Strategic Security Policy Analysis for Coles Supermarket - ISY3006

This report provides a comprehensive analysis of a strategic security policy designed for Coles Supermarket, focusing on protecting its internal network systems. The report begins with an executive summary, followed by an introduction to the company and its operations. It then delves into the documentation of a strategic security policy, covering the nature of information collected, policies regarding personal information, and the purpose of handling customer data. The report also addresses digital services, identifying potential threats and vulnerabilities, and proposing mitigation actions. The discussion includes a deep dive into cyber threats like phishing, vulnerabilities such as cross-site scripting, and practical steps to enhance security, such as using vulnerability scanning tools and implementing efficient password policies. The conclusion emphasizes the importance of the security policy in safeguarding Coles' network and data.

Running head: STRATEGIC SECURITY POLICY FOR COLES SUPERMARKET
Strategic Security Policy for Coles Supermarket
Name of the Student
Name of the University
Author note

1STRATEGIC SECURITY POLICY FOR COLES SUPERMARKET
Executive Summary
The report is based on understanding of the key security policies that would be set in order to
protect the internal networked systems at Coles Supermarket. The supermarket business
primarily deals with customer information, processing them and generating useful results. Thus,
this report puts forward a security policy, which would be able to bind the security systems used
within the network and revise their present polices. From the discussed security policy, the
threats and vulnerabilities that could affect the internal systems have also been discussed. Hence,
a proper mitigation action that could be undertaken have been focused upon in this report.

2STRATEGIC SECURITY POLICY FOR COLES SUPERMARKET
Table of Contents
1. Introduction..................................................................................................................................3
2. Discussion....................................................................................................................................3
2.1 Documentation of a Strategic Security Policy for Coles Supermarket..................................3
2.2 Nature of Information Collected............................................................................................3
2.3 Policies regarding collection and holding of Personal Information......................................4
2.4 Purpose of Handling Customer Information..........................................................................5
2.5 Digital Services......................................................................................................................6
2.7 Identification of Potential Threats and Vulnerabilities..........................................................7
2.8 Mitigation Actions for the discussed Threats and Vulnerabilities.........................................7
3. Conclusion...................................................................................................................................8
References........................................................................................................................................9

3STRATEGIC SECURITY POLICY FOR COLES SUPERMARKET
1. Introduction
The Coles Supermarket have been considered as one of the most featured supermarket
chain located at the West of Sydney. The Coles Supermarket, which operates under the trade
name of Coles deals with various services such as retails and chain of consumer services. The
primary headquarters of the retail chain is located in Melbourne. The company also holds an
online presence in the market, which has been strategized for engaging powerful services to
customers. In the present times, there have been major kind of issues arising over the rising
number of internal and external threats and vulnerabilities towards the networks established by
the organisation (Manners-Bell 2017). The store deals with several kind of business transactions
and also stores critical assets, data and information within their internal networks.
The following sections in the report would mainly discuss about the kind of incidents that
might arise within the network. The other discussed topics within the report would be based on
the security vulnerabilities that might occur within the organisation and the ways in which new
techniques and policies could be helpful for protecting the internal networks and flow of
information within the organisation.
2. Discussion
2.1 Documentation of a Strategic Security Policy for Coles Supermarket
The Coles Supermarket deals with customer and business information, which are stored
within the internal networks and databases servers that are a part of the organization. The
security policy that would be defined for the organization would be prevalent across all
supermarket chain present within the organisational chain businesses (Donovan et al. 2015).
These includes Coles Financial Services, Coles Online, Coles Gift Cards Services and many
others. The security policy is thus defined for presenting personal information based on the
information that is being collected and handled by the internal security team.
2.2 Nature of Information Collected
The variety of information, which is been collected by Coles Supermarket are discussed
as:
1. Name and contact details of customers

4STRATEGIC SECURITY POLICY FOR COLES SUPERMARKET
2. Information regarding date of birth
3. Details of household
4. Payment history details and the kind of transactions made
5. Records of interactions and communications made
6. History of transactions, order information and other activities
The supermarket business collects the home address information based on delivering
goods at the doorstep of customers. Customers would need to provide their valuable data at the
hands of the company (Taylor 2016). The security policy, which is being set also discusses the
fact that whenever a consumer would provide the details of other people, they would need to
gain a consent in order to submit that to the company.
2.3 Policies regarding collection and holding of Personal Information
Coles Supermarket would control the transactions and interactions of customers, which
would be included during the processes when:
1. During the use of payment cards
2. Making a purchase over the online website or in stores
3. Conducting of a transaction that includes non-cash payment service or also during the
process of registering of a service that includes the collection of personal information (Abomhara
2015).
4. Participation in a competition, survey or promotion
5. Posting of a review or commenting on any social media pages or websites linked to the
company
6. Use of digital services and posting content on social media pages
Coles Supermarket would also have general rights based on recording and monitoring of
communications that are made between customers and the company officials. The monitoring
over communications would mainly be done based on resolution over security disputes, purposes

