Assessment of the Effectiveness of Non-Technical Approach to Cyber Security Management for NLIMS System in the Ministry of Lands and Physical Planning, in Kenya

Abstract

The study determined whether NLIMS has adequately addressed the social aspect of their information security system. The study was conducted at Ministry of Land and Physical Planning Headquarters in Nairobi. The study adopted descriptive research design, and utilized stratified sampling technique to select respondents. Close-ended questionnaires were used to collect quantitative on social engineering cyber threats. Results indicated that 70% of staff using NLIMS system lack knowledge about social engineering attacks, their conduct, weaknesses, and the skills necessary to prevent or stop cyber threats. The findings further indicated that the 70% of Ministry of Lands’ staff use insecure methods to dispose waste that may contain information that could be used to launch an attack. This lack of attention to secure waste disposal puts NLIMS at risk of accessing sensitive information through dumb star diving. Unauthorized personnel can easily access information on staff computers or working desks through shoulder surfing. Workstation privacy is compromised by workstation resource sharing policies, allowing malicious staff to exploit them. Over 60% of staff lack proper social engineering awareness. Further, lower rank staff accesses information they are not authorized to access through the workstation resource sharing policy. The non-technical aspect of information security at KMLPP towards NLIMS has weaknesses, impairing the overall effectiveness of the security. This study establishes, as a key take away, that despite global awareness, less attention is given to the social aspect of cyber security despite being labelled the major weakness in any information security system. The study concludes that holistic approach, technical and non-technical aspects in KMLPP's use of secure waste disposal methods, such as shredding and burning, is essential for effective management of non-technical vulnerabilities. This study recommends that KMLPP on NLIMS should pay more attention to workstation privacy, secure waste disposal and educating staff on cyber security awareness.