Let's Share

IT Governance and Change Management Proposal Education Department Western Australia (Case Analysis)

2020-04-29T15:51:00.001+07:00

1. Executive Summary

From recent information technology (IT) audit cycles during 2017 and 2019, multi-agencies of Western Australian (WA) State have resulted similar undesirable conclusions reported by WA Audit General. The audit findings were strongly concerned with weaknesses of IT security and business continuity across the agencies. To rectify these year-after-year issues, WA Department of Education (DoE) takes the initiative to design and implement a new governance framework as the first pilot to improve the IT governance system in responding to the weaknesses addressed in the audit reports. Control Objectives for Information and Related Technologies (COBIT) 2019 is used for the design of governance system, and Queensland Change Management Plan Workbook and Template is used for managing the implementation to ensure the effectiveness and its sustainability.

This proposal will provide an overview of the WA Audit General’s reports and DoE background. It will also analyse COBIT19 core models to produce an effective design of IT governance system and develop a sustainable change management for its implementation.

2. Understanding the Background

WA Audit General performed comprehensive IT audits between 2016 and 2018 across 14 agencies. The reports of 3 audits revealed that control weaknesses have been found existing repeatedly around IT system security, security of sensitive information and business continuity, arising in application control and general computer controls (Auditor General Western Australia 2017, 2018, 2019).

In July 2017, DoE was reformed by merging the Department of Education and Department of Education Services. The Department’s role has been influencing the whole education system in Western Australia (Department of Education 2018a). Since 2018, the department’s strategic plan is to provide up-to-date curriculum, high quality teaching, effective leadership, good governance, safe learning environment and strong collaboration (Department of Education 2018b). All schools are using Standing Operating Environment (SOE) for delivering online learning and content (MLA 2012). More than 100,000 of student, parents and teacher are using online communication (Connect) platform across 75 schools compared to approximately 70,000 users during last year (Department of Education 2018a).

As coupled the IT security weaknesses in WA agencies, and the growth of users on the online services in DoE, the department could face severe consequences ranking from disruption of online learning delivery due to system failures to personal information exposure in the events of data breach.

3. The Design of Governance Framework

3.1. Overview of COBIT19

COBIT19 is a framework for management and governance of IT. It guides enterprises how to develop an IT governance system, based on enterprise’s goals, with a dynamic and holistic approach that provides stakeholder value. It also focuses on end-to-end and tailored system where governance and management activities are clearly distinct (ISACA 2018b, 2018c).

3.2. Identifying and Analysing COBIT Core Models

To identify the governance and management objectives and practices, it is necessary to understand and associate the DoE environment with COBIT design factors. Below are the significant factors that drive decision making in achieving the governance system in DoE.

i. Strategy:

DoE is a government agency and is currently focusing delivering high quality of education while facing financial constraint (Department of Education 2018a). As a result, the primary focus of the department is to provide stable service and the secondary focus is to minimise cost.

ii. Goals:

DoE’s goal also pays high attention on information security and business continuity improvement.

Based on COBIT mapping table and an analysis of significant prioritisation (See Appendix 1), there is 1 governance objective and 3 management objectives that need to be adhered by to strengthen IT governance system. The governance objective is to optimise risk (EDM03), while management objectives are to manage security services (DSS05), continuity (DSS04) and security (APO13).

3.3. Defining Key Practices and Challenges

3.3.1. EDM03 – Risk Optimisation

This governance objective is to ensure that IT-related risks in DoE are optimised and it is below department’s risk appetite and tolerance. Also, the impact of the risks is identified and managed. Governance bodies of the department must be the key involvement in implementing relevant practices including evaluating, directing and monitoring the risk management.

To ensure that the processes are effectively employed, Minister of Education and Training should take the accountability while Director and Deputy Director General Department of Education as well as Chief Information Officer and Director ICT Governance and Planning should take responsibility of practices performance.

By properly evaluating IT risks, IT security and business continuity risks in DoE are assessed and properly defined, and thus the establishment of related practices to manage the risks are being acknowledged and enforced more effectively. But there might be some cultural challenges involved since the ownership acceptance and commitment from Minister of Education and Training who is accountable for this object is required.

3.3.2. APO13 – Security Management

This management objective is to limit the occurrence and severity of information incidents in DoE – to below risk appetite level. To achieve the objective, firstly, information security management system (ISMS) including standards, policy and approaches to secure technology and business processes need to be established and maintained in alignment with business needs. Then, a treatment plan is to be defined according to business cases with a comprehensive recommendation of how the risks are managed. Also, regular communication of the plan and updates must be in place to provide ongoing assessment of the ISMS and its improvement.

Managing security requires Chief Information Security Officer’s (CISO) accountability in achieving it. However, since DoE does not have CISO (Department of Education 2018a, p. 186), this role should be temporary taken by CIO while other underline levels need to be delegated other responsibilities (See Appendix 2).

The proper implementation of security practices enables DoE to identify information security risks that the department is prone to and to develop a reasonable approach to address them in a cost-effective manner. For instance, the department might focus on the risks related could-based solution since student learning platform is an online solution. The main limitation that DoE is facing while adopting these practices is competency shortage. The department may need to employ a CISO who have enough skill and experience in information security strategy to lead the adaptation and to influence the aware of its necessity.

