Reference no: EM133723936 , Length: 1500 Words

Assessment: Case Study Report

Introduction
In this individual assessment, you will develop the cybersecurity policy, procedures, or guidelines for an organisation. Your findings should be delivered in a written report. For the given case study (below) write the Data Security and Privacy Policy for the case study presented below. Use an appropriate template to complete the report as shown in the report structure section.
Report Structure
Use an appropriate policy template. For Example:
CONTENTS
PURPOSE
SCOPE
POLICY STATEMENT
<Sub-headings are not numbered>
PROCEDURE
<Sub-headings are not numbered>
RESPONSIBILITIES

Records management
DEFINITIONS
Terms and definitions <delete if not required>
RELATED LEGISLATION AND DOCUMENTS
FEEDBACK
APPROVAL AND REVIEW DETAILS
APPENDIX <or APPENDICES> <delete if not required>

Case Study
Young Minds Secondary College (YMSC) is a private Australian secondary school that has been operating for several years, developing innovative programs for its students. Its staff has grown from 15 to 120 and the school enrols 700 students across level 7 to 12. YMSC has been growing steadily over the past 10 years. They have built strong relationships with the community and parents tend to send all their children to the school as well as recommending it to other parents. The owners anticipate continued growth and are planning to purchase another school to set up another campus.

YMSC is owned and operated by a group of parents who originally wanted to create an alternative education for their children. Their children have since finished school but the school was so successful in growth and is now managed by Joline Schack. The school's IT facilities have grown along with the school, and it now employs 2 full time staff (Tim and Abishek to keep the system running, as along with a program coordinator, Carol, who assists teachers to incorporate computing within their programs).
Joline can foresee a time in the near future where they employ over 300 people across two campuses. Their staff are mostly teachers, though the school does have a Human Resources manager, and Accounts Manager, several administrative assistants (receptionist, office manager, secretary), and grounds staff.

You have very recently been contracted to solve an area of concern to the owners - information security. The school's security measures have been
developed in a largely uncoordinated fashion and it has been suggested by Joline that information security could threaten the survival of the school. You have been given access to all staff for assistance in determining the security needs for YMSC.

In fact, it is Joline that has initiated your hiring. She encountered a little resistance from current ICT staff, arguing that continuing with the current approach is satisfactory. That approach has been one without a formal policy where security has been built in an ad-hoc, piecewise manner.
They would both say that the current policy has worked well enough up to now, thanks to the knowledge and expertise within the team.

Joline would like to have Tim more onside with the structured and formal approach that you will bring. In an attempt to get that support, Joline has asked you to begin your role with YMSC by developing a report that discusses how information security could be better managed by YMSC.
While this report will largely be about general principles, she would also like you to go into detail on one specific issue as a means of further demonstrating the usefulness of your formal approach. She would like you to go into detail about a development that both she and Tim are very concerned about, problems that will be introduced by opening a second campus. You have decided that you will choose one aspect of that development and draw up a Risk Management Plan for it and include a recommendation based on a Cost-Benefit Analysis.

The school currently uses commercial applications products for its processes. This includes a learning management system (Moodle), MSOffice, accounts and finance (Business One), a VOIP telephone system internally and several mobile phones for staff use. The school has a LAN infrastructure and it uses Wi-Fi throughout the campus. All employees that require regular access to school systems are supplied with a desktop laptop - depending on their needs. Students must have their own laptop or notebook and can access the school's network through the Wi-Fi system. Some of the school's systems need to be accessed from off campus. The school does have a print and file servers. All data for school management is backed up to cloud services provided by a local ICT provider. Email has been contracted to Microsoft.