qantas group cyber security policy

We have rigorous security measures in place, as well as security teams working to protect our customers details and accounts. provide and operate competitions, promotions and events, distribute newsletters and other communications either directly or through a third party, facilitate participation in Qantas and program partner loyalty programs, conduct marketing activities for Qantas or third party products and services (the collection notice states that this is one of the primary purposes of QFF), conduct market and other research to improve Qantas products, services and marketing activities. Cyber Security Graduate jobs now available in Greystanes NSW 2145. 4.4 The OAIC also considered its APP Guidelines, which outline the mandatory requirements of the APPs, how the OAIC will interpret the APPs and matters the OAIC may take into account when exercising functions and powers under the Privacy Act, in the privacy analysis below. If you're booking a group of 10 or more, or have 20 or more passengers travelling to the same destination for a common purpose, Qantas Group Travel has you covered. Login. The OAIC is of the view that the clarification and formalisation of the existing cybersecurity arrangements to explicitly include privacy would adequately provide good privacy governance. The Group has a structured employee wellbeing and mental health program which has the dual focus of understanding and protecting our people from wellbeing and mental health-related risks, along with amplifying the opportunities for our work to positively impact on our wellbeing and mental health. 6.3 The scope of this assessment was limited to the consideration of QFFs handling of personal information against the requirements of APP 1 (open and transparent management of personal information) and APP 5 (notification of collection of personal information). Qantas Customer Story. This process is documented in a Qantas privacy procedure document, which is a high-level internal document that sets out broad privacy obligations. At the time of the assessment, the staff on the GCSC were raising privacy issues. Doniz served as Qantas group CIO from January 2017, and at Boeing will the CIO and senior VP of information technology and data analytics. Cyber Security Policy; 5. The OAIC recommends QFF works with Qantas to continue with the Group-wide implementation of a network of privacy champions, including a dedicated champion within QFF. IT Security Specialist, Security Supervisor, Information Security Analyst and more on Indeed.com Cadetship, Cyber Security Jobs in Sydney NSW (with Salaries) 2022 | Indeed.com Australia All employees receive security, privacy, and compliance training the moment they start. [11] See paragraphs 1.15-1.32 of the APP Guidelines. The Qantas Group Security Management System aims to increase security awareness through continuous improvement of security processes and enhancing the security culture across the Group (Qantas Sustainability Review, 2015). The communications are then matched to member personal information by a separate team. The card is posted to the members nominated postal address. 4.10 Whilst all QFF personal information is stored in Australia, QFF use several offshore customer service centres. Protection from these attacks and the QFF also has contractual rights to audit the third party and the QFF information they hold throughout the course of the relationship. We pay our respects to the people, the cultures and the elders past, present and emerging. Complaints files are assigned priorities, which determine team allocation and due date for response. Furthermore, marketing and analytics staff are in constant consultation with QFF Legal in relation to changes or new ideas. The shark tank proceedings are not recorded. This correlates to the need for a PMP (discussed earlier at 4.18-4.21), which would include the establishment of these privacy governance arrangements as part of its privacy goals as well as their ongoing evaluation. January 24, 2017 by AJ Kumar Security policy Security policy is the statement of responsible decision makers about the protection mechanism of a company crucial physical and information assets. Qantas works closely with the Australian Government and overseas agencies, regulators, law enforcement and its global partners across the industry to proactively monitor and manage threats and risks. Qantas Group Policies The Qantas Group has a set of 10 Group Policies, which reflect the Non-Negotiable Business Principles and outline the minimum expected standards across a range of governance areas where compliance is necessary for legal reasons and to protect our brands and reputation. 4.42 However, in view of the complexity of Qantas current risk management structure and framework, the OAIC suggests that QFF: 4.43 The Qantas Group has a co-ordinated Group-wide approach to crisis management, which includes a crisis management plan. Jenks High School Football Roster, The DISO may also determine that a more comprehensive security review or a formal PIA is needed. Checking of all contractors and third parties (such as vendors), including security maturity testing, prior to selection and engagement. We ensure the safety and welfare of our people, the protection of our reputation and the maintenance of critical services. QFF sometimes utilises independent third parties to conduct external PIAs, however, the majority are conducted informally and in-house, and are built into its project management processes. 