qantas group cyber security policy

A data breach will trigger a crisis response, the extent of which depends on the nature and severity of the breach. fieldwork, which included interviewing key members of staff and reviewing further documentation, at the QFF offices in Mascot on 25 May and 1 June 2017. 2.2 When entities undertake data analytics that involve personal information, they must comply with the requirements of the Privacy Act 1988 (Privacy Act). [3] QFF is run by Qantas Loyalty, a business unit within Qantas Airways Limited (Qantas). It will compile threat forecasts and geopolitical assessments for airline safety/security committees, up to Board level, and will lead the Qantas Londons Heathrow airport last year outlined plans for a 50m project to implement The Qantas Group continues to support key external initiatives under the Australian Governments Cyber Security Strategy, the voluntary ASX100 Cyber Health Check,and joint Commonwealth and private sector meetings, including the inaugural AustraliaUnited States Cyber Security Dialogue to discuss ways to collaborate on better security outcomes. Jenks High School Football Roster, Oracle will provide its Siebel Loyalty Management platform to the airline so it can better manage its 7 million members. Likely reputational damage to the entity, such as negative publicity in national or international media. The DISO regularly briefs both the CEO and Chief Information Officer (CIO), formally and informally. Please refer to Qantas Group Policies available on the Qantas Intranet or from your manager or people representative for details. strong corporate governance transparency in reporting. [5] Qantas EpiQure was re-branded as Qantas Wine after the assessment. 4.51 The Qantas crisis management plan and its various supporting documents serve as a data breach response plan. The business resilience framework assists the Qantas Group in the preparation for, and recovery from, adverse incidents affecting the business and our interests. Over the past year, the return of domestic and international travel as borders reopened required a similar program of work to return our aircraft to the skies, including a focus on training for crew and support employees. Spoiler alert: SecurityScorecard customers realize investment payback in under a quarter. Safe growth: The Qantas Group has announced orders for a range of new aircraft. The OAIC recommended that QFF: 2.1 Loyalty programs are popular with consumers and businesses alike, with one Australian consumer research study reporting that 87 percent of Australians aged 18 and older were members of a loyalty program in 2017. Qantas EpiQure,[5] Qantas Money, etc). Staff complete the training at induction and then every three years. Year founded 1920 Employees 20.6K Qantas Airways is an airline that provides the transportation of customers using Qantas and Jetstar brands. Additionally, at the time of the assessment, QFF was conducting a multi-factor authentication pilot with selected members. timeless ink and piercing studio; how to make someone want to move out; how long does heparin stay in your system. Additionally, after the assessment fieldwork, QFF informed the OAIC that GCSC has since been renamed the Cyber Security and Privacy Committee. All relevant materials have been updated and the Qantas Group continues to manage both the data privacy and data security risks in a coordinated way. If a query relates to a QFF membership, then the call is referred to the QFF specific customer care team. formalising its current cyber security governance material to incorporate privacy. The airline said it would contact customers whose bookings were cancelled directly. Qantas Group Policies The Qantas Group has a set of 10 Group Policies, which reflect the Non-Negotiable Business Principles and outline the minimum expected standards across a range of governance areas where compliance is necessary for legal reasons and to protect our brands and reputation. 4.74 Qantas Frequent Flyer applies data analytic techniques, and then uses this data for targeted advertising and marketing. I have a proven track record of leadership and performance in a range of strategic cyber security, risk, compliance and finance roles while working in the UK, Canada, India and Australia. The recent increase in oil prices has been a threat for the aviation sector's success. These emails are provided on an opt-out basis, so members can change or cancel the different types of marketing materials that they receive from QFF. General Qantas Group IT users cannot access data in QFF systems unless they have QFF authorisation. Core Qantas Group policies are reviewed annually, and if any changes are made, they require approval of the Qantas Board (the Board). What your policy needs to cover. All projects require sign-off by Legal and staff are encouraged to approach them early in the process. We brought grounded aircraft back into service, our employees came back to work after being stood down, and