3.3.3. DSS04 – Continuity Management

This COBIT core model is to make business and IT organisation properly respond to events causing business disruption. The important practices that DoE necessarily performs include defining continuity plan objectives and scope, developing and documenting business continuity plan (BCP) and disaster recovery plan (DRP). Training must also be provided to all relevant internal and external people, and the BCP and DRP test and assessment should be conducted regularly.

Deputy Director General Education Business Services should take the accountability of this core model and assign various responsibilities to other executives and directors underneath (See Appendix 2).

The benefit of this objective is to provide DoE a set of controls safeguarding the continuous availability of business operation. In the fact that the department using online solution to manage student information and learning, solid plans such deploying secondary cloud solution and having regular data replication can be defined as parts of the scope to ensure the online service continuity. Nevertheless, there are some challenges related to staff training because there are over thousands of stuff across the department and schools (Department of Education 2018a), and might not be cost-effective to acquire additional services.

3.3.4. DSS05 – Managed Security Services

To answer the DoE’s primary focus – information security, this objective allows the department to create more concrete elements to protect information form identified information security risks and to minimise the impact of any incidents. To succeed that, various practices may also be required such as managing network and infrastructure security, user identity management, logical and physical accesses, and protecting the systems from malicious software.

It is also a key difficulty that all the practices need a competent CISO to be accountable for those beneath managements who are have responsibility to make it happen (See Appendix 2). In addition, it is a cost incurrence as comprehensive tools need to be employed – for example, security information and event management (SIEM), and it also involves culture adaptation to a more restrictive environment of user devices when identity and access management systems are implemented.

4. Change Management Strategy

4.1. Change Vision

This change management is made for IT governance system improvement. It will affect some changes in policies and processes in DoE. It aims to enhance IT system security, information security and business continuity. Without the improvement of IT governance, the risks associated to IT security and business continuity are less likely to be minimised while the scale of information is increasing. Failing to protect the information will result great reputation loss and make WA citizen’s personal information exposed to malicious activists.

4.2. Change Detail

Structure Change

1. CIO’s role needs to be temporarily modified by including accountable and responsible for information security risk management until the department may place a CISO.

2. CISO will have an independent office to oversee and operate all the information security matters and implementation.

People and Skills

Pre-requisite skills such as security service tools should be provided to IT team under CIO and CISO offices.

4.3. Approach

Stakeholders

Participating Level	Stakeholders
Driver	1. Minister of Education and Training 2. Director General Department of Education 3. Deputy Director General Education Business Services
Advocating	1. Chief Information Officer 2. Director ICT Operations and Customer Services 3. Director ICT Governance and Planning 4. Director Integration, Build and Deployment
Active Participants	Relevant department officers who are working under the 4 Advocative.
Willingness	1. WA Audit General 2. Executive Director Finance and Commercial Services
Understanding	Director Business and Customer Services

Resistance Management:

Survey is to be conducted before the implementation start targeting CIO, Director ICT Operations and Customer Services, Director ICT Governance and Planning, and Director Integration, Build and Deployment offices to ensure all key players clearly understand the vision and to foresee future barriers.

Change Management Team

Role	Member
Project Steering Committee	1. Minister of Education and Training 2. Director General Department of Education 3. Deputy Director General Education Business Services
Project Manager	Chief Information Officer
Communication Manager	Director ICT Governance and Planning
Governance Integration Manager	Director ICT Operations and Customer Services
Process Integration Manager	Director Integration, Build and Deployment

4.4. Strategy

Action Plan

The main activities to be completed include the following (See Appendix 3 for more detail).

1. Communication the change

2. Pre-implementation survey

3. Pre-requisite skill training

4. Governance objective implementation

5. Management objective implementation

6. Awareness training

7. Feedback survey

8. Close of project

Communication Plan:

The communication plan consists of the following key information (See Appendix 4 more detail).

1. Vision

2. Key management involvement

3. Project timeline

4. Pre-requisite skill training

5. Implementation specification

6. Awareness training

7. Close of the project

Training Plan

The trainings to be conducted include the following modules (See Appendix 5 for more detail).

1. Overview of COBIT19 (For Executive and Director levels)

2. Security awareness (For everyone)

3. Business continuity (For everyone)

4. Disaster recovery (For IT team responsible for recovering system)

5. Security incident response (For IT team responsible for IT Security monitoring)

Resistance Plan

From the survey completed from the previous stage, it can identify who are likely to resist to the change in the department. The Project Communication Manager then can conduct a consultation meeting to assure that the resistance is caused by misunderstanding of the key message delivery or other factors and to find further remedial actions (See Appendix 6 for common change resistance and overcome factors).

4.5. On-going Monitoring and Review

Upon the completion of the implementation, DoE should consolidate all the strengths and challenges, and properly document them as key lessons learn. This document can be used for evaluating the post implementation performance and effectiveness. In additional, regular on-going internal audit function should be performed to monitor the consistency of the performance. Where any business process changes are required, the IT governance should be re-evaluated, and new directions should be provided to align those changes.

