A Stratified Cyber Security Vigilance Model for Corporate Information Technology Infrastructure
Abstract/ Overview
Cyberspace is a relatively new unavoidable battlefield for most organizations- businesses governments, security agencies, learning and research institutions, political parties, terrorist groups and many others. As a result of mass exodus to online systems, concepts like e- commerce, e-government, e-learning, e-health, e-procurement, e-mail, mobile money have become part of our day to day lives. So almost everybody is enthusiastically going on line, most of whom are lured or tantalized by real or imagined strategic advantage that comes with strong online presence but oblivious of the grave dangers that lurk in the cyberspace. Most of these players go online with limited security controls in place, largely devoid of vigilance mechanisms, making it difficult for them to detect, and control risks to their Information Systems in good time. Moreover, in order to implement Information Systems security in an organization, there is need for a well-designed and executed security program based on a sound cyber security model. Consequently, this study proposed a Stratified Cyber Security Vigilance (SCSV) model designed to secure an organizations network infrastructure. The model was developed after considering the strengths and weaknesses of existing computer security models, using information elicited from relevant theories and frameworks. The specific objectives of the study were to assess the existing Information System Security models and identify their strengths and weaknesses; to develop a SCSV model for corporate Information Technology infrastructure; to conduct test experiments by implementing the SCSV model in a corporate Information Technolog infrastructure and collect data for analysis; and finally, to validate the SCSV model by analyzing the data collected in the network fashioned after the model. The study adopted experimental research approach guided by descriptive and diagnostic research design. The model developed from theory was implemented in a computer network infrastructure in terms of security controls. Different levels of vigilance were achieved by deploying various layers of security controls at different times during the research- representing different phases of the experiment. During this experiment period, in-situ data was collected from the network of Cyber-Class International University. Quantitative data was collected using Cyberoam CR300iNG UTM appliance and Nmap scanning tool. The study considered a population of 12,386 comprising of teaching staff, non-teaching staff and students. Sampling technique applied was census. Data was analyzed using Cyberoam UTM reporting tools, MS Excel 2010 to get descriptive statistics and graphs were used to present data since vigilance is a function of observation and detection of stimulus events over time. The results showed that adoption of SCSV model in a computer network and ERP system improved its security in terms of timely and accurate detection and control of threats and vulnerabilities, increased level of availability of Internet bandwidth, optimized utilization of Internet bandwidth and improved the process of design and re-engineering of information systems. The study recommends adoption of SCSV model in security administration of corporate Information Technology infrastructures in order to enhance security. Future research can be done on application of vigilance in security of the software development process and other aspects of Information Technology not considered in this study.