their personal information by taking several measures (Behl & Behl, 2012). However, it
should be ensured at first that the information which is being stored is of the best quality. This
will help the organization to eradicate all the unnecessary information and to store only the
necessary and important information. The second part is to correct the information. Even if the
information has some problems within it, it should be corrected immediately so that DAS do not
face any problems in future (Khalil, Khreishah & Azeem, 2014). This quality and correction of
personal information is the most important step in the strategy of privacy and security. Moreover,
a system should be implemented to check the overall privacy and security of the system and the
information.

11
CLOUD PRIVACY AND SECURITY
The above-mentioned steps will complete the entire process of privacy data control
strategy (Popa et al., 2012). Department of Administrative Services should opt for this strategy to
control and secure their personal information.
2. Privacy Controls Recommendations
S.
No
“Privacy Controls
Risks
(Personal data)”
“Mitigation Plans” “Implementation “
1. Malicious Code or
Software: This type
of software or code
is implemented in
any system for
hacking purpose
(Rong, Nguyen &
Jaatun, 2013). A
hacker or an intruder
does this type of job
so that he is able to
hack into the hack
and obtain all the
1. Antivirus: This is the
most basic and simple
mitigation plan for any type
of risk in the personal data
(Khalil, Khreishah & Azeem,
2014). This type of software
helps to detect and prevent
the virus attacks and
malicious codes or software
from entering into the
system.
1. Antivirus can be
implemented in any
system by installing the
software in the system
easily.