5.6 Prior to the OAIC assessment in May/June 2017, the Qantas Group was already expanding its cyber security governance processes and materials to include increased focus on privacy. We encourage our people to report safety and security-related matters, even when they are closely involved and might feel vulnerable to criticism. Safe growth: The Qantas Group has announced orders for a range of new aircraft. It will compile threat forecasts and geopolitical assessments for airline safety/security committees, up to Board level, and will lead the Qantas Londons Heathrow airport last year outlined plans for a 50m project to implement The Qantas Group continues to support key external initiatives under the Australian Governments Cyber Security Strategy, the voluntary ASX100 Cyber Health Check,and joint Commonwealth and private sector meetings, including the inaugural AustraliaUnited States Cyber Security Dialogue to discuss ways to collaborate on better security outcomes. rockhaven homes jonesboro, ga; regular mail or courier citizenship application Qantas hiring Manager Aircraft Controlled Software and EDTO in Millers Accuweather Ulster County Ny, Cyberspace and its underlying infrastructure are vulnerable to a wide range of risks stemming from both physical and cyber threats and hazards. Qantas Group declared at its recent investor day that it had made a significant investment in cyber security systems and capability. Though the extent of involvement may vary by role, security is everybodys responsibility at Workday. 2.3 In the 2014/2015 financial year, the OAIC assessed two leading loyalty programs in Australia. We acknowledge the traditional custodians of Australia and their continuing connection to land, sea and community. CHESS also has oversight of risks associated with regulatory compliance. This includes aviation safety, WHS, environment, security (including cyber security) and business resilience matters. 6.7 The OAIC conducted a risk-based assessment of QFF and focused on identifying privacy risks to the effective handling of personal information in accordance with privacy legislation. 7 2022. qantas group cyber security policythe renaissance apartments chicago. 4.75 At registration, QFF collects members personal information as well as other voluntary information about preferences for food and drink, finance and other products or services that a member is interested in. A data breach will trigger a crisis response, the extent of which depends on the nature and severity of the breach. 4.34 The OAIC notes that the charter document for the GCSC primarily focuses on cyber risks and their management and does not specifically refer to privacy. 4.92 Under APP 1.3, APP entities must have a clearly expressed and up to date APP privacy policy that explains the entitys handling of personal information. Risk assessments are conducted on relevant third party suppliers and we work with them to address any material risks identified. Villanova University Salary Bands, However, given that only one document was affected and that QFF staff demonstrated a strong understanding of Qantas information handling and management practices, including thorough PIA processes that do not heavily rely on this document (see Privacy impact assessments and security impact assessments below), the OAIC regards this as a low privacy risk for QFF. Additionally, there are contractual terms in place, which stipulate that only QFF may contact its members in relation to a program partner. The Prime Minister's $230 million Cyber Security Strategy The Australian Crime Commission estimates the annual cost of cyber crime to His appointment as Qantas group CISO was part of a significant revamp of the cyber security function at the airline. Specific complaints handling processes are embedded in the complaints handling system. The CHESS has responsibility for strategy, policy, systems oversight, monitoring and corporate governance over operational risks of the Qantas Group. Cyber risk ratings influence business activity from the loading dock to the board room. Defines Victoria Universitys high-level information security requirements based on the ISO 27001:2013 standard, NIST Cybersecurity Framework and other industry best practices, enabling the University to minimize information security risk and efficiently respond to incidents. Qantas Cyber Security Rating & Vendor Risk Report | SecurityScorecard As the Security Technology Controller, you will be accountable for day to day operational activities across the physical security team including access, surveillance and alarm monitoring services with a focus on Qantas Group ASIC program compliance. The Group is committed to raising awareness of our privacy compliance obligations and to manage our privacy risk by implementing a culture that considers privacy by design as a default position when handling personal information. However, without this practice being reflected in the documentation underpinning the GCSC, there is a medium risk that the Qantas Group and QFF may not discuss or consider privacy issues, especially where there is a change of personnel sitting on the GCSC. The Corporate segment provides centralized management and governance. 4.33 A network of privacy champions across business units within the Qantas Group, including a dedicated QFF privacy champion, would help to identify and communicate privacy risks, as well as good privacy practices, across the Group. The Group is keenly aware of the risk posed by trusted insiders people who seek to use privileged access provided in the context for doing their jobs to facilitate illegal activities, such as transporting illicit substances. The Qantas Groups FY21 performance for Total Recordable Injury Frequency Rate and Lost Work Case Frequency Rate both improved compared to the prior year. It is the responsibility of New York State Office of Information Technology Services (ITS) to provide centralized IT services to the State and its governmental entities with the awareness that our citizens are reliant on those services. 