we opened or reopened flying to ports that we had not flown to in over a year and to some that had not seen an aircraft in that time. Privacy Amendment (Notifiable Data Breaches) Act 2017, Australian entities and the EU General Data Protection Regulation (GDPR), Big data and privacy: a regulators perspective, Ting Our Fraud and Scams teams are monitoring 24/7 for any suspicious activity across the Westpac Group, using industry best practice security and fraud detection techniques. How can I be sure my Frequent Flyer account details are secure? Only a small number of QFF staff can match the anonymous identification number back to a QFF members individual member profile. All user access is logged and monitored, with the logs regularly audited by the platform owners. [9] Office of the Australian Information Commissioner (OAIC), Big data and privacy: a regulators perspective, viewed 26 September 2017. 4.98 The OAIC considers that there is room for improvement in the readability of the policy, and suggests that QFF works with the Qantas Group to review and, where possible, simplify the language of the policy. However, the OAIC notes that it is heavily dependent on key staff involved and is not recorded unless it forms part of the SIA or includes written advice from Legal. The Qantas Group Security Management System aims to increase security awareness through continuous improvement of security processes and enhancing the security culture across the Group (Qantas Sustainability Review, 2015). Safely returning to our ports: Many of the ports we fly to had no or limited activity during the pandemic. Maintaining a regularly updated directory of all of the information assets (including personal information) held by QFF, and where these are stored. Despite these challenges, our operational safety performance was strong as we maintained a reporting culture where people are confident to report issues without fear and consistent operational performance across all parts of the organisation. To safeguard members personal information, QFF have implemented measures, such as overseas contract staff background checks and provisions in employment contracts related to the handling of personal information. Your cyber security policy doesn't need to be very long; most SMEs should be able to fit theirs onto a single sheet of paper. The main factor in the cost variance was cybersecurity policies and how well they were implemented. QFF utilises this document in conjunction with a number of its own risk management documents and strategies. 4.76 In relation to the use of personal information for marketing and analytics purposes, QFFs APP 1 privacy policy and collection notice state that members personal information may be used to: 4.77 Potentially sensitive information gathered by the airline, such as meal preferences and medical conditions, is not used by, or accessible to, the QFF marketing and analytics teams. 4.63 Staff are required to undertake a thirty-minute online privacy training course, which summarises the law and includes a series of randomly generated series of test questions. This includes aviation safety, WHS, environment, security (including cyber security) and business resilience matters. Therefore, the OAIC recommends that QFF, along with Qantas, formalises the current cyber security governance material, such as the GCSC charter documents, to specifically encompass privacy. 4.52 The OAIC encourages Qantas to continue its current practices for testing and reviewing its crisis management plan in the context of a data breach. The security chief said foreign spy agencies posed a major threat to the privacy of the 40 million passengers flying Qantas each year. 4.101 The OAIC found that the QFF collection notice meets the requirements of APP 5, and that it refers readers to the Qantas privacy policy for further information. This may lead to the loss of vital information regarding identified privacy risks. Threats and exploits cant get through, and Umbrella gives us confidence because we know that our users are protected when theyre surfing the internet on or off the network.. develops and implements a privacy management plan that considers privacy goals and targets, and how to meet them. Additionally, there are contractual terms in place, which stipulate that only QFF may contact its members in relation to a program partner. Take a look at the 10 factor categories at the core of SecurityScorecards rating methodology. Environment Policy; 6. Legal generally relies on deductive reasoning rather than a formal document or checklist to identify any privacy issues. QFF has since advised the OAIC that a Group Privacy Officer was appointed in late July 2017 and one of the primary responsibilities of this Privacy Officer, on appointment, would be to set up and co-ordinate a network of privacy champions across the Qantas Group. We learned from nearly 12 million ratings that companies with an F are 7.7 times more likely to be impacted by a breach versus those with an A. Australia's largest domestic and international airline, Qantas, needed a holistic security solution that would not only protect remote workers, but also support its secure access service edge (SASE) initiative. Like many large organisations, we operate in an environment of ever-evolving cyber threats, where external attackers are Only Qantas approved Users may use Qantas Information Technology systems, and must do so in accordance with the law and Qantas Policies, including the Information Technology Group Policy. 