5. Conclusion

In conclusion, this report is written as a solution to strengthen IT governance coping with IT system security, information security and business continuity weaknesses addressed by Western Australian Audit General in the context of piloting in Department of Education. four COBIT core models are to be adopted into the department, including risk optimisation, security management, security service management and continuity management. To some extent, there are some challenges foreseen in the new governance system including culture change, competency need and cost incurrence. However, with the use of adequate change management (Queensland Change Management Plan Workbook) which responsibilities are communicated, strategies and approaches are followed, it will ensure that the transition of the new governance system will not impact daily operations and will be sustainable in the Department of Education.

6. Appendices

Appendix 1: Mapping Process

From mapping the enterprise goals (ISACA 2018a, pp. 139-140), it provides the following objectives:

Education Department’s Goals	Remark
(EG02) Managed business risk (EG06) Business continuity	Based on 2 the goal of ensuring IT security and business continuity.
Alignment Goals	Remark
~~(AG03) Managed I&T-related risk~~ (AG07) Security of information, processing, infrastructure and application and privacy	AG03 is excluded because most of its objectives are the same as AG07 and it is less significant.
Governance and Management Objectives	Remark
(EDM03) Ensure risk optimisation ~~(APO12) Managed risk~~ (APO13) Managed security ~~(BAI10) Managed configuration~~ (DSS04) Managed continuity (DSS05) Managed security Services	APO12 and BAI10 are excluded because they are less significant and due to DoE budget constraint.

Appendix 2: RACI Charts

Security Management

Continuity Management

Management Practices	Deputy Director General Education Business Services	Chief Information Officer	Director Business and Customer Services	Director ICT Operations and Customer Service	Director ICT Governance and Planning	Director Integration, Build and Deployment	Information Security Manager
1. Identifying plan object and scope	A	R	R	C	I	R	I
2. Developing and documenting business continuity plan (BCP) and disaster recovery plan (DRP).	A	R	R	C	I	R	I
3. Reviewing and test the plan	A	R	R	R	C	R	I
4. Conduct training	A	I	R	C	C	I	I

Security Services Management

Management Practices	Chief Information Officer	Director Business and Customer Services	Director ICT Operations and Customer Service	Director ICT Governance and Planning	Director Integration, Build and Deployment	Information Security Manager
1. Network and infrastructure security	A	I	R	I	R	C
2. User identity and logical access	A	C	R	I	R	C
3. Physical access	A	C	R	I	R	C
4. Protecting against malicious software	A	I	R	I	R	C

Appendix 3: Action Plan

Activities	Responsible Person	Timeframe
Communication the change	Communication Manager	01-Jan to 15-Jan-2020
Pre-implementation survey	Communication Manager	15-Jan to 15-Feb-2020
Pre-requisite skill training	Process Integration Manager	15-Feb to 30-Mar-2020
Governance objective implementation	Governance Integration Manager	1-Apr to 15-May-2020
Management objective implementation	Process Integration Manager	1-Apr to 15-Aug-2020
Awareness training	Governance Integration Manager and Process Integration Manager	15-Aug to 7-Sep-2020
Feedback survey	Communication Manager	8-Sep to 30-Sep 2020
Close of project	Chief Information Officer	1-Oct-2020

Appendix 4: Communication Plan

What	Who	How	When
1. Vision	From: Director General Department of Education To: Chief Information Officer, Director ICT Operations and Customer Services, Director ICT Governance and Planning, Director Integration, Build and Deployment	Meetings	After the Proposal Approved
2. Key management involvement	From: Project Manager To: Other Executive and Director Under Deputy Director General Education Business Services	Meetings	Early Jan-2020
3. Project timeline	From: Project Manager To: Other Executive and Director Under Deputy Director General Education Business Services	Email and Meeting	Early Jan-2020
4. Pre-requisite skill training	From: Process Integration Manager To: Underneath Team	Workshop and Meeting	Mid Feb-2020
5. Implementation specification	From: Process Integration Manager To: Underneath Team	Email and Meeting	Early Mar-2020
6. Awareness training	From: Communication Manager To: Director ICT Operations and Customer Services, Director ICT Governance and Planning Director Integration, Build and Deployment Offices	Email	Early Aug-2020
7. Close of the project	From: Project Manager To: All offices under Deputy Director General Education Business Services	Email, Department Announcement	Early Oct-2020

Appendix 5: Training Plan

Module	Outcome	Delivery Mode
Overview of COBIT19	- DoE will understand the benefit of good IT governance. - Promoting effectiveness of IT governance in the department	Online learning
Security awareness	- DoE will understand the significance of IT security. - Promoting individual awareness	Online learning
Business continuity	- DoE will be able to act accordingly in the event of any business disruption.	Workshop
Disaster recovery	- DoE will be able to act accordingly in the event of IT system failures.	Workshop
Security incident response	- DoE IT team will be able to act accordingly in the event of IT security breach.	Workshop

Appendix 6: Change Resistance Root Causes and Overcome Factors

ISACA (2018d, p. 39) identifies some common root causes and overcome factors of resistance to change as the table below.

