3.8 QFF stores data in a separate, partitioned section of the Qantas Group IT Environment. QFF also has contractual rights to audit the third party and the QFF information they hold throughout the course of the relationship. The GCSC also monitors, reviews and enhances the compliance of all cyber risk management systems, policies and procedures, protocols and controls with all relevant laws and regulations. 1.1 This report outlines the findings of an assessment of the Qantas Frequent Flyer (QFF) program undertaken by the Office of the Australian Information Commissioner (OAIC). Oct 2016 - Present6 years 4 months. Qantas group security head Steve Jackson has some simple rules for dealing with IT security: Dont panic, dont overstate the risk, and Section 1 - Summary. Cyberspace and its underlying infrastructure are vulnerable to a wide range of risks stemming from both physical and cyber threats and hazards. We remain committed to minimising the risk of workplace injuries, including those associated with mental health risks. Cha c sn phm trong gi hng. QFF Legal reports to the Qantas Group General Counsel, who has ultimate responsibility for all privacy compliance matters in the Qantas Group. [8] The European Union General Data Protection Regulation (the GDPR), which commenced 25 May 2018, contains new data protection requirements. However, they are only provided with de-identified data, and strong contractual protections are put in place against re-identification or use of data other than as stipulated. 4.98 The OAIC considers that there is room for improvement in the readability of the policy, and suggests that QFF works with the Qantas Group to review and, where possible, simplify the language of the policy. Security impact assessments explain and compare the value of the project in conjunction with any associated security risks, including privacy risks. This plan encompasses all business units of the Qantas Group, including QFF, and is co-ordinated by the Group Crisis Management Team. 4.96 In our review, the OAIC found that the Qantas privacy policy meets the prescriptive requirements of APP 1.4. In addition, Jetstars head of cyber security Yvette Lejins started a broader Group role at Qantas this month as the head of cyber business RAAF Base Curtin to see $244m upgrade; Bonza bound for Tamworth with flights from Melbourne, Sunshine Coast; Podcast: How Lockheed Martin On 2 July 2019, we became aware of a fraudulent website that looked like the Qantas Super login page and used a similar website address. All SIAs are recorded in the system and can be recalled or examined as needed. Additionally, at the time of the assessment, QFF was conducting a multi-factor authentication pilot with selected members. The Qantas Group Security Management System aims to increase security awareness through continuous improvement of security processes and enhancing the security culture across the Group (Qantas Sustainability Review, 2015). QFF provides reasonable and adequate notifications to users of its services (QFF members) when collecting personal information (APP 5). The safety and wellbeing of our customers and people is our highest priority. Heres why. However, given that only one document was affected and that QFF staff demonstrated a strong understanding of Qantas information handling and management practices, including thorough PIA processes that do not heavily rely on this document (see Privacy impact assessments and security impact assessments below), the OAIC regards this as a low privacy risk for QFF. As the Security Technology Controller, you will be accountable for day to day operational activities across the physical security team including access, surveillance and alarm monitoring services with a focus on Qantas Group ASIC program compliance. By Darren Argyle, Group Chief Information Security Officer, Qantas Cybersecurity is moving from having purely technical relevance to increasingly societal relevance, affecting the way we live our lives and honour our obligations. Your cyber security policy doesn't need to be very long; most SMEs should be able to fit theirs onto a single sheet of paper. In ever-increasing times of uncertainty, the resilience of an organisation plays a significant role in effectively meeting market demands and supporting the delivery of strategy. Like many large organisations, we operate in an environment of ever-evolving cyber threats, where external attackers are Only Qantas approved Users may use Qantas Information Technology systems, and must do so in accordance with the law and Qantas Policies, including the Information Technology Group Policy. 5.6 Prior to the OAIC assessment in May/June 2017, the Qantas Group was already expanding its cyber security governance processes and materials to include increased focus on privacy. "Qantas Frequent Flyer uses security protocols to protect our members' accounts, including multi factor authentication, to minimise the impact, if their travel data is accessed or lost by third parties." PDF Operating Responsibly and Transparently - Qantas Qantas Groups policies and business practices over the next 12 months. 