CSI2102- Information Security Assignment 2 – Risk Management and Data Classification

1 CSI2102- Information Security Assignment 2 – Risk Management and Data Classification Details: Title: Information Security Assignment 2 Due Date: 05.00 PM (GMT+8) Monday 13th May 2019 Value: 30% of the final mark for the unit Length: Minimum of 1500 words, maximum 2000 (excluding cover page and references) Background: For this assignment students are required to perform a risk analysis and data classification for a small dance club. The dance club is operated by six staff and has approximately 200 members. The dance club (All Stars Dance) has just implemented an online web portal for its members, the dance club has requested a risk assessment and data classification for the data it stores and collects to ensure personal information is secure. To become a member of the dance club, members are required to visit the website and apply for membership or renew their existing membership. The web portal is an open source content management system (Joomla CMS) that is hosted in Australia by a hosting provider. The portal allows members to purchase membership, read member only news and register for events or dance tests. Club membership runs from January 1 through to December 31 each year regardless of the application date. Member payments are processed using a merchant gateway, SecurePay, and deposited directly into the associations nominated bank account. Once a member has paid for membership the system adds the member to a mailing list and updates permissions on the user account of which authorises access to member resources. Similarly, when memberships expire on December 31, members are removed from the mailing list and permissions are restricted until membership renewal. The mailing list is stored and processed by Mailchimp, a third-party provider located in the United States. Personal information collected for the mailing list include full name and email address. No other