Task

Examine the following case study:

http://www.finance.nsw.gov.au/ict/resources/nsw-government-digital-information-security-policy

1. Use a diagram (produced by the means of using Rationale, Visio or any other relevant software application of your choice) to illustrate current security risks and concerns considered by the NSW government.
2. Provide detailed explanation of the diagram and identify the areas of: high, medium, medium-low, and low risk exposure.
3. Carry out comparative analysis of the Deliberate and Accidental Threats and rank those threats in order of importance. Justify your rankings not only on the basis of the case study but also by the means of doing further research and drawing upon other relevant case studies (e.g. Security guidelines for other private and public organizations) that you can identify.
4. While drawing upon theories, tools and patterns covered in the subject (e.g. ''thinking in zones'' concept) as well as your own research, explain the challenges that the NSW government is going to face while deciding on whether security/risk management should be carried out internally or externally (e.g. via outsourcing).
5. Explain the difference between the concepts of ''Risk'' and ''Uncertainty'' (make sure that your discussion is linked to the case considered).
6. Discuss and evaluate (with examples) different approaches available to the NSW government for risk control and mitigation.

Rationale

To demonstrate your understanding of:

• the principles of information security management;
• the eight rules of security;
• the application of security management principles to real-world examples;
• the principles of security risk management.