4.73 The OAIC particularly welcomes the use of multi-factor authentication and encourages QFF to continue its expansion. [4] For a current list of program partners, see the Earn Qantas Points page. 4.8 Policies are also reviewed when major legislative changes occur, such as the significant amendments to the Privacy Act that commenced in 2014. Accuweather Ulster County Ny, generate consumer insights, which may include combining personal information from third parties or public sources (for example, Census data). Risk Management Policy; 9. This includes aviation safety, WHS, environment, security (including cyber security) and business resilience matters. ICT protections, such as firewalls for segregated zones, malware detection software, whitelisting, application patching, encryption of data in transit and regular penetration testing. Wonderful video celebrating so much of who we are as Australians. 4.21 The OAIC has developed a PMP template that should assist QFF in the development of a PMP. The Group Policies apply to Qantas Group entities and employees in line with the Groups Corporate Governance Framework. You can also use The Emirates Group's CyberSecurity PGP key to encrypt sensitive information that you send by email. The CHESS has responsibility for strategy, policy, systems oversight, monitoring and corporate governance over operational risks of the Qantas Group. This anonymous identification number is used for most internal transactions relating to the members account to limit the number of staff with access to personal information. Section 1 - Summary. Possible reputational damage to the entity, such as negative publicity in local or regional media. Is Okra Good For Fibroid, Protection from these attacks and the potential financial and public reputation implications associated with unauthorised access to the information we hold is key. This is an internal control or risk management issue that if not mitigated is likely to lead to the following effects, Medium risk Entity should, as a medium priority, take steps to address Office expectations around requirements of Privacy legislation, Timely management attention is expected. Symphony Communication Services Holdings LLC. The Head of Human Resources is required to sign-off on the completion of all required training in a report to the QFF CEO. Human resource and other policies exist at entity or business unit level, which also outline the minimum expected standards for our people in the context of their employment. Learn all you how to incorporate ratings insights into workflows throughout your organization. clear knowledge of information assets held and a range of ICT security measures in place to safeguard these. This is supported by policies and procedures to ensure our people are treated fairly under what is known as just culture. The program covers both work-related and non-work-related conditions. The DISO assesses the security implications of the project and considers mitigation strategies for cyber security risks. When we receive your email, we send an automatic email acknowledgment. Request access from Qantas's to view their private documentation available on demand only. Its current APP 5 collection notification practices appear reasonable and adequate. Cyberspace and its underlying infrastructure are vulnerable to a wide range of risks stemming from both physical and cyber threats and hazards. Customer Name: Qantas. However, it is a difficult decision for Australia-based Qantas Group is set to order 12 Airbus A350-1000 planes and 40 narrowbody jets to improve services for passengers. The case management lists are checked daily by management to ensure their timely resolution. Todays business environment is characterised by rapid, unpredictable change that brings demands in responding to a variety of challenges. 4.62 Qantas privacy training underwent a large-scale review in 20132014 due to the major changes made to the Privacy Act, and at the time of the assessment, was being revised to include the Notifiable Data Breaches scheme. The Group Business Resilience Management System (GBRMS) is an integrated response and recovery system across Qantas Groups strategic, operational and tactical environments, and is subject to a variety of airline and safety standards and regulations. Security teams are able to react quickly to digital criminals, respond to Zero-Day incidents faster, and reduce the risk exposure timeline. Furthermore, marketing and analytics staff are in constant consultation with QFF Legal in relation to changes or new ideas. Contract Engagement, Review and Execution Policy; 4. [11] See paragraphs 1.15-1.32 of the APP Guidelines. Qantas suffered a 30 percent turnover in its technology personnel as the airline battles staff loss, in the wake of repeated Covid-19 lockdowns. 