4.31 Compliance with APP 1.2 is fundamentally about good privacy governance. Privacy complaints and compliance issues are handled by the corporate liaison team, who receive regular privacy training. We have rigorous security measures in place, as well as security teams working to protect our customers details and accounts. These risk management processes allow an entity to identify, assess, treat and monitor privacy risks related to its activities. A data breach will trigger a crisis response, the extent of which depends on the nature and severity of the breach. 4.56 The findings of a SIA may determine whether or not a new project will go ahead. January 24, 2017 by AJ Kumar Security policy Security policy is the statement of responsible decision makers about the protection mechanism of a company crucial physical and information assets. Villanova University Salary Bands, Environment Policy; 6. simplifies the notice to enhance readability, changes the title from important information to something that indicates to potential members that the notice relates to the collection of their personal information. Report a cyber security incident for critical infrastructure Get alerts on new threats Alert Service Become an ACSC partner Report a cybercrime or cyber security incident About the A Qantas Boeing 787-9 at Brisbane Airport. The OAIC guidance on the GDPR may be found at Australian entities and the EU General Data Protection Regulation (GDPR). 4.7 A Qantas Group policy registry is kept by the Company Secretariat for all Qantas Group policies. 4.76 In relation to the use of personal information for marketing and analytics purposes, QFFs APP 1 privacy policy and collection notice state that members personal information may be used to: 4.77 Potentially sensitive information gathered by the airline, such as meal preferences and medical conditions, is not used by, or accessible to, the QFF marketing and analytics teams. Possible ministerial involvement or censure (for agencies), Risks are limited, and may be within acceptable entity risk tolerance levels, Unlikely to breach relevant legislative obligations (for example, APP, TFN, Credit), Minimum compliance obligations are being met. 4.10 Whilst all QFF personal information is stored in Australia, QFF use several offshore customer service centres. QFF utilises this document in conjunction with a number of its own risk management documents and strategies. 4.19 A PMP assists with embedding a culture of privacy that enables privacy compliance. snoopy happy dance emoji Matt Biber's email & phone | Qantas's Manager, Qantas Group Cyber 4.74 Qantas Frequent Flyer applies data analytic techniques, and then uses this data for targeted advertising and marketing. Wonderful video celebrating so much of who we are as Australians. Qantas appoints new CISO - CIO Qantas Customer Story. Is Okra Good For Fibroid, Contester Contravention Repentigny, The need for shared vigilance on cyber issues is supported by formal recognition of employees who help detect attempted cyber scams. -Adam Kinsella, Product Owner for Network, Network Security, Qantas. Swot Analysis Of Qantas Group - 1205 Words | Bartleby In addition, Jetstar's head of cyber security Yvette Lejins started a broader Group role at Qantas this month as the head of 'cyber business protect', which covers the Jetstar Group, Qantas . To do this, they must give Woolworths their QFF membership number so that Woolworths can arrange for the Qantas Points to be awarded. 4.14 Requests to access personal information and privacy queries are also handled through the Customer Care Centre. Additionally, the OAIC noted that the notice is labelled important information, which does not indicate what the notice is, or its purpose. blue shield of northeastern ny customer service number qantas group cyber security policy. Matt Biber has been working as a Group of Qantas Cyber Security Centre Head (Gcsc) at Qantas for 8 years. name, email address, phone number). Assessment undertaken: MayJune 2017 Draft report issued: 9/10/2018 Final report issued: 30/6/2019. [10], 4.95 APP 1.4 contains a prescriptive list of information that an APP entity must include in its privacy policy,[11] as well as a list of other information that could be included, depending on the circumstances of the entity, to describe how the entity manages personal information.[12]. When you're managing the travel needs of multiple people, we understand the size of the group can often change. Cyber security for Qantas Frequent Flyer accounts The COVID-19 pandemic presented many challenges to our organisation and our people to work through. Qantas Domestic has a growing margin advantage over competitors, with a brand, network and product offering targeted at business and premium leisure customers who value Qantas has joined other sectors in asking the government to at least partially cover the cost of complying with proposed laws aimed at better defending the countrys critical infrastructure networks and systems from cyber attacks. The ability to respond seamlessly to events that impact the Group is fundamentally important in ensuring continued Group operations in the event of a discontinuity of service, mitigating risks and minimising disruptions to our customers. At the time, the airline said its new cyber security chief would identify and lead programs to "monitor the emergence of new threats and vulnerabilities, assess business impacts, and drive rapid responses to cyber security events." 