5STRATEGIC SECURITY POLICY FOR COLES SUPERMARKET
of training and quality issues. It also includes audio and video surveillance devices present
within the office premises.
The personal information that would be derived from various third parties such as:
1. Public sources
2. Service providers of Information
3. Authorized public approved by customers
4. Service providers who primarily administer over the services and products that
includes insurance and payment cards (Chen, Desmet and Huygens 2014).
2.4 Purpose of Handling Customer Information
Coles Supermarket is dedicated towards connecting with their customers in
administering, personalizing and improving the offered services and products, which would in
turn support the functions of business. These could also include the following aspects:
1. Management of requests raised by customers based on services and products. This
includes the processing of payments, delivery of services and providing exclusive discounts and
refunds.
2. Registering accounts, keeping regular update of information gathered and verification
of identity (Jang-Jaccard and Nepal 2014).
3. Communication with customers based on providing exclusive promotional offers
services and latest product information.
4. Improving the offered services based on conducting market and product research by
understanding the trends of purchase habits made by customers.
5. Improvement in operational processes based on enhancing the experience of
customers.
6. Generating quick responses based on gathered queries, feedback and concerns (Tari
2014).

6STRATEGIC SECURITY POLICY FOR COLES SUPERMARKET
With the collection and use of personal information from customers, Coles Supermarket
is dedicated to improve the suitability, standards and behavior in terms of their offered services,
offers and products. This also includes the performing of risk assessments based on financial
products.
2.5 Digital Services
Coles Supermarket has an effective strategy for communicating with customers based on
using digital services. The company offers diverse range of information and services based on
making use of online and digital services including apps, online advertisements, email and
websites (Greitzer et al. 2014). These are cooperatively known as Coles Digital Services. The
digital services offered by Coles also employ the use of “cookies”. This cookie assists in
maintaining the continuing functionality of a browsing session based on remembering
transaction or browsing details (Akhunzada et al. 2015). There are different other technologies
that are used within the website of Coles that includes JavaScript, Flash local stored objects and
web beacons. The web browser could be configured based on rejection and deletion of cookies.
The internal networks and systems within the organization record various kind of
information that would be in relation with kind of interactions made with the help of online
services (Papp, Ma and Buttyan 2015). These might include information based on the use of
software versions that are made use by customers, location data, file metadata, data entered,
device identifiers (such as IP address) and performed user activity based on clicking of links. In
exceptional cases, the third parties might use cookies and different other technologies that could
be considered as a part of Coles Digital Services (Scholz 2017). The use of these technologies
might be used based on connecting with activities such as online behavioral advertising, email
campaign management, website analytics and surveys.
Other forms of services that might be used include Yahoo, Google (DoubleClick and
AdSense), Microsoft and Adobe (Analytics and Campaign Manager). Coles Supermarket is
dedicated towards the enhancement and development of online technologies while making
reasonable efforts towards ensuring that the Privacy Policy documents are being continuously
updated (Pereira, Barreto and Amaral 2017). Customers are thus requested to check back on the
current practices during the use of online services, which are being used by the company.

7STRATEGIC SECURITY POLICY FOR COLES SUPERMARKET
2.7 Identification of Potential Threats and Vulnerabilities
With the use of the security policy as documented above for Coles Supermarket, the
potential threats and vulnerabilities that could affect the network of the company are:
Cyber threats, which can be discussed as threats generally refer to circumstances of cyber
security or events and have the potential for causing harm to customers. Some of the most
common examples based on threats includes phishing or social-engineering attacks (Williams
and Woodward 2015). These threats are generally launched by an attacker by installation of a
Trojan and stealing of confidential data from applications stored within the computer system.
Vulnerabilities are defined as weaknesses present within a system. A computer system
could thus be exploited based on the attack of a single vulnerability (Fenz et al. 2014). Some of
the common examples of vulnerabilities, which might affect the system includes cross-side
scripting, transmission of sensitive data in plain text format, SQL injection attacks,
misconfigurations in server and many others.
2.8 Mitigation Actions for the discussed Threats and Vulnerabilities
A threat and vulnerability could be defined as a weak spot detected within the system
network, which might be exploited based on a security threat. Some of the major risks that could
be discussed with the effect of network vulnerability are loss of hours, data, and downtime of site
and rebuilding of a website (Ashraf and Habaebi 2015). Based on the determination of the
vulnerabilities within the system, certain major actions needs to be taken for protecting the
confidentiality and integrity of systems. These are discussed below:
1. Understanding of common attack – In has been seen that in many cases of threats
and vulnerabilities affected over a network, the network engineers might not have a required
amount of training (Head 2014). Lack of funding towards training individuals could be
considered as an important cause towards the scenario. Hence, skilled individuals should be
selected who would be able to understand the attack and describe plans for mitigation.
2. Use of Vulnerability Tools for Scanning – There are many tools, which ensure the
checking of security state of the current network. These tools mainly check for unpatched
software, open ports and weaknesses (Scholten, Sharkey Scott and Fynes 2014). One of the most
common Microsoft tool includes Microsoft Baseline Security Analyzer. This tool checks for