Root causes	Overcome Factors
- Misunderstanding the usefulness of the requirements - Afraid of increase in workload and cost - Unwilling to admit fault - Threat to role and power	- Provide awareness based on educating rather than instructing - Employ change agents who have both IT and business experience - Create a sense of success after each implementation milestone. - Boost the sense of recognition in every small win - Focus on enabling or empowering people by training, coaching, mentoring, transferring skills.

Reference List

Auditor General Western Australia 2017, Information Systems Audit Report 2017, ISSN: 2200-1921 Western Australian Auditor General’s Report 7th Floor Albert Facey House 469 Wellington Street, Perth.

Auditor General Western Australia 2018, Information Systems Audit Report 2018, ISSN: 2200-1921, Western Australian Auditor General’s Report 7th Floor Albert Facey House 469 Wellington Street, Perth.

Auditor General Western Australia 2019, Information Systems Audit Report 2019, ISSN: 2200-1921, Western Australian Auditor General’s Report 7th Floor Albert Facey House 469 Wellington Street, Perth.

Department of Education 2018a, Department of Education Annual Report 2017–18 ISSN: 1843–2396 Department of Education - Government of Western Australia.

Department of Education 2018b, Strategic Outline, ISBN 978-0-7307-4617-1, Department of Education Western Australia, 151 Royal Street East Perth WA 6004.

ISACA 2018a, COBIT® 2019 Design Guide: Designing an Information and Technology Governance Solution, ISBN 978-1-60420-765-1 ISACA, 1700 E. Golf Road, Suite 400 Schaumburg, IL 60173, USA .

ISACA 2018b, COBIT® 2019 Framework: Governance and Management Objectives, ISBN 978-1-60420-764-4, ISACA, 1700 E. Golf Road, Suite 400 Schaumburg, IL 60173, USA .

ISACA 2018c, COBIT® 2019 Framework: Introduction and Methodology ISBN 978-1-60420-763-7, ISACA, 1700 E. Golf Road, Suite 400 Schaumburg, IL 60173, USA .

ISACA 2018d, COBIT® 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution, ISBN 978-1-60420-766-8, ISACA, 1700 E. Golf Road, Suite 400 Schaumburg, IL 60173, USA .

MLA, JW 2012, The role of ICT in Western Australian Education: Living and Working in a Digital World, ISBN: 978-1-921865-59-6, Parliament of Western Australia, Perth, < www.parliament.wa.gov.au/ehsc>.

Queensland Government Chief Information Officer Change Management Plan Workbook and Template <http://www.nrm.wa.gov.au/media/10528/change_management_plan_workbook_and_template.pdf>.

Queensland Health Payroll Project IT Governance - A Case Study

2019-11-19T06:47:00.000+07:00

1. Case Study Introduction

The Queensland Government faced a phenomenal payroll system implementation failure after spending $181m with multiple unsuccessful attempts to make the Queensland Health (QH) Payroll system go-live. The project was overrun for an approximate two years, and its functional deficiencies resulted in financial damage which QH accumulatively overpaid staff $112.3m at the end of May 2012 (KPMG 2012, p. 5), as well as impacted on the state public health services (Chesterman 2013, p. 16).

This report will provide an overview of QH Payroll Project and AS ISO/IEC 38500:2016 Standard. It will also highlight and discuss significant IT governance issues occurred during the project, and relevant applications of the standard will be introduced to remediate the circumstances.

2. QH Payroll Project Background

To deliver low cost and optimal quality of corporate functions for the whole-of-government, in 2003 Share Service Initiative (SSI) was established by the Queensland Government. It was considered the largest State Government organisational reform, and QH Payroll system implementation was a part of the project. A Share Service Solution Program was designed by CorpTech, a newly created technology centre under Queensland Treasury, and assisted by four other service providers including Accenture, Logica, SAP and IBM for human resource and finance solution. SAP ECC 5 and Workbrain systems were selected for the solution.

In March 2006, QH Payroll system maintenance responsibility was transferred to CorpTech. After being aware of QH’s legacy system, LATTICE, was close to the end of its life cycle (end of June 2008), CorpTech urgently prioritised QH Payroll system implementation.

Reported in March 2007, a review conducted by Service Delivery and Performance Commission, the project was expressively behind its schedule and analyst foresaw that additional budget input was required (Chesterman 2013). So, organisational structure reform was proposed to make a more effective and efficient project outcome. The reform led a change from multi shared service providers to prime contractor model. IBM was chosen after the tender process for its proposed lowest cost and delivery commitment, 31 July 2008.

After the go-live on 14 March 2010, critical system errors still existed, and the inconsistency between the system and business processes disrupted payroll personnel from completing the payroll on time and correctly. Thus, the QH employee received incorrect wage-payments including over-paid, under-paid and not getting paid. The issues were carried on for months costing the Government more to fix the system and handle the public chaos.

3. Overview of the Australian IT Governance Standard

AS ISO/IEC 38500:2016 is an Australian Information Technology (IT) Governance Standard providing high level principles to guide organisation owners, senior executives and others who are responsible for governing the IT related processes and decision making (Council of Standards Australia 2016). The six principles of this standard aim to ensure the use of IT in an organisation is producing its most effectiveness, efficiency, and acceptability for the business. To achieve the three objectives, governing bodies should carry out evaluation, direction and monitoring the IT resource and activities adhering by the six principles.

