Reference no: EM132611192

Assessment item - Security, Privacy and Data Sovereignty strategy

Scenario

The sudden increase in COVID-19 cases worldwide has caused considerable disruption in many countries. However, a number of countries have started to use an individual tracking approach to try and contain the spread of the virus.

A number of countries have developed mobile phone apps that track people and their movements. Some details of these apps are:
• Singapore: Contact tracing app.
• South Korea: Tracking mobile phones and cashless transactions:
• Australia: CovidSafe:

Tasks
After your successful engagement to develop privacy and personal data protection strategies for DAS, you have been engaged by the Department of Health (DoH) to advise on the development of privacy and data protection for CovidSafe users. DoH expect up to 16 million Australian mobile users to download and use this app. DoH have announced that they will be using a major U.S. based public cloud provider to host the CovidSafe data, but claim that the data will always be under Australian Government control.

You are to provide a report to DoH that:

1. Discusses the possible threats and risks to the security of user data on mobile phones, and in linked Cloud and financial accounts from the use of the CovidSafe app.

2. Discusses the possible threats to the privacy of a user's data, location and activities from the use of the CovidSafe app.

3. Discusses the issues of data sovereignty that may apply to the storage of CovidSafe data in U.S. based Cloud storage.

4. You are to recommend that DoH adopt:
a. Possible security controls that would prevent the loss or breach of user data, while still enabling effective tracking for COVID-19, and the reasons these controls will be effective.
b. Possible privacy controls to protect user privacy, particularly of data, location and activity, while still enabling effective tracking of COVID-19, and the reasons these controls will be effective.
c. Possible controls to ensure that the CovidSafe data remains under Australian data sovereignty and control, and the reasons these controls will be effective.

Learning outcome 1: be able to examine the legal, business and privacy requirements for a cloud deployment model.

Learning outcome 2: be able to evaluate the risk management requirements for a cloud deployment model.

Learning outcome 3: be able to critically analyse the legal, ethical and business concerns for the security and privacy of data to be deployed to the cloud.

Learning outcome 4: be able to develop and present a series of proposed security controls to manage the security and privacy of data deployed to the cloud.

Learning outcome 5: be able to develop and present a cloud governance framework to underpin the cloud operations for an enterprise.

Attachment:- Privacy and Data Sovereignty strategy.rar