8STRATEGIC SECURITY POLICY FOR COLES SUPERMARKET
necessary updates and other errors based on configuration problems. Nmap can be defined as
other forms of free scanning tool.
3. Efficient Password Policy – Organizations should define efficient password policies
based on crafting efficient and effective passwords by consumers. The potential attackers mostly
look for weak passwords and thus are able to crack them thus gaining access to customer data
(Mattsson and Jenelius 2015). Thus, it can be discussed that default passwords help in providing
attackers with the key to unlock any process. These passwords should thus be changed frequently
in order to design a robust password. Complex passwords help in protecting of systems against
any social and physical engineering attacks.
3. Conclusion
Based on discussion over the above aspects, it can be understood that a proper security
policy should be determined by Coles Supermarket in order to protect the internal network
systems from various threats and vulnerabilities. The above discussion formulates a policy based
on ensuring security policies are being strongly used within every computing system used within
the framework. From the understanding gathered from the discussed security policies, the
various threats and vulnerabilities that could affect the internal systems have been discussed. The
final part of the report discusses about the mitigation actions that could be taken in order to
reduce the possibility of occurrence for the discussed threats and vulnerabilities. Thus, from the
discussion, it could be concluded that such kind of mitigation actions could be highly helpful for
protecting the internal networks of Coles Supermarket and thus ensure a healthy network
environment.

9STRATEGIC SECURITY POLICY FOR COLES SUPERMARKET
References
Abomhara, M., 2015. Cyber security and the internet of things: vulnerabilities, threats, intruders
and attacks. Journal of Cyber Security and Mobility, 4(1), pp.65-88.
Akhunzada, A., Ahmed, E., Gani, A., Khan, M.K., Imran, M. and Guizani, S., 2015. Securing
software defined networks: taxonomy, requirements, and open issues. IEEE Communications
Magazine, 53(4), pp.36-44.
Ashraf, Q.M. and Habaebi, M.H., 2015. Autonomic schemes for threat mitigation in Internet of
Things. Journal of Network and Computer Applications, 49, pp.112-127.
Chen, P., Desmet, L. and Huygens, C., 2014, September. A study on advanced persistent threats.
In IFIP International Conference on Communications and Multimedia Security (pp. 63-72).
Springer, Berlin, Heidelberg.
Donovan, J., Franzel, S., Cunha, M., Gyau, A. and Mithöfer, D., 2015. Guides for value chain
development: a comparative review. Journal of Agribusiness in Developing and Emerging
Economies, 5(1), pp.2-23.
Fenz, S., Heurix, J., Neubauer, T. and Pechstein, F., 2014. Current challenges in information
security risk management. Information Management & Computer Security, 22(5), pp.410-430.
Greitzer, F.L., Strozer, J.R., Cohen, S., Moore, A.P., Mundie, D. and Cowley, J., 2014, May.
Analysis of unintentional insider threats deriving from social engineering exploits. In 2014 IEEE
Security and Privacy Workshops (pp. 236-250). IEEE.
Head, B.W., 2014. Evidence, uncertainty, and wicked problems in climate change decision
making in Australia. Environment and Planning C: Government and Policy, 32(4), pp.663-679.
Jang-Jaccard, J. and Nepal, S., 2014. A survey of emerging threats in cybersecurity. Journal of
Computer and System Sciences, 80(5), pp.973-993.
Manners-Bell, J., 2017. Supply chain risk management: understanding emerging threats to
global supply chains. Kogan Page Publishers.

10STRATEGIC SECURITY POLICY FOR COLES SUPERMARKET
Mattsson, L.G. and Jenelius, E., 2015. Vulnerability and resilience of transport systems–A
discussion of recent research. Transportation Research Part A: Policy and Practice, 81, pp.16-
34.
Papp, D., Ma, Z. and Buttyan, L., 2015, July. Embedded systems security: Threats,
vulnerabilities, and attack taxonomy. In 2015 13th Annual Conference on Privacy, Security and
Trust (PST) (pp. 145-152). IEEE.
Pereira, T., Barreto, L. and Amaral, A., 2017. Network and information security challenges
within Industry 4.0 paradigm. Procedia Manufacturing, 13, pp.1253-1260.
Scholten, K., Sharkey Scott, P. and Fynes, B., 2014. Mitigation processes–antecedents for
building supply chain resilience. Supply Chain Management: An International Journal, 19(2),
pp.211-228.
Scholz, R.W., 2017. Digital threat and vulnerability management: the SVIDT
method. Sustainability, 9(4), p.554.
Tari, Z., 2014. Security and Privacy in Cloud Computing. IEEE Cloud Computing, 1(1), pp.54-
57.
Taylor, E., 2016. Mobile payment technologies in retail: a review of potential benefits and
risks. International Journal of Retail & Distribution Management, 44(2), pp.159-177.
Williams, P.A. and Woodward, A.J., 2015. Cybersecurity vulnerabilities in medical devices: a
complex environment and multifaceted problem. Medical Devices (Auckland, NZ), 8, p.305.