IT Risk Assessment

Length: 1000 words.

Need to answer the following 3 questions based on the attached scenerio

What are the threats and risks to the digital identities of Government employees from the move to SaaS applications?

Consider the operational solution and location(s) of the two SaaS providers for HR and Contractor management. Does either the operational solution, or the operational location, or both, increase or mitigate the threats and risks identified for the security and privacy of employee data?

Are there any issues of data sensitivity or jurisdiction that should be considered?

Scenario

The Department of Administrative Services (DAS) provides a number of services to other departments in an Australian State Government. These services include HR and personnel management, payroll, contract tendering management, contractor management, and procurement. These services have all been provided from the Department's own data centres.

As a result of a change in Government policy, DAS is moving to a "Shared Services" approach. This approach will mean that DAS will centralise a number of services for the whole of Government (WofG). This means that each Department or Agency that runs one of these services for its own users, will be required to migrate its data to DAS so that it can be consolidated into the DAS centralised database. DAS will then provide these consolidated services to all other Departments and Agencies within the Government.

Another Government policy mandates a "Cloud first" approach to the process of updating or acquiring software or services. Following these strategic policy changes from Government, DAS has decided to:

Purchase a HR and personnel management application from a US based company that provides a SaaS solution.

The application will provide DAS with a HR suite that will provide a complete HR suite which will also include performance management. The application provider has advised that the company's main database is in California, with a replica in Dublin, Ireland. However, all data processing, configuration, maintenance, updates and feature releases are provided from the application provider's processing centre in Bangalore, India.

Employee data will be uploaded from DAS daily at 12:00 AEST. This will be processed in Bangalore before being loaded into the main provider database.

Employees can access their HR and Performance Management information through a link placed on the DAS intranet. Each employee will use their internal agency digital ID to authenticate to the HR and Performance management system. The internal digital ID is generated by each agency's Active Directory Instance and is used for internal authentication and authorisation.

Purchase a Contractor management application from a German based company that provides a SaaS solution.

This application will provide DAS with a suite of tools to on-board, manage, pay and off-board contractors who are contracted by DAS for specific work. The application provider has advised that the company's main database is located in Heidelberg, Germany, with a replica in Dublin, Ireland. All configuration, maintenance, updates and feature releases are provided from the provider's lab in Walldorf, Germany. The provider does not do any additional processing of data entered into the application.

DAS employees enter the data directly into the application through a secure URL.

Bulk contractor data can be uploaded daily through a secure data transfer application. DAS is responsible for ensuring that any data uploaded is correct and ready for use.

Other Departments and Agencies can view and manage their own contractor data once it has been loaded by DAS staff.

Move the DAS payroll to a COTS (Commercial Off The Shelf) application that it will manage in a public cloud;

Move the DAS Intranet into a Microsoft SharePoint PaaS offering so that it can provide Intranet services to all agencies in the WofG.