Cyber Policy Quiz 1

Where would you find the UNSW's "Acceptable Use of UNSW Information Resources Policy"?

• https://www.myit.unsw.edu.au/

• On UNSW

  Intranet

  (myUNSW)

• Confluence

• On the Internet upon google search

Where would you find the Data Security Standard?

• On the Internet upon google search

• https://my.unsw.edu.au

  (myUNSW)

• https://www.myit.unsw.edu.au/

• Confluence

Users must not use UNSW Information Resources to:

• use a project management SaaS tool

• represent or create the impression of representing UNSW unless explicitly authorised to do so.

• store highly sensitive research data

• make an online payment using personal credit card

Acceptable Use of Information Resources Policy applies to? (Select Multiple Correct Answers)

• Staff (FTE & Contractors)

• Students

• Third Parties & Affiliates

• Alumni

Acceptable Use of Information Resources Policy includes? (Select Multiple Correct Answers)

• Principles for ensuring UNSW Information Resources are used legally, ethically and responsibly.

• Conditions for personal use of UNSW Information Resources.

• User's responsibilities and the penalties for misuse.

• Compliance requirements & Prohibitions

• Requirements for reporting cyber security events

What is an "Information Resource" as per the policy definition? (Select Multiple Correct Answers)

• Any Information Service

• Any Information Asset

• Any Digital Information

• None of the options

Which of the following are examples of an "Information Service" as per the policy definitions? (Select Multiple Correct Answers)

• SaaS (Software as a service)

• Data telecommunications services

• Print services

• Medibank student insurance (no tech component)

A UNSW student is working on research project to build a POC of AI robots. The robots will feed in data from UNSW research systems prior to creating smart reports/publications. Since the POC robot is in the non production environment, the POC system need not comply with the Cyber Security Standard – Risk Management

• True

• False

A Solution Architect from UNSW IT is designing an encryption mechanism for a solution which is going to store employee data. She has come to you for sign off of the design which has the master encryption key is stored on the same database as the keys being protected. She mentioned the design cannot be changed due to operational issues. What is your advice to her?

• Sign off on the solution as is

• Raise a risk as the design may not meet Security Standard

• Ignore her request

An employee from HR team wants to test a software module which will require deactivating encryption in transit. In which of the following environment, can they do that without breaching UNSW standard or policy

• without a written approval the Head of School or equivalent

• in an isolated testing environment or isolated network.

• in a production environment

• finance process purposes