Reference no: EM132344422
Practical Task
For this task you will be required to manage the security, privacy and compliance of a cloud service, and will require access to the following:
• The cloud information and communications technology (ICT) business specifications
• The cloud ICT security assurance specifications
• Management-related scenarios
• A cloud-focused security environment, including threats to security that are, or are held to be, present in the environment
• Information on the security environment, including:
o Laws or legislation
o Existing enterprise security policies
o Enterprise expertise
• Risk analysis tools and methodologies currently used in industry.
To demonstrate that you can effectively manage the security, privacy and compliance of a workplace cloud service, you will need to demonstrate how you:
1. Identify, document and discuss the cloud security issues, including both the business and commercial issues, that relate to the types of delivery and deployment models relevant to your workplace. (discuss this with your assessor)
2. Determine the specific enterprise areas of security responsibility and conduct some research into the relevant security controls and measures for each identified area.
3. Implement the most relevant security controls and measures identified.
4. Identify and document the compliance regulations that are relevant to data storage in your workplace.
5. Determine the business continuity and data recovery plans that are most relevant to your industry and enterprise.
6. Identify what logs and audit trails are available, secure them appropriately and develop a plan to maintain them.
7. Conduct some research to investigate and review the legislation, organisational and jurisdictional policy and procedures that relate to management of the following areas, to ensure that they meet the enterprise policy:
a. Cloud-related privacy issues relevant to your enterprise.
b. Relevant codes of ethics and conduct.
c. The principles of equal employment opportunity, equity and diversity.
d. Financial management requirements.
e. Governance requirements.
8. Implement any changes identified as required by the research conducted, and integrate them appropriately to the business continuity of operation program (COOP) and existing security plans.
9. Develop an ongoing performance measurement and evaluation review process to evaluate the security effectiveness of the implemented security controls.
10. Collect and collate all the relevant documentation required as part of the COOP as would be required for audit tracking purposes.
While you are demonstrating each of the above actions, you will need to keep a journal outlining each point. Ensure that you detail each point clearly outlining how you performed the action and what the outcome was. You must submit your journal as part of this assessment.
Once you have completed these activities, you will need to sit down with your assessor and discuss:
11. The management specifications and objectives identified throughout the task.
12. Management tools and techniques used throughout the task.
13. The organisational and political context within your organisation including, but not limited to; roles and responsibilities that would become redundant, possible resistance, interference with existing and developing projects, senior management and executive level support and the external and industry influences that could impact on security.
14. Discuss and evaluate how the system development life cycle (SDLC) assisted in the development of the continuity of operation program (COOP).
15. Techniques used for critical analysis in the management context throughout the task.
Once you have competed the discussion, write a report on tasks 11-15.