Understanding Recommending and justifying security improvements in VCE Data Analytics U4O2
What it does: This justification names a CIA criterion (confidentiality) and a legal obligation (APP 11), which is how a recommendation is justified. Cost and practicality cover price, effort, training and budget. These show whether the recommendation can realistically be put in place. A strong recommendation names a specific improvement and ties it to the weakness found (shared logins). Vague advice like 'improve security' is not a recommendation. Recommendations must respond to an identified weakness. Otherwise the organisation may spend money on something that fixes nothing. Offsite backups let data be restored after a failure or disaster, so authorised users can access it again. This is availability.
Common mistakes: APP 7 covers direct marketing. Protecting data from unauthorised access is APP 11 (security of personal information), so that is the law the recommendation should cite. Offsite backups let the organisation restore data after a failure, so they are justified by availability, not confidentiality.
Quick Questions
1. Which is a stronger security recommendation for a clinic whose staff share one login?
A. Improve the clinic's security so it is better protected
B. Give each staff member a unique login with MFA, because shared logins weaken accountability and confidentiality ✓
A strong recommendation names a specific improvement and ties it to the weakness found (shared logins). Vague advice like 'improve security' is not a recommendation.
2. A recommendation should be linked to a weakness found in the organisation's current strategy.
Recommendations must respond to an identified weakness. Otherwise the organisation may spend money on something that fixes nothing.
3. Which justification uses the CIA criteria?
A. Encrypting the database protects confidentiality by making stolen data unreadable ✓
B. Encrypting the database is popular, so it is a good idea
Justify a recommendation by naming the criterion it improves (confidentiality, integrity or availability) and explaining how. Popularity is not a justification.
4. A recommendation to store daily backups offsite supports which CIA criterion most directly?
A. Availability ✓
B. Confidentiality
Offsite backups let data be restored after a failure or disaster, so authorised users can access it again. This is availability.
5. Which recommendation is justified by a legal obligation?
A. Delete customer records no longer needed, because APP 11 requires reasonable steps to destroy or de-identify unneeded personal information ✓
B. Keep all customer records forever, because more data is always better
Linking a recommendation to a law, such as APP 11 in the Privacy Act 1988, shows why it is required and not merely optional.
Fill in the Blanks
1. Weakness: staff reuse weak passwords
Recommendation: add MFA to all logins
Hint: Type the abbreviation for the extra login step that links this fix to the weakness
2. Weakness: no audit trail of file access
Recommendation: turn on access logs
Hint: Type the word for the records that show who accessed files and when
3. Fix: encrypt laptops to protect data
Justification: this improves confidentiality
Hint: Type the CIA criterion that is improved when only authorised people can read the data
4. Recommendation: encrypt data in transit
Justification: meets legal obligations
Hint: Type the word for the duties the law places on an organisation
5. Recommendation: train staff in phishing
Practicality: low cost and quick to roll out
Hint: Type the financial factor that is weighed when judging whether a recommendation is practical
Spot the Error
Question 1
A
Weakness: weak passwords
B
Fix: require MFA for logins
C
Criteria: confidentiality
D
Law: APP 7 protects the data
E
Cost: low, uses current app
Line D — APP 7 covers direct marketing. Protecting data from unauthorised access is APP 11 (security of personal information), so that is the law the recommendation should cite.
Question 2
A
Weakness: no offsite backups
B
Fix: add daily cloud backups
C
Criteria: confidentiality
D
Cost: moderate monthly fee
Line C — Offsite backups let the organisation restore data after a failure, so they are justified by availability, not confidentiality.
Question 3
A
Weakness: staff can edit logs
B
Fix: make audit logs read-only
C
Criteria: availability
D
Cost: low, a settings change
Line C — Read-only logs stop records being changed, so the recommendation protects integrity. Availability is the wrong criterion for this fix.
Question 4
A
Weakness: unencrypted laptops
B
Fix: turn on disk encryption
C
Legal: APP 3 requires it
D
Cost: low, built into the OS
Line C — APP 3 is about collecting personal information. Taking reasonable steps to secure stored data, such as by encrypting it, falls under APP 11.
Question 5
A
Weakness: staff click phishing
B
Fix: buy a bigger hard drive
C
Criteria: confidentiality
D
Cost: low, one session a term
Line B — A recommendation must be tied to the weakness found. More storage does nothing about staff clicking phishing links. Staff training does.
