ITC568 Cloud Privacy | Data Security In House HR Database

Introduction: 

Digital Identity Crisis has explored how much data is stored on the Internet. Here, only a little of that data is owned and maintained by individuals. Here a charity is considered that is engaged in seeking and delivering mental health services, support services, accommodations to a various disadvantaged individual in that community.

Here the cloud vendors have made presentations indicating operational expenses that are intended to decline dramatically as the cloud model gets adopted. Here data breaches are considered colossal damage to disadvantaged people in that community.

In this study, information held by the charity over the employees in the present HR systems is considered. Further, data privacy for those staffs moving towards SaaS applications, risks and threats to digital reorganisations of charity employees to move to SaaS applications are analysed. Here, various discussions on operational locations and solutions of SaaS provider for HR manager are considered. This also includes jurisdiction or data sensitivity that is regarded as by charity.

1. Security of Employee Data:

1.1. Current threats and risks of data security in-house HR database: 

The various threats are as follows:

Essential multiple threats are identified below.

1.2. Additional risks and threats to employee data: 

There have been typical problems including huge workloads and different backlogs that are mounting for related database administrators, time-consuming and complicated requirements to testing various parches and issue to find maintenance window for taking down and writing on what is commonly referred to as business-critical systems (Taylor, Fritsch & Liederbach, 2014).

1.3. The resulting severity of risk and threat to employee data:

The resulting dangers and dangers include analysing database vulnerabilities and recognising of compromised endpoints and classification is sensitive information. This also includes lack of lack controlling user access rights and to remove high privileges and different dormant users (Rodriguez & Sanchez, 2015). Further, there are monitoring of every database tasks and patterns of usages in real time for defining unauthorized SQL, significant data transactions and data leakages along with stacks of systems and protocols. Moreover, there has been unblocking of various malicious web requests. Besides, there are automation of auditing with database auditing and protecting platforms.

Furthermore, there has been arching of encrypting databases and external data. Apart from this, there has been a training of employees over risk-mitigation tools including how to identify various cyber threats like spear-phishing attacks. This also includes best practices through online and e-mail utility and managing of passwords. It must also be reminded that any failure to enforce training and creating a work culture that is security conscious raises the scope of a security breach.

2. Privacy of Employee Data:

2.1. Privacies for HR database:

Web tracking:

The web is to be browsed at any time, and various adverts can be noticed across multiple sites that are filled with products that have been searched earlier. The reason is that they are tracked. These web site cookies have been periodically monitored for web browsers through data inserted into a browser. However, there have been various tools like MAC address and tracking of accounts used to see what one have been performing ion the web.

As some people have not been minding that, preference to that have adverts served through to them that are relevant to those interests and some has been finding that an invasion to digital privacy. However, there has been data that has been vital to developers, advertisers and companies. Thus there has been the lot more tracking moving on as default (Cummins et al., 2015). As one is concerned regarding online monitoring, there has been worth delivering to privacy settings of different apps, web browsers and services. This is to assure that the set to provide privacy level needed. On the other hand, there have been anti-tracking tools and browser extensions for keeping those activities within wraps.

Data collection:

This tracking has been following people at real-time, various internet agencies and services can gather browsing data and share computer and router the MAC addresses with third-party companies and advertisers (Mannerström et al., 2018). These data companies comprise no direct interacting that can create a pretty good profile of internet web browsing and habits. As this extends to mobile applications offering services and ask to access phone number, contracts and various more profound phone activities.

Apart from this, different services such as Google Maps are also able to track real-time and common location by default. However, there has always been being stalked by faceless technology agencies. This is the price people have needed to accept for free services and applications. Here some data has been efficiently surrendering that has been pretty invasive.

Lack of security:

Further, various online services and websites have never possessed the latest and robust guards that have been leaving data that could behold and data flowing to computer and web servers at risks within hackers.

For example, websites using the now-outdated HTTP web communication standard, lack of encrypted connections between smartphones and computers with that could be connected. This indicates data were moving between a couple of points that can be controlled by charity and stolen by hackers for different nefarious reasons. Besides, there have been servers supporting online services and websites that one can find (Jarvenpaa & Teigland, 2018). Here cybercriminals have been accessing some of the individual credentials and infringing on privacy that has been paving this way towards identity thefts and fraud. To avoid such problems, this has been worth through to use sites encrypted connections and assure that there is upgraded software related to cybersecurity.

