Cloud Security Report: Analyzing SaaS Migration for DAS HR Systems

This report analyzes the impact of the Department of Administrative Services (DAS) migration to Software as a Service (SaaS) for its HR and personnel database management. The report examines the security and privacy implications of this migration, including threats and risks to employee data, the impact of BYOD, compliance issues, and digital identity. It assesses risks associated with SaaS applications, including loss of control, cybersecurity concerns, and privacy breaches. The study explores the vulnerabilities in HR databases, the challenges of digital identity management, and the need for robust security measures. The report provides an overview of security, hybrid environments, speed, and the issues related to digital identities. It concludes with a discussion of the need for mature SaaS designs and the importance of addressing the human element in security protocols. The report highlights the need for proper data security, privacy, and risk assessment to protect employee data and ensure compliance within the Australian State Government's shared services model.

Running head: CLOUD SECURITY
Cloud Security
Name of the Student
Name of the University
Author Note

1CLOUD SECURITY
Executive Summery
The main aim of this report is to analyze the impacts of the migration to SaaS, decision taken
by DAS. DAS provides different services to the organizations in the State Government of
Australia. There provided service is HR management, payroll management, constructor
management and so on. They have decided to implement the HR and Personnel Database
management software in SaaS for better security and privacy for the employee’s data. This
study discusses about the migration to the SaaS and the risks and threats of the migration to
SaaS of the security and the privacy of the information of the employees of the organization
of the Australian State Government. There are some risk assessment of the threats and risks
of the privacy and security of the personal data of the employee. Digital identity is the issues
that are discussed in this study and the assessment of the study. This paper concludes that HR
and personnel database software application and its migration to SaaS are variables and the
design of the SaaS designs have not yet matured. This study explains that these methods are
increasingly needed for the organization. In order to provide a SaaS alternative, DAS plans to
buy a staff and HR management implementation. The reason why DAS should implement the
HR database into SaaS are In embracing cloud computing, lower servicing costs, particularly
for databases, are often the first concern.

2CLOUD SECURITY
Table of Contents
Introduction................................................................................................................................4
Security of Employee Data........................................................................................................4
Threats and Risks to the Security in HR Database................................................................5
BYOD................................................................................................................................5
Compliance........................................................................................................................5
Litigation Exposer Risks....................................................................................................6
Mobile Applications...........................................................................................................6
Lack of Awareness.............................................................................................................6
Risks and Treats to the Security after moving to SaaS application.......................................6
Assessment of the Threats and Risks to Security to Employee Data.....................................8
Loss & Operations Control................................................................................................8
Cyber Security....................................................................................................................8
Insurance............................................................................................................................8
Privacy of Employee Data.........................................................................................................8
Threats and Risks to the Privacy in HR Database..................................................................9
BYOD................................................................................................................................9
The Cloud...........................................................................................................................9
Voice and video................................................................................................................10
Taking control..................................................................................................................10
People...............................................................................................................................10

3CLOUD SECURITY
Covering all records.........................................................................................................11
Creating a safety environment.........................................................................................11
Risks and Treats to the Privacy after moving to SaaS application......................................11
Assessment of the Threats and Risks to Privacy to Employee Data....................................13
Security............................................................................................................................13
Hybrid..............................................................................................................................14
Speed................................................................................................................................14
Digital Identity Issues..............................................................................................................14
Risks and Threats to the digital identities of employees......................................................14
Identity theft.....................................................................................................................14
Identity tampering............................................................................................................15
Personal information theft................................................................................................16
Privilege escalation..........................................................................................................16
Misuse of identity.............................................................................................................16
Conclusion................................................................................................................................17
References................................................................................................................................19

4CLOUD SECURITY
Introduction
DAS stands for The Department of Administrative Services, which provides various
services to many departments in the State Government of Australia. There are mainly
services like HR management, contractor management, payroll, procurement and contract
management. From the own data center these services are provided. After the Government
policy change, DAS has decided to shift to the Shared Service of cloud computing system. As
a result, all the departments will have to move their services to DAS as DAS can consolidate
their services. Another policy of government has come for mandating the cloud computing
for the updating process of the software. DAS is planning to purchase a personnel and HR
management application to provide a SaaS solution. The main aim of this report is to analyze
the impacts of the implementation of the personnel and HR management application. A HR
suite will be provided with the application of DAS. The performance management system
will be included in the HR application. This report discusses about the employee data or
information security, threats and risks to the HR database security, threats and risks to the
application after moving to SaaS, assessment of the threats for the security of employee’s
information, privacy and risks of in SaaS for the information of the employees and the
assessments for digital security. This study analyzes the migration of Das to the SaaS and its
impact to the organization and the implementation of the HR and personnel database
management system. The aim of DAS is to provide a secure cost effective cloud storage
system for the organization for better range of privacy and security purpose.
Security of Employee Data
Data security is the main concern for the organization in today’s world but the key
focus is on the customers. Companies need to maintain the information of the customer and