3.1. Responsibility: personnel in an organisation must understand and accept their responsibilities of assigned role(s), and they are also provided the authority to complete their actions.

3.2. Strategy: IT plans and strategies of the use of IT resources satisfy the current and future needs of business strategies, and their risks are managed.

3.3. Acquisition: IT acquisitions are balanced between costs and benefits, opportunities and risks in short term and long term.

3.4. Performance: IT operations are for the purpose of supporting organisation business and offering services required to suit current and future business’s requirements.

3.5. Conformance: the use of IT resources and activities are complied with mandatory regulations and legislations.

3.6. Human Behaviour: all IT related aspects show respective actions toward people involved in IT processes.

From the prescriptive level of the standard, it provides high judgemental approaches to governing bodies to employ the six principles. This needs resources, motivation to be able to choose a right approach to accommodate the principles. A study conducted by Alreemy et al. (2016) found that many success factors are required to achieve an effective IT governance including management support, financial support, IT structure, internal and external effects. So, adopting the standard is difficult and required a great effort from all stakeholders in an organisation. However, it would not always guarantee good governance.

4. Discussion and Recommendations

Key issues engaging the severe system failure are discussed in different aspects based on the six principles of the AS ISO/IE 38500:2016, and applicable remediations are provided within each section below.

4.1. Responsibility

The failure under this project responsibilities is associated with scope of work and milestone delivery. It was uncertain that who was in-charge of scoping after IBM became the prime contractor. Neither the State nor QH did provide detail system requirements for IBM, so on 28 January 2008, Statement of Work 8 was signed by the State, which gave all assumptions made by IBM (Chesterman 2013, p. 101). Furthermore, Chesterman also highlighted that six months after the project was kicked off, the issues with the scope was still not settled. This illustrated that the Project Directorate did not monitor the progress of IBM, which mean their accountability was not controlled.

It is implied that Project Board might have not assessed whether the appointed Project Directorate was competent to lead the project and did not monitor and evaluate the ongoing performance of such large-scale project. It is recommended that work progress update should be periodically reported from each level of stakeholders to ensure that their responsibilities are being fulfilled. This can be evaluated to provide feedback to underline stakeholders of what should be improved to deliver what they are accountable for.

4.2. Strategy

The IT strategic plan for the project was vague. LATTICE system vendor (Talent2) had informed QH about the system obsolescence since 2005 before the system maintenance responsibility was transferred to CorpTech (Chesterman 2013, p. 60). However, the project stakeholders did not seem to treat the information as an influential factor to the SSI project. In addition, a key observation reported by an independent reviewer emphasised that the vision and order of the SSI was not widely accepted, and thus insufficient commitment was input by whole-of-Government (PwC 2010). It was noticeable that the implementation for QH was initially scheduled in 2006, yet it was delayed since there was another project delivery for Department of Justice (Auditor-General of Queensland 2010, pp. 2, 56). Thus, it indicated IT strategic plan of the SSI was not adequately developed before its commencement.

The second principle of the standard was critically violated since the strategic plan was not thoroughly developed. As stated earlier, the legacy system outage was not fully aware by the project lead (CorpTech) prior to the plan of adopting new system for QH. Subsequently, CorpTech could not manage to plan the implementation according to the time constraint. It is recommended that Executive Director of CorpTech who was appointed by Treasury Department as a Shared Service Provider of SSI should direct CorpTech to understand and evaluate the business processes and needs of all relevant Queensland State’s Departments to provide an IT strategic plan to the SSI as the whole. Control over the progress should be monitored to ensure that adequate information is gathered, and its insight is obtained.

4.3. Acquisition

The balance between risk and opportunity, and cost and benefit were not being assessed when choosing the prime contractor. The decision making during the Invitation for Tender (ITO) stage was obscure for two reasons. At the final stage of the evaluation, it was Accenture scoring higher than IBM which later became the successful tender (Chesterman 2013). The revaluation was performed after the interference of a private IT consultant, Terence Errol Burn, who was a former IBM employee for 13 years (Horton & Nicholas 2013). Claimed by a Program Direct of CorpTech, Bond (2013), Burn convinced the Evaluation Panel to consider other aspects, particularly his pressure was affecting the integrity of the evaluation as he was not a senior level of public servants. As a result, the influential persuasion interrupted the sceptical assessment during the evaluation.

This principle is to achieve the minimal risk of IT investment. QH project stakeholders who were involved the acquisition process should be aware of everyone’s matter of interest. During the ITO process, additionally, the Evaluation Panel should ensure that a genuinely independent decision is made by delegating independently different evaluation criteria to different people avoiding pressures put by a central evaluation.

4.4. Performance

The IT solution did not support the continuity of the payroll process while adding more cost after the Go-Live. The system was supposed to provide more effective and efficient fortnight payroll for the QH employees. However, it produced significant deficiency and discrepancy. This happened because of the miscarried go-live decision made by the Project Broad. The decision was sorely relied on the Project Directorate’s report which alternatives were not considered besides committing to Go-Live (Chesterman 2013, p. 143). After the Go-Live, Chesterman also added that the payroll processing performed by SAP system was slow and delayed the payroll run for employee while the attendance information transferred from Workbrain system was also incorrectly complied. The deficiency made the payment backlogged for approximately 20,000 cases and unprocessed adjustments, so it took around eight months to solve the issues (KPMG 2012, pp. 4, 12). It concludes that the system was completely incapable to perform as it had been expected.