4.2 The key findings of the QFF assessment are set out below under the following headings: 4.3 The OAIC has applied its guide, Privacy management framework: enabling compliance and encouraging good practice, to its consideration of the reasonable steps that QFF has taken to address the requirements of APP 1.2. Qantas Risk Assessment Report COLLEGE OF BUSINESS, LAW & GOVERNANCE GROUP TASK COVER SHEET Subject code: BX3011 Subject title: Company Furthermore, human resource and other policies exist at entity or business unit level, which also outline the minimum expected standards for our people in the context of their employment. Case Studies - Qantas Customer Story. 6.2 The objective of the assessment was to examine whether personal information collected by QFF is handled in accordance with the Privacy Act. The team selecting those aircraft has made sure we consider safety in our preparations; thinking about technology available to improve information pilots receive, to improve data the aircraft measures, aircraft performance, and to ensure that people using the aircraft (cabin crew stowing luggage, or ground crew loading bags) have a safer experience. fieldwork, which included interviewing key members of staff and reviewing further documentation, at the QFF offices in Mascot on 25 May and 1 June 2017. He is currently in the role of Group Chief Information Security Risk Officer at Standard Chartered Bank, based in Singapore with a global scope. Over the past year, the return of domestic and international travel as borders reopened required a similar program of work to return our aircraft to the skies, including a focus on training for crew and support employees. The OAIC has not identified any privacy risks based on the assessment scope and the above-mentioned observations. Our approach covers three main areas: operational safety, people safety and operational security. As part of this review, the OAIC applied a Flesch-Kincaid test to provide a general indication of the complexity and readability of the policy. 4.80 Qantas Frequent Flyer does not permit access to, or disclosure of, members personal information to any of its program partners and is solely responsible for all communication with its members in relation to program partner products and benefits. Member accounts are also bundled into segments based on these preferences, which dictates the type of marketing material QFF will send to them. Due to this assessments scope, the OAIC did not consider most of these controls in detail. We take active, quality measures to help you keep safe online and we also encourage our members to do what's possible to protect their account and personal information. The cyber safety of Qantas Frequent Flyers is a priority for us. This is known as the crown jewels directory, and is owned by the QFF DISO. Code of Conduct and Ethics; 2. Business Resilience Policy; 3. (1) This Policy: Defines Victoria Universitys high-level information security requirements based on the ISO 27001:2013 standard, NIST Cybersecurity Framework and other industry best practices, enabling the University to minimize information security risk and efficiently respond to incidents. Your use of these systems may be monitored and investigated to ensure compliance with the law and Qantas Policies. QFF utilises this document in conjunction with a number of its own risk management documents and strategies. What your policy needs to cover. [9] Where data analytics involves personal information, entities must ensure they are complying with the requirements of the Privacy Act. timeless ink and piercing studio; how to make someone want to move out; how long does heparin stay in your system. All or part of an assessment report may be withheld from publication due to statutory secrecy provisions, privacy, confidentiality, security or privilege. snoopy happy dance emoji The GCSC also monitors, reviews and enhances the compliance of all cyber risk management systems, policies and procedures, protocols and controls with all relevant laws and regulations. 5.1 The OAIC recommends that QFF develops and implements a Privacy Management Plan that sets out specific goals and objectives for its privacy management with consideration of the specific issues that apply to its operations. Sydney, Australia. How to access Australian Government information, Privacy management framework: enabling compliance and encouraging good practice, Privacy impact assessments and security impact assessments, Guide to undertaking privacy impact assessments, De-identification Decision-Making Framework, Guide to Data Analytics and the Australian Privacy Principles. Assessment undertaken: MayJune 2017 Draft report issued: 9/10/2018 Final report issued: 30/6/2019. Request access from Qantas's to view their private documentation available on demand only. Our governance | Qantas AU 5.3 QFF is working with Qantas to develop a Privacy Management Plan to augment its well-established privacy policies and procedures. 3.2 QFF is a points-based rewards program and members may earn Qantas Points by purchasing products and services from Qantas or any of its program partners. The case management lists are checked daily by management to ensure their timely resolution. How do you quantify cyber risk management? 4.21 The OAIC has developed a PMP template that should assist QFF in the development of a PMP. 4.101 The OAIC found that the QFF collection notice meets the requirements of APP 5, and that it refers readers to the Qantas privacy policy for further information. Qantas Frequent Flyer uses targeted marketing communications (primarily by email) to promote products and offers which may be of interest to members. 