IT Risk Management Report: VIC Government Data Security Framework

This report provides a comprehensive analysis of IT risk management within the Victorian (VIC) government, focusing on their data security framework and risk assessment processes. It begins with an introduction to IT risk management and its significance, particularly in preventing data breaches, followed by an overview of the VIC government's current risk and security arrangements, which emphasize availability, confidentiality, and integrity. The report then delves into a detailed analysis of the risk assessment diagram, exploring the VPDSF model and the four key security domains: information, ICT, personal, and physical security. It identifies and prioritizes risks and threats, including public record security, stakeholder and investment information, employee information, and communication and system information. The report also discusses the challenges faced while conducting research to determine these risks, such as unclear objectives, lack of privilege, and ineffective risk nomenclature, and proposes potential solutions. Finally, it compares risk and uncertainty, highlighting the differences in measurability, controllability, and transferability, and concludes with a summary of the key findings and recommendations for improving IT risk management practices within the VIC government.

IT Risk Management

Table of Contents
INTRODUCTION...........................................................................................................................1
1. Current risk and security arrangement by the VIC government.............................................1
2. Detailed analysis of risk assessment diagram.........................................................................2
3. Determination of risk and threats in the order of their importance, also provide justification.
.....................................................................................................................................................4
4. Challenges faced while conducting research to determining risks.........................................5
5. Compare risk and uncertainty.................................................................................................6
6. Approaches available in order to control risk and mitigation.................................................7
CONCLUSION................................................................................................................................8
REFERENCES................................................................................................................................9

Illustration Index
Illustration 1: Flow chart for VIC government................................................................................2

INTRODUCTION
IT risk management is considered as one of the significant step through which companies
are able to implement effective operations. It helps in influencing the speed and processing of the
company. Along with this there are various drawbacks also associated with this. One of the
biggest failure can be considered as data breach (Aldunce and et.al., (2015)). This report is based
on the data security framework and risk management considered by VIC government. They are
considering VPDSF model for implementing various protocols and methods in order to resolve
this problem. With the help of this report company would be able to determine the risk factors
and on the basis of that necessary steps can be considered (Altangerel & Kull, (2013)).
1. Current risk and security arrangement by the VIC government.
1

On the basis of above mentioned flowchart security can be effectively understand
(Becken & Hughey, (2013)). The major objective of VIC government is based on three factors
such as availability, confidentiality and integrity. There all the risk management and security
frame work is focused on these three elements.
2. Detailed analysis of risk assessment diagram.
The VIC government is a public sector organisation of Australia. They are dealing with
large amount of customer's data. Therefore, in order to maintain data security they are
2
Illustration 1: Flow chart for VIC government

considering frame work. In this process firm is developing strategies considering three key points
such as availability, confidentiality and integrity (Cook, (2014)). On the basis of these three
categories they are implementing further parts of the process. In this they are creating four sub
categories such as information, ICT, personal and physical security. Through these steps they
are able to reduce chances of data breach. In the information security step, various data related to
the shares and investment of the company is protected (Shepherd, Luebbers & Dolan, (2013)). In
this process action plan is developed in order to store and manage information supporting
different media platforms (Davies, (2014)). In this process another security domain is identified
as personal security. In this process employees are provided with access on the basis of their
engagement and responsibilities. With the help of this approach they are able to determine the
significance of the information. On the basis of that necessary features can be introduced (Renz
(2016)). The next element of this process is ICT, in this step information related to the
transactions and communication of the organisation can be tracked. It created huge impact on the
confidentiality, in order to overcome these they are considering specific encryption and
decryption techniques (Dollard & Gordon, (2014)). With the help of these steps they are able to
maintain transaction of information safe and secure. The last security domain is considered as
physical environment. In step information related to the process, approaches and applications
that are considered by the company are included. The above mentioned flow chart contain this an
important security issues. Therefore, in order to effectively handle them VIC government
consider planning step. In this process they are considering privacy and protection act 2014
(Ferguson and et.al., (2013)). On the basis of the outcomes they are implementing strategies.
Once all the steps are applied, compilation of process takes place. The outcome generated by the
compliance step determines the assurance of the process. It the outcomes are satisfied the process
is reported . In case if the results are not effective, necessary steps are considered in order to
overcome the problems. The processing of flow chart is based on the VPDSF model, in which
various steps are interconnected in order to maintain effectiveness of the process. With the help
of this structured frame work, they are able to analyse the issues and problems (Heazle and et.al.,
(2013)). On the basis of that principle and strategies are considered (Paton and et.al., (2014)).
There principles consisting of aims, objective, models and protocols. While implementing these
strategies, effective backups are also considered. It helps in implementing high level data
3