Since one is unable to prevent web servers from getting hacked, through various tools such as two-factor authentications and keeping an eye over for legitimate warnings alerting to actual breaches of data is helpful to personal information security (Lewis et al., 2016).

Connection to everything:

Various smart TVs, thermostats, fridges and speakers can seem like futuristic tech. However, this has been posing a threat to security.

2.2. Privacy of Employee Data:

Data Access Risk:

Since there has been providing of data to the third party. Various users have been concerned regarding who can get access. This has seemed out of control and a new fear of potential dissemination, corruption and deletion of data by authorised people (Lam, 2014). This has been a specific major worry for users planning to store sensitive information that becomes detrimental as it ends up in the hands of others, particularly in competition.

Instability:

Stability and security are actual pillars holding useful SaaS software. These services ahs ruined into a favourite double-edged sword. Besides, it has meant more options for users and keeping up with a competition. Moreover, every individual is unable to keep up with the rise in the market. Further, in the end, employed providers have been shutting down. The reason is that they have no longer competed (Kromer et al., 2016).

Lack of transparency:

SaaS providers have been assuring and secretive towards their clients. This indicates that they have been better at keeping data secure than others. In the minimal form, they have been confirming that they can acquire data and fields more proficiently than the customers. Besides, there has been not every user taking words at face value (Olson & Wu, 2015). Moreover, there have been various concerns about lack of transparency of providers regarding how the complete security protocol can be handled. However, it has been a subject of interest.

Identity theft:

SaaS has always needed payment around credit cards that can do in distant places. This has been a fast and convenient method. However, this has not is a concern of some users regarding various risks implied by it.

The uncertainty of data location:

It is seen that the maximum of SaaS providers have disclosed where the data centres have been. This is the reason they should be aware of regulations that are placed but FISMA or Federal Information Security Management. This states that the necessities of customers in keeping sensitive data have been within the nation.

Paying upfront and long-term:

Here economic security has been a problem that was born out of an agreement to utilise SaaS providers. Here, most of them have needed payment upfront. This must be for long term. As one is unsure that how long they require their service and anything in their policy can change over time (Flynn-O'Brien et al., 2017). This is the concern regarding investing in potentially crucial; part of a company that has not been par and dissatisfied clients. Here, some cab also forces to pay a year ahead.

2.3. Assessing resulting severity of risk and threat to the privacy of employee data:

Prior hiring contractors and employees, a charity has been able to assure that they have in polices procedures and policies for protecting themselves. Specifically, essential strategies include acceptable usage of e-devices and systems. This also includes mobile devices, data collections along with retentions (Haimes, 2015). They have been noticing and consents regarding collection and monitoring of data over the charity and different background check policies permitting pre-employment and present vetting of every staff.

As staffs start working, the charity must analyse indicators of potential problems. This includes excellent systems accessed by employees. This has included outstanding systems located by the crews. This provides information and documents that are downloaded. Printed or mailed while teams perform activities for the charity. This includes efforts by an employee to exceed access privileges and records of different failed log-in attempts.

As companies believe that the employees are disgruntled potentially to any insider thrat., the manager of an employee must coordinate with various other departments including human resources, legal and information technology (Liu et al., 2015). This is to retrieve extra data and planning course of actions. Further, investigations have been including forensic computer or various network searches, preserving affected systems and employee interviews. During developing those facts, a charity must consider how or when to suspend or revoke suspected insider threats has been accessing or taking extra action against insiders. They have been aware of taking action against the alleged employee to implicate employment laws.

Next, while off-boarding employees, a charity must consider steps for protecting themselves. This has been imperative for charity to develop policies and processes regarding off-boarding employees that are directed to minimise risks during data leakage. There have been exit interviews that are to be conducted wherever possible. Here they should be allowing the organisation in spotting potential issues or determine red flags (Pritchard & PMP, 2014). As an employee provides resignation, the activity must decide whether to institute protocols to eradicate or limit access of employee for confidential data prior the last day of employee’s work. The HR must be working with IT for auditing most current network access of the employees and email activities assuring that the employees have not harvested any secret data.

While the charity is prepared to terminate any employee, the charity must deploy protocols to secure confidential data of the company. This includes decreasing access of employee to systems and networks prior or simultaneously with notifying an employee of impending dismissal. Here, the same thing can be done while contracting with consultants, contractors and vendors in bringing the ends near (Koks et al., 2015). Every employee leaving the company and every contractor who contracts must end must remind of various ongoing obligations to protect of confidential information of organisations and must be asking of return every company data, electronic tools and documents of charity before the end day of work.