4.41 Qantas Group and by extension, QFF, have comprehensive risk management processes which adequately encompass the identification, recording, reporting and mitigation of privacy risks within QFF. A Group data privacy, ethics and governance function has been established to assist us to better ensure personal information is handled fairly, ethically and responsibly. "For Qantas, doing business responsibly isn't just the right thing to do it's also the smart thing to do. Qantas Frequent Flyer uses targeted marketing communications (primarily by email) to promote products and offers which may be of interest to members. 5.6 Prior to the OAIC assessment in May/June 2017, the Qantas Group was already expanding its cyber security governance processes and materials to include increased focus on privacy. Industry: Transportation. The OAIC also notes that Qantas Group intends to create a network of privacy champions, co-ordinated through the Group Privacy Officer. We may contact you using the below methods: A phone call from one of our fraud analysts. Qantas has been looking for a security head since August last year. January 24, 2017 by AJ Kumar Security policy Security policy is the statement of responsible decision makers about the protection mechanism of a company crucial physical and information assets. This commitment to security extends to our executives. The OAIC was informed that all new marketing and data analytics projects are subject to a robust in-house vetting process that involves an assessment of both cyber security and privacy risks. We take active, quality measures to help you keep safe online and we also encourage our members to do what's possible to protect their account and personal information. High risk Entity must, as a high priority, take steps to address mandatory requirements of Privacy legislation, Immediate management attention is required. 5.4 The OAIC recommends that QFF continues to build the profile of privacy across the Group by: 5.5 QFF will continue to support the expanded reach, effectiveness and reporting of the Qantas Groups new, dedicated Data Privacy team through the introduction of a network of privacy champions across all Group business units. This is an internal control or risk management issue, the solution to which may lead to improvement in the quality and/or efficiency of the entity or process being assessed. Both QFF Legal and the CIO have veto power over any and all projects. Iron Mountain Horizon, Upgrade your web browser for an enhanced experience. Possible ministerial involvement or censure (for agencies), Risks are limited, and may be within acceptable entity risk tolerance levels, Unlikely to breach relevant legislative obligations (for example, APP, TFN, Credit), Minimum compliance obligations are being met. Furthermore, it is the responsibility of each business unit to identify and report risks. 4.69 At the time of the assessment, QFF had recently undertaken a test exercise, where IT sent false phishing emails to selected QFF staff email accounts. The Prime Minister's $230 million Cyber Security Strategy The Australian Crime Commission estimates the annual cost of cyber crime to His appointment as Qantas group CISO was part of a significant revamp of the cyber security function at the airline. 8959 norma pl west hollywood ca 90069. The team selecting those aircraft has made sure we consider safety in our preparations; thinking about technology available to improve information pilots receive, to improve data the aircraft measures, aircraft performance, and to ensure that people using the aircraft (cabin crew stowing luggage, or ground crew loading bags) have a safer experience. [7] The Notifiable Data Breaches Scheme, introduced by the Privacy Amendment (Notifiable Data Breaches) Act 2017, requires organisations covered by the Australian Privacy Act 1988 (Privacy Act) to notify any individuals likely to be at risk of serious harm by a data breach. 4.83 All new marketing and analytics data uses are subject to the SIA process described above at 4.54, which includes assessment of privacy risks and a flag to complete a PIA. 3.3 Member registration is conducted online, either directly through the QFF website or through a link on a program partner website. Assessment undertaken: MayJune 2017 Draft report issued: 9/10/2018 Final report issued: 30/6/2019. The General Counsel receives weekly briefings on key issues (including privacy matters) from QFF and on an ad hoc basis as needed. The Qantas Group is constantly improving its cyber capabilities as part of its overall data and privacy protection. 