5CLOUD SECURITY
the employees. Employees do not have enough confident that the employers are keeping their
personal information safe at their workplace. Employers of the company have a process to
maintain the huge range of personal information of the employees throughout the entire
employment. During the onboarding process or recruitment and the relationship of
employment, every information is maintained (Rao & Selvamani, 2015). The information of
the assessment of pre-employment, tracking system and the background checks are included
with the candidate’s name, address, email, phone number and SSN. It is as critical to protect
the data as protecting the employee’s information. Without proper safety of the data of
candidate and the employees the company is giving access to the intruders. This could be the
violation of the security of the employee’s data.
Threats and Risks to the Security in HR Database
Data security of HR is very important for any software system or database of any
organization (Chou, 2015). It all included with the personal information of the employees and
their performance data. It integrates or handles the payroll package of the employees.
BYOD
BYOD stands for Bring Your own Device. There are huge number of users of
personal device and their personal usage. Organizations are implementing and installing the
BYOD programs, which will tackle the security issues of the personal devices. Information
security is always being a concern for the organizations for uploading or downloading any
information of payroll and the other sensitive data (Samaras et al., 2014).The user devices
may vary but the protocols and the security policy will not.
Compliance
Even if the employee information is safe form cyber-attack and hacking another risks
and threats will be non-compliance with local legislation (Tang & Liu, 2015). The multi-

6CLOUD SECURITY
national functions can consider the various and even laws. Any device that keeps information
or data needs to have the native encryption.
Litigation Exposer Risks
There will be other risks except the loss of data that is mislaid of information. The
organization may be subjected for the legal actions against them from the employees of the
company, whose information that was (Hill, 2016). Through the HR, the organization usually
needs to have the responsibility for maintaining the security of the data of the employee in
which the security of HR data is included.
Mobile Applications
There is a constant flow of data and information from the cloud and uploaded to the
cloud with a mobile application (Suo et al., 2013). The initial stage of a collaborative HR
application can be unparalleled function in speed and the proven data security except the
other issues. By the approach of BYOD, the issues can be exacerbated and the applications
will be enforced and monitored.
Lack of Awareness
Human is always the biggest risk and threat and the threats factor can be increased
when the user does not have any clear concept about the risks of HR data loss. There is lack
of security issues in the smart devices (Rahman & Cheung, 2014). The weakest factor of the
data security is human errors. If there is lack of the awareness that means there will be lack of
care and attention and that will cause loss of the security of the HR data. The potential
information security always remains. There will be hardware risks as well as software risks
and the human errors.

7CLOUD SECURITY
Risks and Threats to the Security after moving to SaaS application
There will be some concerns for using the cloud applications if the organization does
not aware of it. DAS is planning to move maximum number of corporate data in the cloud
SaaS application. DAS will approve the use of cloud for the business purpose. On this factor,
the organization should focus. The organization should focus on the protection, visibility and
the governance of the SaaS application (Aleem & Sprott, 2013). When it come to the
conversion to SaaS applications there are three various characteristics, which defines the
requirement of the various approach of the risk management, security and data governance in
the cloud.
The user of any smart device can access the SaaS applications with a secure account
and password from anytime, anywhere. The SaaS application can be accessed from any
managed or unmanaged smart devices (Tang & Liu, 2015). This is very distinct from on-site
apps where entry is only permitted through commercial VPN networks and controlled
computers, and there are extra safety obstacles between the customer and the cloud running
data center.
Users create folders and records for the SaaS implementation. Users can use just one
connection to encourage colleagues to discuss these documents with anyone. Many of these
consumers have very little experience in safety to comprehend when their activities put the
organization at risk.
There are many methods to share and store information, distinctive to a very SaaS
implementation. You understand, for instance, that information can be found in Chatter files,
Sales force knowledge base posts, CRM material, documents of web materials and
attachments within the Sales force alone. It is unrealistic for allowing security administrators
to comprehend the nuances of each SaaS implementation, yet eventually they are accountable

8CLOUD SECURITY
for data management (Theoharidou et al., 2013). All this implies that the hazards associated
with the use of SaaS implementation are inexplicably linked with the human element. The
certain attributes that affect the risk profile of an organization in cloud are who users interact
with, their privileges, the data they touch, how they access the data and their behaviors.
Assessment of the Threats and Risks to Security to Employee Data
Loss & Operations Control
It is evident that for every SaaS business it is extremely essential to limit your
responsibility and keep your profit scale stable (Safa et al., 2015). The department of
operations is essential to ensure smooth running of your business. The group should also
introduce countermeasures and checks to mitigate the hazards and to reduce them. Without
the technical checks, administrative checks are ineffective (Chou, 2015). They minimize
downtime while enhancing your capacity to cope with problems rapidly as they occur.
Cyber Security
It requires comprehending the organization's cyber security demands and countless
work functions in cyber security such as safety analyst, principal data safety agent, bug
prevention expert, accident respondent, data threat auditors, hazard assessor, and so on (Rabai
et al., 2013). Only then HR can generate precise work details and determine the correct
match.
Insurance
Regardless of how much you concentrate on implementation errors, procedures and
risk mitigation occur, and litigation continues (Millard, 2013). All companies should have
payment for employees and professional liability insurance, but for SaaS firms two other
strategies are particularly crucial.