Employees have been presenting a notable threat o business crucial information of the company, as consultants or constructors with access to charity’s systems. The organisation must assure their relevant departments like information technology, human resources and legal departments has been coordinated to undertake steps to secure charity against threats including those set forth above (Grace et al., 2015).

3. Digital Identity Issues:

The various risks and dangers are illustrated below.

Immature nature of cloud in identity management:

The cloud providers have put themselves that has always been sophisticated regarding integration of platforms with identity survives beyond enterprise firewall. There have been few third-party tools that have let IT extending of role-based access controls within clouds having single-on. This has given some third-party tools that have made IT extend powers that are role-based accesses. For instance, Google consists of secure data connectors forming encrypted connections between business applications of Google and customer data. This happens while letting customer control where employees have even accessed Google App resources (Hansen et al., 2018). However, this approach has turned wildly since clients have used various SaaS applications finding themselves dealing with multiple tools of security. The third-party products have offered the benefits of connecting to several types of SaaS applications. There has been accessing and identity management on a cloud. Controlling access controls and identities for enterprise applications remained an enormous problem faced by today’s IT. As an enterprise has been able o leverage cloud computing services before any true identity and strategy if access management, in the long run (Penning-Rowsell et al., 2014). This has been extending charity’s identity services to a cloud as a needed requirement for strategic use of various in-demand computing services. However, the evolution of SaaS has outpaced many efforts for building comprehensive standards of the industry. Notably, limited proprietary support for those user profiles and industry standards has included SPML that has not been upgraded for many years.

Weak standards of clouds:

The SAS 70 is an auditing standard that is designed for showing service providers having useful control data. Here, this standard has not been crafted with cloud computing in mind. However, this has turned into a benchmark in the absence of standards that are in the lack of rules that are cloud-specific.

Secrecy:

Here cloud vendors have been arguing that they have been able to secure data than typical customers than SaaS security. This has been better than thought by most of the people. However, the clients have been finding that difficult to believe since SaaS vendors have been tending to be secretive regarding their security processes. Individually various cloud service providers have been releasing a few details regarding their operations and data centres. They have been claiming that can compromise the security (Hopkinson, 2017). Besides, industry analytics and customers have got fed up with every unanswered query and different agreements that are silenced.

Access everywhere where convenience is raised with risk:

Here a critical advantage of software-as-service that can access by business applications in the presence of Internet connectivity has also been posing new risks. This coupled with proliferation smartphones and laptops has made this more important for IT department to safeguard their end-points. This is because the nature of SaaS is accessible at any place. As one decides o put e-mail over G-mail, employees can log in from any unsecured machine. This has been one of the advantages of SaaS (Coronel & Morris, 2016). However, this has also posed various downsides. This endpoint has not been needed to be secured. Here, the data has been no longer over walls in a physical sense and virtual sense.

It is unknown where the data has been every time:

Here various regulations like FISM or “Federal Information Security Management Act: has needed customers to place sensitive information. Though this has been a relatively easy task on the face, cloud vendors gas been often making that guarantee. This has been virtualised systems, virtual and data machines have been dynamically moving to response to load balancing necessities (Hillson & Murray-Webster, 2017).

4. Provider Solution Issues:

The various issues are demonstrated hereafter.

There have been various operational location and solutions rising and mitigating threats and risks recognised for privacy and security of employee data. First of all, there are tighter controls and management that have been of utmost priority for all enterprises. Here human resource management has been needed to automate and streamline processes. Users can select between various top benefits of human resource management system for enhancing that software.

HR management systems have been easing difficulties in controlling HR operations and having every vital element of different workforce management. Here the reason behind HRMS has been to pass higher benefits for the enterprise through automation and decreasing data redundancies. Quicker retrieval of information and sharing are vital for management and employees (Haimes, 2015). HR management system has been providing training materials, new leave management and policy documents for making different kinds of informed decisions. It has been leading to high-speed communications under departments and groups to coordinate for better planning of operations and tasks.

Moreover, there has been higher scalability. Here the business has needed quick scaling of operations as they get derived from market conditions. The HR solutions have been incorporating higher flexibilities to integrate legacy systems and adapt changing scenarios if business. What this has been cutting down on time is taken to extend or shrink HR operations assuring time and cost savings. Besides, it has increased employee satisfaction (Aven, 2016). Here automated HRMS has created built-in performance management and leaving managements that need staffs from performance across a period set. It has negated scopes of fudging and helping in transparent appraisals. By reducing the time necessary for performance evaluation, a quicker rolling-out and payroll processing has been meant for a rising in employee satisfaction and engagement. Next, there have been quicker recruitments. Here, automating hiring of life-cycle has been solving maker barriers for the HR department of the charity.

