Young Minds Secondary College (YMSC) is a private Australian secondary school that has been operating for several years, developing innovative programs for its students. Its staff has grown from 15 to 120 and the school enrols 700 students across level 7 to 12. YMSC has been growing steadily over the past 10 years. They have built strong relationships with the community and parents tend to send all their children to the school as well as recommending it to other parents. The owners anticipate continued growth and are planning to purchase another school to set up another campus.

YMSC is owned and operated by a group of parents who originally wanted to use an alternative education for their children. Their children have since finished school but the school was so successful in growth and is now managed by Joline Schack. The school's IT facilities have grown along with the school, and it now employs 2 full time staff (Tim and Abishek to keep the system running, as along with a program coordinator, Carol, who assists teachers to incorporate computing within their programs).

Joline can foresee a time in the near future where they employ over 300 people across two campuses. Their staff are mostly teachers, though the school does have a Human Resources manager, and Accounts Manager, several administrative assistants (receptionist, office manager, secretary), and grounds staff.

You have very recently been contracted to solve an area of concern to the owners - information security. The school's security measures have been developed in a largely uncoordinated fashion and it has been suggested by Joline that information security could threaten the survival of the school. You have been given access to all staff for assistance in determining the security needs for YMSC.

In fact, it is Joline that has initiated your hiring. She encountered a little resistance from current ICT staff, arguing that continuing with the current approach is satisfactory. That approach has been one without a formal policy where security has been built in an ad-hoc, piecewise manner. They would both say that the current policy has worked well enough up to now, thanks to the knowledge and expertise within the team.

Joline would like to have Tim more onside with the structured and formal approach that you will bring. In an attempt to get that support, Joline has asked you to begin your role with YMSC by developing a report that discusses how information security could be better managed by YMSC. While this report will largely be about general principles, she would also like you to go into detail on one specific issue as a means of further demonstrating the usefulness of your formal approach. She would like you to go into detail about a development that both she and Tim are very concerned about, problems that will be introduced by opening a second campus. You have decided that you will choose one aspect of that development and draw up a Risk Management Plan for it and include a recommendation based on a Cost-Benefit Analysis.

The Young Minds Secondary College Mission Statement

YMSC believes in providing students with an innovative educational program in a secure and modern educational environment.

Hardware and Software

The school currently uses commercial applications products for its processes. This includes a learning management system (Moodle), MSOffice, accounts and finance (Business One), a VOIP telephone system internally and several mobile phones for staff use. The school has a LAN infrastructure and it uses Wi-Fi throughout the campus. All employees who require regular access to school systems are supplied with a desktop laptop - depending on their needs. Students must have their own laptop or notebook and can access the school's network through the Wi-Fi system. Some of the school's systems need to be accessed from off campus. The school does have a print and file servers. All data for school management is backed up to cloud services provided by a local ICT provider. Email has been contracted to Microsoft.

You can envision other hardware, software, and information/data management procedures as you deem appropriate.

Discuss the fit of your formal approach to security with the company's values. Discuss the role your approach would play in terms of governance

in general.

Discuss the implications of legal and statutory requirements applicable to the case study

In the introduction explain the benefits a Risk Management Plan can bring to a company and the steps you would go through to build one. Include a discussion on the importance of Contingency Planning to YMSC, as well as the risk analysis and cost-benefit-analysis mentioned.

Development of a Security Plan List the threats, vulnerabilities, and attacks that your formal plan would manage. This should not be an exhaustive, detailed list. Recommend the risk mitigation for each. Keep the focus on YMSC's context. This should include cost-benefit analysis and impact. Explain about continuity plan and a business continuity plan for the case study. In the conclusion discuss the benefits derived from seeing Security Management as an ongoing process