According to Principle 4, the decision made by the governing bodies including the Project Directorate and Board was not the right option. The Project Directorate should perform further risk assessment and understand the circumstances of the continuing use of LACCITE system with CorpTech support after vender support ended. Illustrated in Payroll Systems Risk Assessment (2007), CorpTech had fully understood the risk of in-house maintaining and the system limitations. Moreover, since then CorpTech started to support the system in-house during the new system implementation project. This could have helped the Project Board revaluate the alternatives to ensure the sustainable business process rather than to give the permission for false go live.

4.5. Conformance

When the Conflict Register which was to obligate the Financial Administration and Audit Act 1977 (Qld), was completed, it wasn’t thoroughly performed. Terence Errol Burn untruly declared himself as not having conflict of interest with IBM during the ITO process. His prior professional experience could have caused him disqualified from the ITO involvement while he did not declare himself (Chesterman 2013, p. 76). This results the non-compliance to the regulatory requirements.

QH Payroll project tried to comply with the State Procedure Policy where the Conflict Register was created. However, there was still a lack of monitoring process to ensure the effectiveness of the registration. Control over the assessment of the participants’ prior work history should be in place to avoid false declaration of the integrity check.

4.6. Human Behaviour

The failure of the QH payroll provided consequences to every employee. Payroll officers expected the new systems (SAP and Workbrain) to perform the same way as the legacy system. However, the payroll was originally run by regional areas where payroll officers were familiar with workers’ different work arrangements (Chesterman 2013). When the system got centralised, it became unfamiliar to the users, and so the work delays accumulated payroll backlog. 200$ underpaid in fortnight payments were made to 11,000 workers, and rallies were held by hundreds of nurses (Nurses rally over payroll bungle 2010). This showed the utmost consequences of the public health system in Queensland when human behaviours were not considered in IT activities.

To remediate the negative outcome from the QH Payroll project, the Project Board should ensure that Project Directorate and public servants consider the alignments of current business and system processes. All system users should be provided a proper training so that they can use the system correctly after it is rolled out. Moreover, it is necessary to have a rollback plan to recover business continuity from any unforeseen event during the cut-off period of the system.

5. Conclusion

From the discussion of the key aspects addressed from the QH Payroll project, it is identified that the QH project IT governance was miscarried in accordance with the AS ISO/IEC 38500:2016 across the six principles. Each produces a correlative impact to the project, from directing improper IT strategic plan which affecting the IT performance and relevant internal and external people, to insufficient evaluating and monitoring of IT resources responsibilities, acquisition, and compliance with regulations. Preventive, detective and corrective measurements should be established to safeguard strong IT governance.

Reference List

Alreemy, Z, Chang, V, Walters, R & Wills, G 2016, 'Critical success factors (CSFs) for information technology governance (ITG)', International Journal of Information Management, vol. 36, no. 6, Part A, pp. 907-916.

Auditor-General of Queensland 2010, Information systems governance and control, including the Queensland Health Implementation of Continuity Project, Auditor-General of Queensland Queensland Audit Office Level 14, 53 Albert Street, Brisbane Qld 4000 GPO Box 1139, Brisbane Qld 4001 1834-1136 Financial and Compliance audits

Bond, DJ 2013, Statement for Health Payroll System Commission Inquiry, 4243568, GPO Box 149, Brisbane QLD 4001, viewed August 14, 2019, <http://www.healthpayrollinquiry.qld.gov.au/__data/assets/pdf_file/0003/179328/BOND,-Darrin-signed-statement.PDF>.

Chesterman, R 2013, Queensland Health Payroll System Commission of Inquiry, Department of Justice and Attorney-General GPO Box 149 Brisbane QLD 4001, PO Box 13674 George Street QLD 4003

Council of Standards Australia 2016, Information technology—Governance of IT for the organization SAI Global Limited, Standards Australian Limited, GPO Box 476, Sydney, NSW 2001, Australia.

Hey, N 2007, Queensland Health Enterprise Solutions Transition, Commercial in Confidence

Horton, J & Nicholas, A 2013, Statement of Witness - Terence Errol Burn, QCPCI Reference: 2128011, GPO Box 149, Brisbane QLD 4001, viewed August 14, 2019, <http://www.healthpayrollinquiry.qld.gov.au/__data/assets/pdf_file/0007/179359/BURNS,-Terence-signed-statement.PDF>.

KPMG 2012, Review of the Queensland Health Payroll System.

Nurses rally over payroll bungle 2010, ABC News (Australia), Australia, August 5, 2019, YouTube database, <https://www.youtube.com/watch?v=OptVZj8x6vk>.