3.3 Member registration is conducted online, either directly through the QFF website or through a link on a program partner website. Last month, a group of 24 Qantas workers filed legal action against Qantas in the Federal Court, arguing that the airlines mandatory COVID-19 Across the Qantas Group, we collect, share, use, store and process personal information in accordance with an ever-changing and increasingly complex landscape of both international and domestic laws and regulations. Qantas will operate Airbus A350-1000s flights from Australia to other international cities. This enhances the accountability of APP entities in relation to their personal information handling practices. Case Study on 'Qantas Airlines' Management Report (Assessment) This is supported by policies and procedures to ensure our people are treated fairly under what is known as just culture. Join to connect Qantas. The OAIC recommended that QFF: 2.1 Loyalty programs are popular with consumers and businesses alike, with one Australian consumer research study reporting that 87 percent of Australians aged 18 and older were members of a loyalty program in 2017. Our Supporting Fitness for Work program is designed to help manage health-based risks in the operational environment, and to support employees more generally through injury or illness, including accommodating disability and diversity when there is a health component. 4.57 New projects may also be subject to meetings known as shark tanks. QFFSC staff verify a customers identity before assisting the member with their query, including making any corrections. Qantas Group also holds monthly direct reporting meetings, and risk is a regular agenda item. QFF, as a business unit, would have the opportunity to share its learnings, as well as to learn from the experiences of other business units. It operates through five segments: Qantas Domestic, Qantas International, Jetstar Group, Qantas Loyalty, and Corporate. These lists are derived from mailing lists that members subscribe to in the my profile section of their QFF account and those that are designed and created using de-identified information linked to the anonymous identification number. (Opens your email client) . 4.67 QFF staff are also required to undertake mandatory risk management and cyber security training. 4.70 The OAIC considers QFF to have an adequate and effective privacy training regime and suggests that it regularly reviews its training to ensure that it remains effective and appropriate. QFF regards personal information as its chief business asset and has invested multiple resources to safeguard it. Cybersecurity 'gaps' exposed by hacks, paper says - as it happened This may lead to the loss of vital information regarding identified privacy risks. If the staff member attempts the training but does not receive a 100% pass rate, training is not marked as completed and the online training system will continue to remind the staff member to complete the training. Due to the investments made in resilience, the capability continues to be strengthened through the successful integration of external stakeholders ensuring the Group continues to possess a sophisticated holistic response and recovery system. These controls include: 4.72 Overall, QFF has established robust ICT and user access policies, procedures and practices governing the security of personal information. This button displays the currently selected search type. toby o'brien raytheon salary. Maintaining a regularly updated directory of all of the information assets (including personal information) held by QFF, and where these are stored. In 2020, security breaches cost businesses an average of $3.86 million, but the cost of individual incidents varied significantly. If a query relates to a QFF membership, then the call is referred to the QFF specific customer care team. Qantas Frequent Flyer then uses this and other information collected at various points throughout their membership, including when members earn and redeem Qantas Points and their interactions with marketing campaigns, to analyse member behaviours and identify target members for marketing campaigns. Location: Mascot, Australia. When you're managing the travel needs of multiple people, we understand the size of the group can often change. Upgrade my browser. generate consumer insights, which may include combining personal information from third parties or public sources (for example, Census data). The recent increase in oil prices has been a threat for the aviation sector's success. 4.91 The purpose of APP 1 is to ensure that APP entities manage personal information in an open and transparent way (APP 1.1). Qantas EpiQure,[5] Qantas Money, etc). Crisis response is heavily reinforced in staff training and practice exercises, and involves staff at all levels, including the executive. QFF advised that this trial was being expanded and QFF would eventually roll out multi-factor authentication to all members. A select team within QFF have sole access to QFF member information (e.g. Design, develop, deliver and measure ongoing risk aligned Group (Qantas, Jetstar and Loyalty) Cyber Safety Awareness Campaigns to raise Qantas Group employees' cyber awareness, uplift their cyber capability and embed a Cyber Safety culture throughout the Qantas Group, incorporating . Weve overcome many obstacles in our long history and this is because weve quickly responded to changing environments and worked hard to produce the right outcome helped by the resilience of our people and their commitment to the national carrier. The Cyber Cooperation Program and Singapores Ministry of Transport has partnered with the Association of Asia-Pacific Airlines, Qantas Group and EY to support the Aviation Cyber Resilience Project, a series of workshops aimed at building cyber capacity in the aviation industry throughout the Asia-Pacific. 3.4 Registration involves collecting a variety of personal information from individuals, including: 3.5 Following registration, members receive a membership number, confirmation email, and a membership pack including a QFF card. How can I be sure my Frequent Flyer account details are secure? 