security frame work. On the basis of above flow chart following area are identified under risk
exposure:
1. Public record security and Information likes stakeholder and investment are
considered under high risk exposure (Howes and et.al., (2015)).
2. Employees information is considered under medium -lower risk exposure
3. Methods, approaches and strategies considered considered under medium risk
exposure
4. Communication and system information are considered considered under lowest risk
exposure.
3. Determination of risk and threats in the order of their importance, also provide justification.
VIC government is interacting with customers and collecting large amount of data.
Therefore, in order to maintain information security and remove data breach they are considering
high level data security frame work (Lawrence and et.al., (2015)). The company is facing various
security risks and threats, such as public record security,communication and system information,
employees information and companies financial, theft of information likes stakeholder and
investment (Publication, (2017)). As VIC government is a non- profitable company of Australia.
They are interacting with large amount of customer's every day. While this process they are
various factors are identified that are having high level of risk and threats. Following is the list of
the process in the order of their risk:
1. Public record security
2. Information likes stakeholder and investment (Victoria government gazette, (2017)).
3. Employees information
4. Methods, approaches and strategies considered.
5. Communication and system information.
Customer's information is considered as one of the most significant data of an
organisation. With the help of this information they are able to implement marketing strategies,
gather feedback and identify their performance (Victoria, (2017)). In case due to some issues if
customer data is theft or stole and create huge consequences for both company and clients.
Therefore, it is considered as one of the biggest risk factor. The next factor is stakeholders and
investigator details of the company. It is also considered as one of the most confidential
4

information of the organisation (Aldunce and et.al., (2015)). The third parties always target the
investment related details of the firm. Hence, it is also considered as risk exposure area. The
third risk factors id the strategies, method and approaches considered by the business association
are also targeted by the hackers. Therefore, VIC should consider it as one of the crucial
information. The last but one of the important information is communication and system
information, it can be easily tracked by the hackers without affecting the process, due to this
sender and receiver will never know about the process until huge consequences takes places
(Altangerel & Kull, (2013)). On the basis of basis of above discussions it is analysed that Public
record security, information likes stakeholder and investment and Employees information are
falls under deliberate threat, on the other hand methods, approaches and strategies and
communication and system information are considered under accidental threats. In this user is
not aware about the risk (Becken & Hughey, (2013)).
4. Challenges faced while conducting research to determining risks.
While conducting research for determining the risk and threat factors various challenges
are faced by the VIC government. They are considering data security as a major issue for this
they are implementing security frame into various levels. In this process priority of the activities
are determined on the basis of conducting research (Victoria, (2017)). The organisation is facing
problems at various levels such as identifying problems, planning, execution and demobilization.
In this process first step is identified as unavailability of objective, aim and strategies are not
clear to the analyser. If the issues are not clear, the analyser will not able to understand the
problems that are being faced by the VIC company related data security necessary changes
cannot be implemented. It affects the solution and strategies that are applied by the company
(Victoria government gazette, (2017)). Another major challenges is considered as lack of
privilege. The researcher is not provided with proper rights and authorities, due to which they are
not able to effectively consider the research. It creates direct impact on the issues therefore, in
order to resolve this some changes should be implemented into the process. The next challenges
is identified as nomenclature of the risk is not effective (Cook, (2014)). This is considered as
establishment issues in which different categories are considered. On the basis of that specific
methodology is considered. If the risk is not identified effectively, the approach will not result
into effective outcomes. The risk assessment approach is also one of the biggest issue identified,
5