PwC 2010, Shared Services Review - Review of the Model for Queensland Government PricewaterhouseCoopers Riverside Centre, 123 Eagle Street, BRISBANE QLD 4000 GPO Box 150, BRISBANE QLD 4001 DX 77 Brisbane Australia

Cryptography

2019-09-02T13:50:00.001+07:00

Cryptography is the use code to secure information. It was original from Greek words 'kryptos' and 'graphein', meaning 'hidden' and 'to write'.

There are some key term that need to be understood to get earlier to understand cryptography.

plain text is the information or message that is to be hidden.
encryption is the operation of distinguishing the plain text. encryption algorithm is the set of rules used for encrypting the plain text.
encryption key is the value need to be input into encryption algorithm to perform the encoding.
cipher text/cryptogram is the encrypted plain text.
decryption algorithm is the set of rules used for decrypting the plain text.
decryption key is the value need to be input into decryption algorithm to perform the decoding.

Put the key terms together, the process of cryptography between a sender and a receiver can be explained as below:

5G's Pros and Cons, and the Risk to Data Privacy

2019-07-05T08:50:00.000+07:00

Evaluating the Strengths and Weaknesses of 5G Technology Implementation Associated with Data Privacy

Background

As technology has been rapidly advancing, the Internet is becoming the primary source of connection between humans across businesses, governments and public services. To fulfil the greater demand from users, a fifth generation of mobile wireless network (5G) has been designed in the last couple of years to provide extremely fast speed, broader bandwidth for more device connection, and to reduce connection latency (Shankaranarayanan & Ghosh, 2017). However, it has been argued that the 5G implementation provides a significant threat to privacy due to its newly design technology (Aiqing & Xiaodong, 2017). This paper will provide an overview of 5G wireless network, and evaluate the opportunities and challenges of its implementation.

5G has been innovated to anticipate the tremendous growth of smart devices and technologies communicating via the Internet. It has been estimated that by 2020 the number of smart devices used globally is 200 times those used in 2010, and this amount of the connectivity will not be able to be supported by 4G technology (Al-Dulaimi, Wang, & I, 2018). Because of its speed, bandwidth and less latency, 5G has been considered the world cutting-edge technology advancement being awaited by giant tech companies moving to toward the Internet of Things (IoT). IoT has been defined as the expansion of the Internet to accommodate, explicitly or implicitly, all electronic devices’ and components’ connection and communication (Saleh & Bouhaï, 2017).

The Benefits of 5G

The Industrial Internet of Things (IIoT) is one of the aspects that will benefit from the 5G technology. The IIoT plays a significant role in current shifting of industrial revolution – from Industries 3.0 to 4.0. This transformation can be established by employing self-controlled smart systems and services via the Internet or cloud service to collect, and process data from manufacturing production lines (production, inventory, warehouse) and to monitor the industrial output. Industries 4.0 will be able to manage flexible production based on consumer demands ,and provide instant monitoring and decision making for manufacturing industries (Sendler, 2018). A study has shown that in order to perform real-time monitoring of all operations and equipment in an advanced manufacturing industry, it requires a higher communication rate of at least 25 megabit per second of wireless network connection (Cheng, Chen, Tao, & Lin, 2018). By comparing current speed provided by 4G, Liyanage, Ahmad, Abro, Gurtov, and Ylianttila (2018) have highlighted that 5G network could provide 100 times better communication speed than 4G, which can provide only approximately 10 megabit per second speed. Thus, the higher communication rate offered by 5G will fulfil that requirement demanded by the latest industrial revolution and IIoT.

Another positive influential aspect of 5G is improvement of healthcare services. The provision of most accurate remote-control access between human and devices can allow doctors and health experts to work from a distance because of the ultra-low latency introduced by 5G. It reduces the end-to-end remote control lag duration to 1 millisecond which is 50 times shorter compared to the 4G network (Liyanage et al., 2018). Research conducted on cognitive systems for healthcare has proposed that remote surgery could be performed by using the display and tactile sensing devices via the 5G network since surgeons can obtain real-time information and circumstances of the patient (Chen, Yang, Yixue, Mao, & Hwang, 2017). In April 2019, distant heart surgery was performed in Guangdong, China directed by a specialist 400 kilometres away from the surgery room by using 4k ultra-high deification conference using 5G (Ye, 2019). Ye also pointed out another surgery case was also occurred in Beijing. The surgery was completed using surgical robot by a neurosurgeon working at Hainan, China to implant a deep-brain stimulation. As a result, it is proved that 5G’s ultra-low latency can improve healthcare service by allowing remote support and from distant available expertise.

Moreover, 5G will also contribute to promoting modern urbanisation, such as the smart city. A smart city is considered to include, but not limit to, smart public safety and environment monitoring, smart buildings and smart mobility. This domain will require huge data collection from smart devices, sensors, geographical trackers, as well as surveillance system such as closed-circuit television (CCTV), radars and satellite (Saleh & Bouhaï, 2017). This massive data needs to be collected spontaneously and wirelessly for analysis in order to produce an on time and reliable outcome. For example, traffic lights could automatically switch depending on the real-time analysis of data gathered from the road cameras to smoothen the traffic congestion. This process can be supported by the high speed and broad range of connections given by 5G wireless network.