4.39 The QFF CEO is ultimately responsible for business risks (including privacy risks), and the QFF finance manager has responsibility for the QFF risk profile. This includes aviation safety, WHS, environment, security (including cyber security) and business resilience matters. The OAIC has not identified any privacy risks based on the assessment scope and the above-mentioned observations. CHESS also has oversight of risks associated with regulatory compliance. Privacy related matters will also be raised during short stand-up meetings, where staff consult each other or offer suggestions on different matters and projects. [7] The Notifiable Data Breaches Scheme, introduced by the Privacy Amendment (Notifiable Data Breaches) Act 2017, requires organisations covered by the Australian Privacy Act 1988 (Privacy Act) to notify any individuals likely to be at risk of serious harm by a data breach. continues to build the profile of privacy across the Group by: continuing with the implementation of the Qantas Group network of privacy champions to assist with the coordination of privacy matters across business units and reporting of these issues to senior management. 4.45 The crisis management plan encompasses identification and notification, assessment and response. View Finall.docx from BX 3011 at James Cook University. We brought grounded aircraft back into service, our employees came back to work after being stood down, and we opened or reopened flying to ports that we had not flown to in over a year and to some that had not seen an aircraft in that time. Get Qantas Airways Ltd (QAN-AU:ASX) real-time stock quotes, news, price and financial information from CNBC. The more we rely on technology to collect, store and manage information, the more vulnerable we become to severe security breaches. We are continually working to expand employee awareness of evolving data security risks, including through no notice simulations and structured training. Australian businesses of any size may need to comply if they have an establishment in the EU, if they offer goods and services in the EU, or if they monitor the behaviour of individuals in the EU. High risk Entity must, as a high priority, take steps to address mandatory requirements of Privacy legislation, Immediate management attention is required. Like many large organisations, we operate in an environment of ever-evolving cyber threats, where external attackers are always adopting more sophisticated techniques. 4.60 The OAIC suggests that all informal privacy and other risk assessments be recorded in some form, such as email or file notes, and stored in an accessible location for relevant staff to access. The shark tank proceedings are not recorded. qantas group cyber security policy Members are required to undergo a telephone identity check and staff follow a security procedure and checklist to guide them through the process. 4.53 Formal PIAs are generally only undertaken for major projects. Cyber security risk is, at the practical level, the responsibility of the QFF DISO. 3.7 Members personal information continues to be collected at various points throughout their membership, including when they earn and redeem Qantas Points and Status Credits,[6] and when they interact with QFF marketing campaigns. 8959 norma pl west hollywood ca 90069. Understand the effectiveness of protections in place for laptops, desktops, mobile devices, and all employee devices that access that companys network. As part of the membership to the program, the entity operating the loyalty program can collect data about members and their purchasing activities. Qantas keeps relationship with various regional carriers. This commitment to security extends to our executives. He is currently in the role of Group Chief Information Security Risk Officer at Standard Chartered Bank, based in Singapore with a global scope. 7 Essential Cybersecurity Risk Assessment Tools - SecurityScorecard If a privacy complaint must be escalated, the corporate liaison manager reports the complaint to the Customer Care Manager who then reports it to Group Legal. 6.7 The OAIC conducted a risk-based assessment of QFF and focused on identifying privacy risks to the effective handling of personal information in accordance with privacy legislation. 4.78 As stated above, QFF holds all personal information in data warehouses, with highly restricted access. 4.57 New projects may also be subject to meetings known as shark tanks. 4.12 All customer complaints, including QFF privacy complaints, are managed through a case management system, which enables staff to monitor all complaints received and their status. Paula Searle - Qantas Group Cyber Security Awareness and - LinkedIn clear knowledge of information assets held and a range of ICT security measures in place to safeguard these. Safety | Qantas US TPG Telecom announced on Tuesday it has picked up a five-year deal to handle fixed and mobile voice services for Qantas. Though the extent of involvement may vary by role, security is everybodys responsibility at Workday. QFFSC staff verify a customers identity before assisting the member with their query, including making any corrections. The OAIC recommends that QFF develops and implements a PMP that sets out specific goals and objectives for its privacy management with consideration of the specific issues that apply to its operations. TH: A strong, consistent commitment to the vision and strategies for the Qantas group from our senior leadership