for this drawbacks of the concept should be also considered. Qualitative and qualitative approach
is also creating various difficulties for the analyser (Davies, (2014)). In this step ineffective
training and mathematical implementation skills affect the outcomes. Lack of time directly
affects the research, due to unavailability of time they are not able to explore all the issues
effectively.
In order to overcome there difficulties various solutions are also available that helps the
company. Some of the are like considering hybrid structures in order to determine the factors,
along with this various training and learning should be provided so that they can determine the
unexpected conditions (Dollard & Gordon, (2014)). Along with this effectively time
management should be considered, it help in exploring various factors within the time bound.
Along with this researcher should implement efficient risk management approaches it helps in
exploring various factors on the basis of that clear and outcomes can be generated. The
employees should be provided with privilege, it helps in discussing and accessing the
confidential and sensitive data of the company. It helps in understanding the problems with deep
understanding and supports in developing better backup plan (Ferguson and et.al., (2013)).
5. Compare risk and uncertainty.
Following are the comparison between risk and uncertainty:
Risk Uncertainty
 Risk is considered as probability, in
which chances of wining and losing
both are considered.
 On the other hand uncertainty refers to
the where future events are considered
and their success rate is not known.
 The risk of the process can be measured
with the help of risk factor (Heazle and
et.al., (2013)).
 Uncertainty of any event cannot be
measured because future outcome are
considered.
 The chances of results can be analysed.  The chances of results cannot be
analysed.
 This process is controlled as the
influencing factors can be determined.
 On the other hand affecting reason are
known. Therefore, process cannot be
6

controlled.
 Risk of the process can be minimised
with the help of risk management
approaches.
 Uncertainty of the process cannot be
minimised (Howes and et.al., (2015)).
 The risk factors of the process are
measured with the help of probability.
 On the other hand probability approach
cannot be considered in order to
determine the uncertainty of the
process.
 It can be transferred into one form to
another form with the help of
implementing various approaches.
 However, it is cannot be transformed
from one form to another because there
is no specific approach is available for
this.
 The implementation cost of the product
can be easily determined by including
their risk (Lawrence and et.al., (2015)).
 The uncertainty of the process cannot
be determined. Therefore it is not
included into the development cost of
the product.
 It is considered as an objective
approach, due to which it can be
measured with the help of
implementing certain approaches.
 On the other hand uncertainty is
considered as a subjective approach
therefore, all the outcomes can be
realised only (Paton and et.al., (2014)).
 Risk can be measured with the help of
implementing probability and along
with this various risk management
approaches are also available (Renz
(2016)).
 Some time it can be measured with the
help of some4 mathematical approaches
such as standard deviation, variance,
expected down- side and up- side
uncertainty approaches.
On the basis of above comparison it is analysed that there are various methods and
approaches are available through which risk and related factors can be identified. With the helps
7

of considering effective risk management strategies, impact can be minimised. While developing
and implementing any procedure or action plan, effective risk analysis steps are considered along
with this cost can be also estimated (Shepherd, Luebbers & Dolan, (2013)). It helps in improving
the quality of the processing. On the other hand uncertainty is considered for the activity in
which future effect is not determinant, due to this any preventive measures cannot be considered.
Along with this impact is also not controlled. While implementing the action plan, individual is
not able to determine the cost. There is any effective management and analysis approach is not
available.
6. Approaches available in order to control risk and mitigation.
The VIC government is trying to control risk and mitigation, for this various approaches
are available that helps in generating effective outcomes. This approach can be effectively
considered with the help of implementing four risk management techniques, that are mentioned
below:
Avoidance: This is considered as one of the easiest step through which companies are able to
reduce risk and mitigation. It this process organisation's are avoiding all steps that can creates
jeopardy.
Reduction: Another risk management approach is considered as reduction. In this techniques
various reductions steps are considered through which potential of each activity can be
considered. On the basis of that steps containing less weightage can be reduced (Publication,
(2017)).
Transfer: This is considered as one of the most important and significant step in this step
company is able to convert one form of risk into another risk. With the help of risk
transformation managers of the company are able to get the effective approaches to solve the
problems. Along with this it helps in reducing the cost of risk factor. Through these steps they
are able to overcome failure of their process and able to reach objective effectively.
Acceptance: It is considered as one of the dangerous approach. In this method chain of the chain
of the risk factors are considered on the basis of outcome of one step changes are implemented
into the next step. It leads to the unnecessary reduction of the process, along with this excess
steps are also introduced into the process.
8

With the help of all these approach VIC government is able to effectively control all the
risk and mitigation form the process. Along with this it helps in increasing effectiveness of the
process.
CONCLUSION
On the basis of above report it is inferred that VIC government is considering data
security frame work. In order to effectively implement this they are considering three major
element such as availability, confidentiality and integrity. On the basis of that they are
developing a high class data security model. With the help of this approach various risk exposure
areas are identified on the basis of their order. This report also consists of challenges and
difficulties that are identified while considering the research. It also consists of comparison of
risk and uncertainty. With the help of that it is identified that risk can be estimated with the help
of various mathematical approaches.
9