The Challanges of 5G

However, at the same time while 5G is a dream come true of the IoT, security weaknesses and other unforeseen failures are imposed by the implementation of the technology. There are some characteristics of security challenges and loopholes that are posed a threat to data privacy. Firstly, 5G mobile wireless network increases the magnitude of risk landscape comparing to the previous generations. Extensive use of 5G is generating the complete environment of the IoT, including smart city, smart home, eGovernment, eHealth, and financial technology some of which have been explained earlier. Also, it brings hacker’s motivations in attempting to break through the network because of more available vulnerabilities of newly connected platforms including new smart devices, services and systems (Liyanage et al., 2018). Another characteristic of the 5G network is the uncertain security standards. The existing security mechanism developed in the 4G network is not so applicable for 5G’s newly advanced infrastructure (Ji et al., 2018). Because 5G’s architecture consists of new hardware, open source software platforms and ununified automated source management, it raise many other unpredicted threats within the technology.

In addition, the more devices are used and connected to IoT, the greater amount of user private data is collected, including personal data, geographical location, and personal identity from the services users are utilising. Threats related to privacy are classified into two categories. One of those is data gathered and used by the companies that users are associated with. For instance, when users register on a mobile application, it will often request permission from the users to access phone location or make use the content and information created on that application by the users. The information might be used by the companies for product invention or for other business strategy purposes which users might have not been aware of. Another category of the privacy invasion is the use of information breach from hacking users’ personal devices or companies’ system servers. This threat might provide more vital damages regarding some personal information such as person identity, financial and health information are more value able and targeted by hackers. Thus, given the opportunities and extent of sensitive data exposure, 5G is providing a contestable trade-off regarding the privacy disclosure.

The Response to the Challenges

In responding to the concern of the security weakness imposed on data privacy, many studies have been conducted. International Telecommunication Union’s Telecommunication Standardization Sector (ITU-T) has provided security recommendations to address the network security aspects (Ji et al., 2018). It focuses on providing security mechanisms to protect network security and users against the threats to security. This will probably address the 5G new network architecture implementation mentioned earlier as it contains significant loopholes and unforeseen consequences. Ji et al. (2018) also emphasises that “5G Evolved Security Module” – a well-defined security strategy and plan, and tools and processes needed to respond to any attack case detected, should be developed. Additionally, to deal with the personal privacy of individuals, device users should be skeptical while using drives. Device passcode should be complex and not easily to be guessed, and device auto-lock screens should be set. While applications installed and used in the mobile and other smart devices should be assessed for its genuine use, timely update of the devices’ firmware or operating system should be performed. Based on the stated counter measurements to the weakness of 5G security characteristics and the exposure of user privacy, these might highly likely reduce threat that is involved to user data privacy.

In conclusion, 5G mobile wireless networks are offering boundless opportunities toward the Internet of Things phenomenon including building smart manufacturing industries, enhancing healthcare services and promoting smart cities through its extensive features which overcome previous generations of mobile wireless network. However, the embedded threats to data privacy cannot be avoided due to the new technology flaws and hacktivists’ advanced motivations. Proper security plans and measurements need to be in place to ensure that while experiencing the enjoyment of new technology, users can control and protect their data and privacy.

References

Aiqing, Z., & Xiaodong, L. (2017). Security-Aware and Privacy-Preserving D2D Communications in 5G. IEEE Network, 31(4), 70-77. doi:10.1109/MNET.2017.1600290

Al-Dulaimi, A. a., Wang, X., & I, C.-L. (2018). 5G networks : fundamental requirements, enabling technologies, and operations management. Hoboken, New Jersey: Wiley-IEEE.

Chen, M., Yang, J., Yixue, H., Mao, S., & Hwang, K. (2017). A 5G Cognitive System for Healthcare. Big Data and Cognitive Computing, 1(1). doi:http://dx.doi.org/10.3390/bdcc1010002

Cheng, J., Chen, W., Tao, F., & Lin, C.-L. (2018). Industrial IoT in 5G environment towards smart manufacturing. Journal of Industrial Information Integration, 10, 10-19.

Ji, X., Huang, K., Jin, L., Tang, H., Liu, C., Zhong, Z., . . . Yi, M. (2018). Overview of 5G security technology. Science China Information Sciences, 61(8), 081301. doi:10.1007/s11432-017-9426-4

Liyanage, M., Ahmad, I., Abro, A. B., Gurtov, A., & Ylianttila, M. (2018). A Comprehensive Guide to 5G Security. Newark, UNITED KINGDOM: John Wiley & Sons, Incorporated.

Saleh, I., & Bouhaï, N. (2017). Internet of Things : Evolutions and Innovations. Newark, UNITED STATES: John Wiley & Sons, Incorporated.

Sendler, U. (2018). The Internet of Things : Industrie 4.0 unleashed. Berlin, Heidelberg: Springer Berlin Heidelberg : Imprint: Springer Vieweg.

Shankaranarayanan, N. K., & Ghosh, A. (2017). 5G. IEEE Internet Computing, 21(5), 8-10. doi:10.1109/MIC.2017.3481346

Ye, Y. (2019). Doctors do surgery over 5G internet. New Scientist, 242(3225), 8. doi:https://doi.org/10.1016/S0262-4079(19)30623-2