SBM4302-IT Audit and Controls
Assessment Details
This assessment is designed to assess students’ ability to apply theoretical learning to practical, real world situations. In this assessment students are given a sample case study and asked to design an IT audit based on it. In particular, emphasis on the reason(s) behind the situation that unfolded and actions that could have been taken to prevent such incidents from occurring.
Case Study: Service NSW Data Breach
On September 7th 2020, media reports showed that the Service NSW, the New South Wales state’s biggest data collection agency, suffered a massive data breach through a cyber attack. Personal data of 186,000 customers and staff were leaked after a cyber attack occurred through phishing emails earlier this year, in which 47 employees had their email accounts compromised. A four-month investigation, which began in April, concluded that roughly 3.8 million documents had to be analysed to assess the severity of any possible breaches
"This rigorous first step surfaced about 500,000 documents which referenced personal information," Service NSW chief executive Damon Rees said. "The data is made up of documents such as handwritten notes and forms, scans, and records of transaction applications."
The total size of the breach was 738 gigabytes of data, but not all of that was personal information, a spokesperson for Service NSW said. There is no evidence that individual MyServiceNSW account data or Service NSW databases were compromised.
Customers who have been identified as "at-risk" will be notified by mail, which will include instructions on how to get support. The department said it "will never call or email a customer out of the blue requesting customer information about this or any other data breach".
Requirement
Based on the above case study, you have to prepare a report and then a subsequent presentation to answer the followings:
- objectify your audit focus and scope
- which IT resources of Service NSW, are you planning to audit? And how can you detect regularities, abnormalities in them?
- what suggestions, recommendations do you want to provide to Service NSW based on your findings?
- As IT auditor, what are the rules and regulations that you plan to adhere to?