team, and strong support for all initiatives in alignment with the vision. Competitive quotes in real time. Enhanced security measures for the smaller regional (domestic) cargo shipments in accordance with new Australian requirements. Combining the expenditure of both domestic and international tourists who travel on Qantas and Jetstar, the additional total value added to the Australian economy associated with the role of the Qantas Group in facilitating tourism in FY 2017 is estimated to be $10.7 billion. The notice refers members to the Qantas privacy policy for further information. Socio-cultural. IAPP Asia Advisory Board Member & Singapore Chapter Co-Chair, DPO & Privacy Program Manager, International SOS RAAF Base Curtin to see $244m upgrade; Bonza bound for Tamworth with flights from Melbourne, Sunshine Coast; Podcast: How Lockheed Martin 10.Security Policy. "For Qantas, doing business responsibly isn't just the right thing to do it's also the smart thing to do. The Qantas Groups FY21 performance for Total Recordable Injury Frequency Rate and Lost Work Case Frequency Rate both improved compared to the prior year. Cybersecurity 'gaps' exposed by hacks, paper says - as it happened The Qantas Group online Privacy Statement includes a link to a feedback form that is pre-populated to classify the matter as privacy related. The time taken to resolve complaints depends on their complexity. These emails are provided on an opt-out basis, so members can change or cancel the different types of marketing materials that they receive from QFF. The OAIC recommends that QFF continues to build the profile of privacy across the Group by: 4.36 QFF follows the Qantas Group risk management practices, policies and procedures. Qantas Airways Limited ABN 16 009 661 901. Additionally, the DISO sends a monthly cyber update email to QFF staff to reiterate the importance of good privacy practices and current threats. Each members profile is assigned an anonymous identification number that is unrelated to their membership number. It may also be updated on an ad hoc basis as needed, for example, following key personnel changes. 3.9 QFF is governed by and subject to Qantas Group policies. We encourage our people to report safety and security-related matters, even when they are closely involved and might feel vulnerable to criticism. Hilary Jackson on LinkedIn: It's an exciting time to join Qantas, as (Rob Finlayson) The Qantas Group has updated its flight cancellation policy, as it gears up for The Qantas Group is constantly improving its cyber capabilities as part of its overall data and privacy protection. 4.13 Qantas has target timeframes for response due dates, including for privacy complaints. 4.94 The OAIC reviewed this privacy policy against the requirements of APP 1. qantas group cyber security policy - spokenwordoutreach.org Furthermore, it is the responsibility of each business unit to identify and report risks. Therefore, the OAIC recommends that QFF, along with Qantas, formalises the current cyber security governance material, such as the GCSC charter documents, to specifically encompass privacy. 4.2 The key findings of the QFF assessment are set out below under the following headings: 4.3 The OAIC has applied its guide, Privacy management framework: enabling compliance and encouraging good practice, to its consideration of the reasonable steps that QFF has taken to address the requirements of APP 1.2. Make sure your good security posture has a presence on your website: show it off and share the news by adding a Badge from SecurityScorecard. Furthermore, crises are reviewed after resolution to determine the cause of the incident and whether it was preventable. If a query relates to a QFF membership, then the call is referred to the QFF specific customer care team. The recent increase in oil prices has been a threat for the aviation sector's success. 4.9 The OAIC noted that one document contained references to the National Privacy Principles (NPPs), which were replaced by the APPs in March 2014. The security chief said foreign spy agencies posed a major threat to the privacy of the 40 million passengers flying Qantas each year. Across the Group, we are responsible for handling a substantial amount of personal information. Safely returning to the skies: During the pandemic Qantas had to ground the majority of our fleet. 6.2 The objective of the assessment was to examine whether personal information collected by QFF is handled in accordance with the Privacy Act. Qantas Group Policies The Qantas Group has a set of 10 Group Policies, which reflect the Non-Negotiable Business Principles and outline the minimum expected standards across a range of governance areas where compliance is necessary for legal reasons and to protect our brands and reputation. 4.41 Qantas Group and by extension, QFF, have comprehensive risk management processes which adequately encompass the identification, recording, reporting and mitigation of privacy risks within QFF. Iron Mountain Horizon, 4.16 The OAIC noted a strong awareness of privacy and information security issues through its review of relevant QFF policy and procedure documents and interviews with staff. Once a SIA is formally underway, its progress is generally informal and collaborative, and may involve the project owner, the DISO, Legal, and any other relevant business units.