4.71 During the assessment, the OAIC was advised of the security controls applied to QFFs systems. We comply with government and regulatory agencies to integrate risk strategies through a holistic approach ensuring a robust framework is in place to counter any crisis management, contingency planning and business continuity event. As QFF is a popular loyalty program with a large member base, the OAIC conducted a privacy assessment of QFF in 2017. By continuing to use this system you confirm your acceptance of the above. Due to this assessments scope, the OAIC did not consider most of these controls in detail. Together with our government and industry partners, some of the key security improvements in FY22 were: Like most industries, the aviation sector is dependent on data, systems and networks and we take our customers trust in the security of their personal data seriously. 4.93 QFF uses the Qantas Group-wide privacy policy, also referred to as the Group privacy statement. 4.54 All new projects require a security impact assessment (SIA), and staff have access to the relevant form on the Qantas Intranet. The Corporate segment provides centralized management and governance. That is, our observations and opinions are only applicable to the time period during which the assessment was undertaken. 4.91 The purpose of APP 1 is to ensure that APP entities manage personal information in an open and transparent way (APP 1.1). New Restaurants In Perrysburg Ohio, Londons Heathrow airport last year outlined plans for a 50m project to implement Qantas urges govt to chip in for cyber incident interventions Law 'may not achieve objective without funding'. 4.64 Privacy training is compulsory for all staff with access to personal information, which includes Qantas call-centre staff, reservations staff and the entirety of QFF. The aviation industry continues to face complex threats from individuals and organisations globally. 4.20 At the time of the assessment, QFF did not have an overall policy document for meeting its goals for managing privacy. Qantas Frequent Flyer and Qantas could also consider using graphics, videos and other digital formats as a way of clearly communicating to its members how it handles personal information. The Main Types of Security Policies in Cybersecurity. We encourage our people to report safety and security-related matters, even when they are closely involved and might feel vulnerable to criticism. 2.3 In the 2014/2015 financial year, the OAIC assessed two leading loyalty programs in Australia. It identifies specific, measurable privacy goals and targets and sets out how an entity will implement the four steps outlined in the OAICs Privacy management framework and meet its goals for managing privacy. 4.99 APP 5 requires APP entities that collect personal information about an individual to take reasonable steps either to notify the individual of certain matters (listed in APP 5.2) or to ensure the individual is aware of those matters. Cyber Security Policy; 5. The OAIC recommends that QFF continues to build the profile of privacy across the Group by: 4.36 QFF follows the Qantas Group risk management practices, policies and procedures. Together, they fulfil an important requirement of APP 1.2 to implement practices, procedures and systems that ensure compliance with the APPs, as recommended in the OAICs Privacy management framework. ProStarSolar > Blog Classic > Uncategorized > qantas group cyber security policy. CHESS also has oversight of risks associated with regulatory compliance. This notice is located at the bottom of the QFF online registration form, just before members are asked to accept the terms and conditions and provide payment information. Enjoy a choice of fares to match your customers budget in Economy, Premium Economy, Business and First; with flexible conditions unique to group travel. 4.15 The majority of corrections to personal information are completed by members themselves using the self-service facilities online, however, corrections may also be processed by telephone via an interactive voice system (where the member keys in their PIN) or manually via the QFF Service Centre (QFFSC) staff. These include the Qantas privacy statement (APP 1 privacy policy) and risk management policies, which are discussed separately later in this report. enable the entity to deal with privacy related inquiries or complaints from individuals. During the pandemic, our Wellbeing program expanded from a focus on traditional areas of health and wellbeing physical health, nutrition, sleep, exercise and mental health to include financial wellbeing, healthy relationships and digital wellbeing. Marketing campaigns are sent to different member lists. Our commitment to a healthy, safe and secure environment for our people and customers. 