5.Data Sensitivity:

The security, trust and privacy have been highly interconnected such as ethics and laws. Preservation of privacy and security provisions depending on assurances has allowed to whom who is trusted by one with a zone of inaccessibility where one never feels secures till one believes security providers. Further, there has been a violation of privacy constitutes such as risk and threat to security (Kott & Arnold, 2015). Here, the law has been providing a solution while ethics controls whether the ethics can offer contexts to law. The privacy breaches have been disturbing the expectations and running the risks of losing security and diluting. Thus they have been showing disrespects to statute and violations of various ethical guidelines. Here, data privacy has been about access, using and collection of data. Here the data has been subjected to legal rights to information. It has been regarding freedom of unauthorised access to private data, improper usage of data, completeness and accuracy while gathering data about people.

Here, availability of data contents and legal rights to ownership and access has comprised of data subjects. Here the risks have been to inspect, upgrade and correct that information (Wolke, 2017). Here, the data privacy has also been concerned with expenses as data privacy has been breached. Here the costs involve hard costs like financial penalties inserted through regulators, payments of compensations in lawsuits like non-compliance with various contractual guidelines. This also includes soft costs like loss of client trusts or reputational damages. Here, though there have been multiple cultures put together with many values over privacy or to make that impossible for defining a universal or stable value, this is also a broad consensus where privacy has not been intrinsic, social and core value. This is the reason why approach towards confidentiality has been embracing the ethical principle, societal and environmental, law concerns. These are possible despite the difficulty and complexity in holding data privacy (Bromiley et al., 2015).

Conclusion: 

The study is used to examine business, legal and privacy requirements helpful for cloud deployment model. It helps in analysing risk management perquisites for cloud deployment models and critically analyses industry, ethical and legal concerns for privacy and security of data implemented in the cloud. Here, the experience of identity technologies has been specific, subjective and individual to contexts. Here every context requires the deep dive. As the designers are needed to create identities from most sound principles as they require knowing what these concepts have meant in experiencing users they are designed for. Here the ultimate aim has been building digital identity systems that have not met the necessities of individuals who have put them. The discussion proves that empowering people to make their lives simpler that can be achieved as their experiences and views are included in designing new systems of digital identity. Here, the charity has needed different digital identity solutions that are valid around services, technologies, standards and markets. Here legal certainty is vital to guarantee interoperability of services around various countries and sectors and same experience for the users. Besides, cyber security of transactions is a primary problem for adopting reliable digital identity systems. Further, regulators have been protecting consumers and placing data protection at the core of the framework of secure and string digital identity system. Thus the charity needs trust frameworks through regulating various elements or schemes of digital identity.

References:

Adjei, J. K. (2018). Monetization of Personal Digital Identity Information: Technological and Regulatory Framework. In Internet Taxation and E-Retailing Law in the Global Context(pp. 29-43). IGI Global.

Aven, T. (2016). Risk assessment and risk management: Review of recent advances on their foundation. European Journal of Operational Research, 253(1), 1-13.

Baym, N. K. (2015). Personal connections in the digital age. John Wiley & Sons.

Bromiley, P., McShane, M., Nair, A., & Rustambekov, E. (2015). Enterprise risk management: Review, critique, and research directions. Long range planning, 48(4), 265-276.

Brustbauer, J. (2016). Enterprise risk management in SMEs: Towards a structural model. International Small Business Journal, 34(1), 70-85.

Buczak, A. L., & Guven, E. (2016). A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys & Tutorials, 18(2), 1153-1176.

Coronel, C., & Morris, S. (2016). Database systems: design, implementation, & management. Cengage Learning.

Cummins, J., Hu, S., Markus, P., & Kristiina Montero, M. (2015). Identity texts and academic achievement: Connecting the dots in multilingual school contexts. Tesol Quarterly, 49(3), 555-581.

Feher, K. (2015). Corporate Digital Identity: Key Factors of Policy and Business.

Flynn-O'Brien, K. T., Fallat, M. E., Rice, T. B., Gall, C. M., Nance, M. L., Upperman, J. S., ... & Rivara, F. P. (2017). Pediatric trauma assessment and management database: leveraging existing data systems to predict mortality and functional status after pediatric injury. Journal of the American College of Surgeons, 224(5), 933-944.