4.93 QFF uses the Qantas Group-wide privacy policy, also referred to as the Group privacy statement. Her remit will cover group-wide technology projects as well as Qantas' loyalty business. With the assistance of the Qantas Group Cyber Security Centre, the website was detected not long after it was built and we have worked with the internet service provider to take it down. We may contact you using the below methods: A phone call from one of our fraud analysts. Like many large organisations, we operate in an environment of ever-evolving cyber threats, where external attackers are always adopting more sophisticated techniques. Safety and Health Policy; and 10. The OAIC recommends that QFF continues to build the profile of privacy across the Group by: 4.36 QFF follows the Qantas Group risk management practices, policies and procedures. We may use your personal information for the following purposes: Qantas Groups policies and business practices over the next 12 months. How We Use Your Personal Information. 4.71 During the assessment, the OAIC was advised of the security controls applied to QFFs systems. Read about our approach to risk management. The Group Management Committee has steadfastly supported the change we needed to make, despite the many challenges we face in the aviation industry. During the pandemic, our Wellbeing program expanded from a focus on traditional areas of health and wellbeing physical health, nutrition, sleep, exercise and mental health to include financial wellbeing, healthy relationships and digital wellbeing. QFF Legal reports to the Qantas Group General Counsel, who has ultimate responsibility for all privacy compliance matters in the Qantas Group. Spoiler alert: SecurityScorecard customers realize investment payback in under a quarter. The Group Business Resilience Management System (GBRMS) is an integrated response and recovery system across Qantas Groups strategic, operational and tactical environments, and is subject to a variety of airline and safety standards and regulations. An Introduction to cybersecurity policy | Infosec Resources This privacy champions network will result in Qantas training staff to perform this key privacy role in each business unit to coordinate privacy matters across the different business units and report these issues to senior management. However, based on practices at the time of the assessment, there is a medium risk that privacy issues from the various business units will not be communicated effectively through the existing channels. This means that the policy may be too complex for some readers, who are younger or who have a lower literacy level, to understand, and this could affect some QFF members. Leading International Airline, Qantas, Embarks on Its SASE Journey - Cisco A Group data privacy, ethics and governance function has been established to assist us to better ensure personal information is handled fairly, ethically and responsibly. Where privacy complaints are received outside of this process (including by phone or by mail), a file/record is created in the complaints handling system. The OAIC guidance on the GDPR may be found at Australian entities and the EU General Data Protection Regulation (GDPR). Incident notifications may come from a variety of channels. 4.69 At the time of the assessment, QFF had recently undertaken a test exercise, where IT sent false phishing emails to selected QFF staff email accounts. I have a proven track record of leadership and performance in a range of strategic cyber security, risk, compliance and finance roles while working in the UK, Canada, India and Australia. Past crises are often used in staff training. November 3, 2021. [1] These programs reward individuals for their purchases and engagement via points, credit and other benefits. Further detail on this approach is provided in Chapter 7 of the OAICs Guide to privacy regulatory action. We monitor global developments in governance, laws and business practices, and work collaboratively across our global footprint to ensure we continue to meet these standards. Marketing campaigns are sent to different member lists. 4.61 The OAIC has published the Guide to undertaking privacy impact assessments, which may be of assistance to QFF in considering future PIAs. Cyber fraud techniques evolve into confidence trick arms race. Likely breach of relevant legislative obligations (for example, APP, TFN, Credit) or not likely to meet significant requirements of a specific obligation (for example, an enforceable undertaking), Likely adverse or negative impact upon the handling of individuals personal information, Likely violation of entity policies or procedures. Both the General Counsel and CEO sit on the Group Management Committee (GMC), with the General Counsel reporting to the GMC on privacy. QFF requires two-factor authentication for making changes to member accounts. Together, they fulfil an important requirement of APP 1.2 to implement practices, procedures and systems that ensure compliance with the APPs, as recommended in the OAICs Privacy management framework. 3.1 QFF was established in 1987, and had over 11.4 million members in June 2016. 4.88 Additionally, given the amount of personal information that QFF handles and the extent of its use in marketing and data analytics projects (whether in identified or de-identified forms), the OAIC also suggests that QFF continue to monitor and assess the risks of these projects as they progress, including any risk surrounding re-identification or the creation of new data sets. 4.14 Requests to access personal information and privacy queries are also handled through the Customer Care Centre. We are at the forefront of improving security outcomes for customers and employees by operating within a security framework that is proportionate, agile and responsive to changing threats and risks across our network. QFF anticipated that the next such large-scale change would occur in 2018 to reflect the commencement of both the Notifiable Data Breaches Scheme[7] and the European Union General Data Protection Regulation (GDPR).