4.66 As a part of Qantas financial and corporate governance reporting requirements, the Group Audit Team regularly checks the QFF training logs, which are managed by the Qantas Human Resources Department. With the assistance of the Qantas Group Cyber Security Centre, the website was detected not long after it was built and we have worked with the internet service provider to take it down. QFF, as a business unit, would have the opportunity to share its learnings, as well as to learn from the experiences of other business units. 4.32 Whilst QFF has numerous governance mechanisms and structures in place to facilitate privacy management, the OAIC notes that there are no specific, dedicated privacy roles within Qantas or QFF (with the exception of the recently appointed Group Privacy Officer). Security Policy. Former IHS Markits group chief information security officer, Darren Argyle, has been appointed ongoing CISO at the airline, with his tenure as its cyber security chief to begin later this month.. Argyle was appointed to the CISO role after a recruitment process that began last year as part of a cyber security strategy revamp.. Qantas in December appointed a new But it might still face a legal storm if its policy is tested before a tribunal or court. These are some of the factors we use to calculate the overall score: Discover open access points, insecure or misconfigured SSL certificates, or database vulnerabilities. We are at the forefront of improving security outcomes for customers and employees by operating within a security framework that is proportionate, agile and responsive to changing threats and risks across our network. The visibility gained from these assessments provides insight that helps guide high-level cybersecurity decisions, making them a valuable asset for organizations of all sizes. 4.47 QFF maintains a cyber incident register, which includes data breaches and online fraud. Matt Biber has been working as a Group of Qantas Cyber Security Centre Head (Gcsc) at Qantas for 8 years. The OAIC recommends that QFF develops and implements a PMP that sets out specific goals and objectives for its privacy management with consideration of the specific issues that apply to its operations. Flexible Fare options. Cyber Security Policy; 5. The Group is keenly aware of the risk posed by trusted insiders people who seek to use privileged access provided in the context for doing their jobs to facilitate illegal activities, such as transporting illicit substances. 4.94 The OAIC reviewed this privacy policy against the requirements of APP 1. 4.23 QFF Legal has primary responsibility for advising QFF on privacy compliance matters. Number of Employees: 25,000. Please refer to Qantas Group Policies available on the Qantas Intranet or from your manager or people representative for details. Automated reminders are sent to staff who have not completed their mandated refresher or induction training, and to their managers. We take active, quality measures to help you keep safe online and we also encourage our members to do what's possible to protect their account and personal information. In the matter of the Australian Securities and Investments Commission v RI Advice Group Pty Ltd [2022] FCA 496, the Court found that a financial services provider had breached its licence obligations, and failed to act efficiently or fairly by not having in place adequate risk management systems to cater for risks arising in relation to cyber security. Specifically, the assessment examined whether: 6.4 Where the OAIC identified privacy risks and considered those risks to be high or medium risks, according to OAIC guidance, the OAIC made recommendations to QFF about how to address those risks. 4.17 The OAIC noted that one of the documents contained outdated references to the NPPs that was based on an older OAIC document that was updated in 2014. IT Security Specialist, Security Officer, Security Engineer and more on Indeed.com Cyber Security Jobs in Sydney Western Suburbs NSW (with Salaries) 2022 | Indeed.com Australia To comply with our legal obligations and for health, safety and security purposes: to ensure the safety and security of all passengers, including investigating security and screening issues and to take appropriate steps to prioritise the health of those passengers and our crew. 4.33 A network of privacy champions across business units within the Qantas Group, including a dedicated QFF privacy champion, would help to identify and communicate privacy risks, as well as good privacy practices, across the Group. These controls include: 4.72 Overall, QFF has established robust ICT and user access policies, procedures and practices governing the security of personal information. The legal team confirms any material advice given as part of these hallway discussions via email. 6.2 The objective of the assessment was to examine whether personal information collected by QFF is handled in accordance with the Privacy Act. However, one current exception is QFFs partnership with Woolworths, as Woolworths Everyday Rewards (WER) members may opt-in to earn Qantas Points as their reward under the WER program, automatically converting WER points they earn when shopping at Woolworths into Qantas Points.