Glendon, A. I., Clarke, S., & McKenna, E. (2016). Human safety and risk management. Crc Press.

Grace, M. F., Leverty, J. T., Phillips, R. D., & Shimpi, P. (2015). The value of investing in enterprise risk management. Journal of Risk and Insurance, 82(2), 289-316.

Grassi, P. A., Garcia, M. E., & Fenton, J. L. (2017). Digital identity guidelines. NIST Special Publication, 800, 63-3.

Haimes, Y. Y. (2015). Risk modeling, assessment, and management. John Wiley & Sons.

Haimes, Y. Y. (2015). Risk modeling, assessment, and management. John Wiley & Sons.

Hansen, A., Pisaniello, D., Varghese, B., Rowett, S., Hanson-Easey, S., Bi, P., & Nitschke, M. (2018). What can we learn about workplace heat stress management from a safety regulator complaints database?. International journal of environmental research and public health, 15(3), 459.

Hillson, D., & Murray-Webster, R. (2017). Understanding and managing risk attitude. Routledge.

Hopkin, P. (2018). Fundamentals of risk management: understanding, evaluating and implementing effective risk management. Kogan Page Publishers.

Hopkinson, M. (2017). The project risk maturity model: Measuring and improving risk management capability. Routledge.

Jarvenpaa, S., & Teigland, R. (2018, January). Introduction to the Minitrack on Trust, Identity, and Trusted Systems in Digital Environments. In Proceedings of the 51st Hawaii International Conference on System Sciences.

Koks, E. E., Jongman, B., Husby, T. G., & Botzen, W. J. (2015). Combining hazard, exposure and social vulnerability to provide lessons for flood risk management. environmental science & policy, 47, 42-52.

Kott, A., & Arnold, C. (2015). Towards Approaches to Continuous Assessment of Cyber Risk in Security of Computer Networks. arXiv preprint arXiv:1512.07937.

Kromer, R., Hutchinson, D. J., Lato, M. J., & Abellán, A. (2016). Rock Slope Pre-failure Deformation Database for Improved Transportation Corridor Risk Management. Landslides and Engineered Slopes. Experience, Theory and Practice, 1211-1217.

Lam, J. (2014). Enterprise risk management: from incentives to controls. John Wiley & Sons.

Lewis, K. A., Tzilivakis, J., Warner, D. J., & Green, A. (2016). An international database for pesticide risk assessments and management. Human and Ecological Risk Assessment: An International Journal, 22(4), 1050-1064

Liu, Y., Sarabi, A., Zhang, J., Naghizadeh, P., Karir, M., Bailey, M., & Liu, M. (2015, August). Cloudy with a Chance of Breach: Forecasting Cyber Security Incidents. In USENIX Security Symposium (pp. 1009-1024).

Mannerström, R., Hietajärvi, L., Muotka, J., & Salmela-Aro, K. (2018). Identity profiles and digital engagement among Finnish high school students. Cyberpsychology: Journal of Psychosocial Research on Cyberspace, 12(1).

Olson, D. L., & Wu, D. D. (2015). Enterprise risk management(Vol. 3). World Scientific Publishing Company.

Penning-Rowsell, E., Priest, S., Parker, D., Morris, J., Tunstall, S., Viavattene, C., ... & Owen, D. (2014). Flood and coastal erosion risk management: a manual for economic appraisal. Routledge.

Pounders, K., Stowers, K., Wilcox, G., Love, B., & Mackert, M. (2017). Exploring gender and identity issues among female adolescent and young adults who connect in an anonymous platform. Journal of health psychology, 22(5), 548-560.

Pritchard, C. L., & PMP, P. R. (2014). Risk management: concepts and guidance. Auerbach Publications.

Rodriguez, G. J., & Sanchez, V. (2015). Affirming Gender Identity in Elementary Schools.

Sullivan, C. (2015). Digital Identity: an emergent legal concept(p. 178). University of Adelaide Press.

Taylor, R. W., Fritsch, E. J., & Liederbach, J. (2014). Digital crime and digital terrorism. Prentice Hall Press.

Wise, J. B., & O’Byrne, W. I. (2015). Social scholars: Educators’ digital identity construction in open, online learning environments. Literacy Research: Theory, Method, and Practice, 64(1), 398-414.

Wolke, T. (2017). Risk Management. Walter de Gruyter GmbH & Co KG.