Australian Government Architecture Reference Models Version 3.0

198
7.6 Security and Privacy
Security and privacy considerations apply to all three of the DRM’s standardisation areas. Security defines the
methods of protecting information and information systems from unauthorised access, use, disclosure,
disruption, modification or destruction in order to provide integrity, confidentiality and availability, whether in
storage or in transit. Privacy addresses the acceptable collection, storage, use and disclosure of information, and
its accuracy.
The DRM allows for the integration of existing Australian Government information security and privacy policies
within each of its standardisation areas. The table below describes several sets of security policies and
legislation that are applicable to the DRM.
Policy/Legislation Description
Australian Government
Information Security Manual
(ISM, formerly ACSI 33)
Privacy Act 1988
(Commonwealth)
Australian Government Architecture Reference Models Version 3.0
Developed by the Defence Signals Directorate (DSD) to provide
policies and guidance to Australian Government agencies on how to
protect their ICT systems.
Commonwealth and ACT government agencies must comply with 11
Information Privacy Principles which are set out at section 14 of the
Privacy Act 1988 (Cth). These are based on the 1980 OECD
guidelines governing the protection of privacy and transborder flows of
personal data.
Archives Act Commonwealth agencies must comply with National Archives Act
Protective Security Policy
Framework (PSPF)
Commonwealth agencies must comply with the PSPF.
An institutional process that includes roles and responsibilities for data stewardship for each project or program
in the agency needs to be defined as part of a policy that governs data quality, security and privacy.
There are a number of areas that should be addressed in building such a policy. These include:
� constructing a policy that is compliant with legislation and standards
� addressing sensitivity of information that eliminates possible compromise of sources and methods of
information collection and analysis
� establishing the practices of data stewardship
� addressing specific data access policies defined by the responsible steward, for example:
o data is available for open, unrestricted access
o data is accessible only to a defined group of persons or organisations
o data access is dependent on the identity of the accessing person, data about that person (e.g.
current position) and data about the environment (e.g. physical location)
o data is self-protecting through digital rights management 21 or similar technologies.
The successful categorising, describing and sharing of data are dependent on the implementation of security
regarding the data being exchanged. Security and privacy requirements must be considered at each level of the
DRM and, in particular, regarding the sharing of data. The DRM is designed to allow for the integration of existing
Australian Government information security policies and privacy legislation within each of its standardisation
areas.
21 Digital Rights Management is also abbreviated DRM. Hence, the reader should be aware of context when this abbreviation is encountered.