MGMT902: Enterprise and Information Systems – Cyber Security Analysis

Assessment Overview

Critically evaluate how an organisation operating in New Zealand or Australia governs its cyber security and information risk, and benchmark that approach against the frameworks and standards applied in New Zealand and Australia. Analyse the organisation’s threat landscape and regulatory obligations, evaluate the effectiveness of its existing security measures against recognised frameworks, and assess the broader ethical, social and cross-border implications of its ICT initiatives. You may select an organisation you have previously studied, provided it operates in New Zealand or Australia and sufficient publicly available information exists.

Report Question

How effectively can a comprehensive approach to information security and risk management apply New Zealand and Australian cyber security frameworks and standards to govern the technical, operational, ethical and social challenges of ICT adoption at a company of your choice, and what can be learned from relevant international equivalents?

A. Cyber Security Threats, Risk Management And Process Improvement (30 Marks)

• Critically analyse the prevalent cyber security threats facing the company, including data breaches, ransomware and extortion, supply chain compromise and social engineering.
• Develop a tailored risk management framework by critically applying relevant New Zealand and Australian cyber security frameworks, standards and regulatory requirements.
• Evaluate the implications of the identified risks for key ICT-enabled business processes and determine major opportunities to improve process performance, resilience and security.
• Formulate and justify improvement initiatives and establish measures for evaluating their effectiveness.

Relevant instruments may include the New Zealand Information Security Manual (NZISM), the Protective Security Requirements (PSR), the Privacy Act 2020 including the notifiable privacy breach scheme and IPP 3A, the ACSC Essential Eight and Information Security Manual, the Security of Critical Infrastructure Act 2018 and the Cyber Security Act 2024.

B. Security Performance, Innovation And ICT Strategy Alignment (30 Marks)

• Critically evaluate the effectiveness of existing information security measures by benchmarking current practices against New Zealand, Australian and international frameworks and standards.
• Identify material gaps in existing security and ICT-enabled processes and formulate evidence-based enhancements.
• Assess opportunities for technological and process innovation, critically evaluating their organisational and commercial value, implementation requirements, risks and contribution to sustained performance.
• Formulate a systematic process for developing or revising the organisation’s ICT strategy, and critically compare it with the operational strategy, organisational strategy and wider business objectives, justifying how information systems, cyber security and innovation initiatives should be prioritised and aligned.

The comparative analysis may draw on the UK NCSC Cyber Assessment Framework (CAF) and Cyber Essentials, the NIS Regulations 2018 and the Cyber Security and Resilience Bill, the EU NIS2 Directive, the GDPR, the Digital Operational Resilience Act (DORA), the Cyber Resilience Act and ISO/IEC 27001:2022.

C. Ethical And Social Implications, Stakeholder Communication And Strategic Implementation (40 Marks)

• Critically evaluate the ethical and social implications of widespread ICT adoption within the company, including data privacy, data sovereignty, cross-border data transfer, algorithmic bias and the digital divide.
• Analyse the broader implications of ICT adoption for societal domains such as employment, education and healthcare that are materially affected by the organisation’s activities.
• Develop and justify strategies that promote ethical ICT practices, mitigate social inequalities and strengthen responsible ICT governance.
• Engage with internal IT specialists and business managers on the identified risks, ethical issues, process improvements and strategic initiatives; synthesise their perspectives and critically evaluate how stakeholder input shaped the final analysis, priorities and recommendations.
• Formulate practical, evidence-based recommendations for implementing, governing and sustaining the proposed ICT, information security and process improvements, showing how they support operational priorities, organisational strategy and longer-term objectives.

Experts Answer on Above Questions on Cybersecurity Risk Management

Organisation selected for analysis is Air New Zealand

Cyber security threats, risk management and process improvement

The threats are mainly in the form of data breaches such as theft of passenger data and customer information can negatively impact the reputation. The threat of ransomware/extortion can directly affect the booking process and operational system which in turn contributes to reputational pressure. Supply chain compromise is another major threat whereby third party technology can introduce vulnerabilities into Air New Zealand’s systems.
Risk management framework – it is important for airlines like air New Zealand to make use of NZISM along with PSR and privacy act 2020 for its New Zealand operations. The required information security management framework can also be accomplished using ISO/IEC 27001:2022.
Process impact and improvement – the impact could be negative as it will result in booking this location, compromise on employee accounts for privileged access control, supplier compromise and data breach.
Effectiveness measures – The effective measures needed are remediation of critical vulnerabilities as per agreed SLA, reducing phishing test failure rate, backup Restoration testing, and third party supplies completing security assessments.

Security performance, innovation and ICT strategy

Framework benchmarking – The application of NZISM at air New Zealand strengthens its technical security control, PSR framework improves protective security governance, privacy act 2020 helps in protecting the information of employees, and ISO 27001:2022 allows for formalising organisation-wide ISMS.
Main gaps to address – the main gaps that need to be addressed are greater dependence on interconnected third parties, identity and privileged access risks, increasing exposure to digital service, and difficulty in maintaining consistent security controls across suppliers.
Innovation opportunities – the innovative approach to consider are AI-assisted threat detection, zero trust, automated vulnerability management and security orchestration.
ICT strategy alignment – it is important for Air New Zealand to prioritise ICT investments as per its business criticality and cyber risk, and not on the basis of technology novelty. As for example, priority should be given to maintaining reliable digital booking because it directly affects the customer service and revenue.

Ethical and social implications

The ethical implications to consider are data privacy whereby information about the passenger is collected only for genuine purposes and retained only till they are required. Another ethical implication is data Sovereignty as Air New Zealand should identify the storage and processing of data especially when the cloud providers operate infrastructure outside New Zealand. The cross border data transfer should also be handled by giving due emphasis on privacy, and the increasing Reliance on digital booking should not hurt its passengers who have limited digital access or capability.

Stakeholder Communication

The IT specialist should identify technical vulnerability and feasible controls while the business managers should prioritise risks on the basis of its business and operational impact. The legal Team should evaluate privacy act and cross border requirements while the senior management should approve risk appetite and strategic priorities.

Strategic recommendations

It is recommended to Air New Zealand to implement zero trust and phishing resistant MFA, strengthen its third party risk management through supply assessment and continuous monitoring, establish ISO 27001 aligned ISMS, conduct regular disaster recovery exercises, and create AI governance processes to handle privacy, bias and human oversight.

Want Detailed Answers with References?

The analysis of cyber security threats, risk framework, ICT strategy, privacy, ethics and resilience using Air New Zealand above revealed important findings about the issues and necessary measures to consider in dealing with the cyber security threats effectively. With our professional cyber security expert in New Zealand, it is possible to get support with cyber security tasks easily by visiting our New Zealand assignment help page. You can also review the expert written answers on questions from different domains from Auckland Institute of Studies.