9CLOUD SECURITY
Privacy of Employee Data
In order to protect the personal data of the citizens of each country, most information security
and safety regulation are enacted (Pearson, 2013). These regulations usually regulate the
capacity of the organizations and people to process data from others such as retrieve, store,
arrange and maintain, use and extend when data is recorded, obtained, handled or conveyed
to or from the nation. Due to the growing use of portable phones for the company reason, a
Mexican in Canada whose data are collected by the Brazilian-based Cloud Computation
service supplier would probably cause certain clause within the legislative system of all three
nations. A general counsel must hold record of the electronic information of his corporation
as it travels across boundaries in attempt to prevent transgressions of all these legislation.
Threats and Risks to the Privacy in HR Database
BYOD
The manner individuals operate is developing quickly, facilitated largely by
technological improvements. This is a tremendously beneficial thing in many respects, as
staff can operate anytime, anywhere (Sobers, 2015). Using private smart phones, laptops and
phones to do company, however, increases the danger of information failure either by human
mistake or by offering a route in for computer criminals. A research conducted by Ovum
discovered that 79% of staff discovered that BYOD allowed them to do their employment
faster, but approximately 18% stated that their IT office had no concept that they were using
their own equipment for job.
The Cloud
Cloud computing is easy, more and more common, and is usually regarded as safe.
That's not always the situation, though. All information is deposited inside a public cloud
inside the network of the operator and, as such, is accessible to assault. Also the private cloud

10CLOUD SECURITY
with information deposited in such a private network that is not accessible to the globe is still
not faultless (Sadiku, Musa & Momoh, 2014). Because both government and personal
windows are fundamentally centralized devices with only one weakness level, it is
comparatively simple for someone to keep the gate open through failure or by malice.
Voice and video
Many organizations also struggle to understand how their underlying cyber security
approach is influenced by telecoms and progressively by television. Of course, efficient
communication from casual conversations between peers to private customer discussions is
vital for any company (Alam, 2019). Video and voice however, are as prone as other
technologies to hacking. This is particularly accurate with regard to VoIP (Kulkarni et al.,
2013). Any IP interaction including speech is possibly useful to hackers and vulnerable to
assault. For example, when using Skype, this is not something organizations appear to
consider, but video and voice should be treated as carefully like any other safety and files
risk.
Taking control
Digital data security and privacy should be an immediate privilege for companies, but
they are unfortunately not. For organizations, however, there are methods to grow up and
bring away power, enabling them to experience a personal and secure digital life (Hashizume
et al., 2013). There are solutions like Siccura that allow companies to manage all information
through a centralized administration scheme, synchronize all company telephone records,
monitor all company interaction and information, and encrypt all documents.
People
Quite often, individuals in the protection chain are the fragile connection. It is not
always harmful, but an enormous source of cyber threats and violations of information is

11CLOUD SECURITY
human error (Rittinghouse & Ransome, 2017). Something as easy as transferring data to the
incorrect email address, leaving a mobile or laptop or using standard passwords can cause
enormous problems. Then there are circumstances in which staff deliberately trigger safety
assaults or spill information. Fortunately, important measures can be taken by organizations
to assist mitigate risks to cyber safety and data privacy.
Covering all records
There are too many methods that assaults and breaches can happen, taking benefit of a
alternative that can address not just text, but text messages, SMS, speech and text calls,
computers, and any records and data placed on cloud, regional and adjustable memory across
a broad spectrum of systems is essential for any extensive safety approach (Jiang et al.,
2014). It is also essential for organizations to think whether the organization have the
capacity to hold away, restrict entry to and ruin information if needed, for instance if an
worker leaves or if the computer of an worker that they used to contact business messages is
wasted.
Creating a safety environment
A powerful feeling of safety across the company is a crucial component of
safeguarding organizations from assaults and breaches of information (Di Martino, Cretella &
Esposito, 2014). Every worker should be conscious of the appropriate hazards and threats and
their function in minimizing them.
Risks and Threats to the Privacy after moving to SaaS application
User’s visibility and control have been decreased. Organizations lose some
transparency and influence over these operations when transferring assets activities to the
cloud. The responsible for some of the strategies and facilities shifts to the CSP when using
real cloud facilities.