Enhancing Cyber Security Measures Against Advanced Persistent Threats
Abstract
The advancement of cyber security and technology offers a vital benefit for business. Modern Banking increasingly relies on the Internet and computer technologies to operate their businesses and market interactions. Banks are on the way of using up-to-date technologies to increase efficiency and effectiveness in service delivery. However, these benefits do not come without risks for information being misused, service disrupted or any other attacks interrupting the normal operation of computer based cyber systems. The threats and security breaches are highly increasing in recent years globally. Nigerian case is not an exception.
The main objective of this study is to propose and develop a workable Cyber security measures in banking sector. In this work, attempts were made to examine and compare the available cyber security frameworks and best practices. This research combines ISO audit checklists and expert experiences to assess the cyber security system practices in the banking industry.
By applying a mixed research method approach the study assesses the existing practices, process and challenges of the selected banks cyber security issues and proposed cyber security audit framework which is workable for the Nigerian banking industry. The framework is constructed from two basic pillars. The first is the requirement identification mechanism which is further broken into ERM (Entity Relation Model) and organizational & process models. The second one is the counter measure which focuses on the organizational policy, procedure, guideline, and controls. Finally, the researchers proposed a workable framework that can assist the industry from cyber-attacks.
The framework has both practical and theoretical contributions to the industry at large and for researchers for further similar efforts.
Keywords: Cyber Security, Cyber security measures, Cyber security measures, Security Threats, and Security controls.
CHAPTER ONE
INTRODUCTION
Background of the Study
Cyber security (CS) is, basically, the process of ensuring the safety of cyberspace from known and unknown threats. The International Telecommunication Union states that cyber security is the collective application of strategies, security measures, plans, threats administration tactics, engagements, training, paramount practices, and assurance and expertise that can be used to guard the cyber system, organization and related assets [18]. Cyber security (CS) is important because government, military, corporate, financial, and health organizations collect, process, and store unprecedented amounts of data on computers and other devices. A significant portion of that data can be sensitive information, whether that is intellectual property, financial data, personal information, or other types of data for which unauthorized access or exposure could have negative consequences [25]. For an effective cyber security, an organization needs to coordinate its efforts throughout its entire cyber system .Security counter measures help ensure the confidentiality, availability, and integrity of cyber systems by preventing asset losses from cyber security attacks [8]. Effects of cyber security failure leads to the loss of intellectual property, direct financial loss from cybercrime, loss of sensitive business information, sabotage of operations, extra costs for systems’ recovery, stakeholders loss of on system confidence.
Cyber security measures (CSA) is an independent review and examination of system records, activities and related documents. These auditing are intended to improve the level of cyber security, avoid improper cyber security designs, and optimize the efficiency of the security safeguards and security processes. It is a systematic, measurable technical assessment of how security policies are built into the cyber systems and it is part of every successful cyber security management [26].
The major challenge in cyber Security in banking industry is the knowledge gap about the holistic approach of cyber security management, Due to this, most security requirements are derived by the external bodies than the Bank’s management. Even though security measures are technical, physical and human, Banks concentrate on the technical security measures only in order to comply with the external requirements. This situation creates bad security culture in most of the bank industry [22].
Some of the challenges in banking industry are numerous and inherently diverse. A traditional approach in addressing these challenges includes the use of technical controls to treat risks. While technical controls are helpful in protecting valued assets, unfortunately, technical controls alone are insufficient in providing reliable security. Thus, Global outsourcing, consumer-centricity, security compliance and legislation as emerging global business drivers have imposed new security requirements that complicate traditional perspective of cyber security [4].
Literature in the area of cyber security shows that security culture is still in its early stages of development especially in developing countries. Thus, the establishment of an organizational cyber security culture is necessary for effective cyber security [22].
Nigerian IT capacities are still at a developmental phase and are immature in relation to leading western technologically developed countries. In addition, the business environment of Nigerian is different from the business environment in the USA and other Western countries [22]
Cyber Security Framework (CSF) is a set of industry standards and best practices to help organizations manage cyber security risks. It is basically, a blueprint for building a cyber-security program to manage risk and reduce vulnerabilities. The Framework enables organizations – regardless of size, degree of cyber security risk, or cyber security sophistication – to apply the principles and best practices of risk management to improve the security and resilience of critical infrastructure. [25].
Cyber-attack involves the malicious application of information and communication technology either as a target or as a device by several malicious actors. Cyber security could also refer to the security of internet, computer networks, electronic systems and other devices from the cyber-attacks.
Research in Nigeria indicates that, there is lack of cyber security measures and practice. For instance the research done in the investigation of the state of cybercrime in Nigeria by taking 40 institutions from Financial Organization of Nigeria found that all respondents experienced a number of cybercrime incidents, Computer viruses, worms, malware, or other malicious attacks (57.1 %), website defacement (40%), illegal access (17.1%), and spam (14.7%) were the most frequently penetrated cybercrimes against the organizations. The respondents also indicated a range of infrequently occurring cybercrimes such as causing damage to computer data (62.9%), denial of service (DOS) (45.7%), and system interference (45.7%). Overall, the survey results demonstrate that cybercrime is a legitimate problem in Nigeria. When one takes into account institutions’ lack of capability regarding cybercrime detection, it is valid to presume that cybercrime in Nigeria is more prevalent than what is revealed in this survey. A majority of the respondents (77.1%) also said that they do not have any organizational structure specifically dedicated to dealing with cybercrime threats. Only 8.6% of the institutions (four banks) have specialized teams responsible for cyber security incidents. These results demonstrate that cyber security governance is neglected by the majority of the institutions involved in the survey. The results may indicate that institutions as a whole are ill-prepared to deal with cybercrime [12].
This research work propose a workable cyber security audit framework that can be used to guide the banking industry by , assessing the current practice, and challenges, which at the end helps the banking industry as guideline for cyber security measures process of the industry.
Statement of the Problem
IT plays a vital role in modern banking industry across the world. The banking industry in Nigeria is one of the rapidly growing sectors of the country’s economy. In addition, the banking service has also dramatically changed from manual operation to the technology supported system which then brought the industry and customers to national and global presence anywhere-anytime banking. The banking business competition has motivated the advancement of services enabled by IT which in turn increased the cyber security risk. These threats to data’s and information can include purposeful attacks, environmental disruptions, and human or machine errors and result in great harm to the national and economic security interests of the country [29].
Most of the Nigerian bank industries face challenges with regard to the governance of cyber security resources mobilization process across all. Most researchers also indicate that there need rigorous research for the proper security enhancement mechanism through designing a guide line that can support the task of security protection.
According to [42], most of the Nigerian Bank industries are also challenged in managing their ICT resource .This industries in Nigeria lacks security policy document, security protection manual documents. The researcher also identified that most of the banks don’t conduct any cyber security awareness and training for their staff. He concluded that the capability and readiness of Nigerian government organizations to perform cyber security audits is extremely low.
Nigerian banking system is still underdeveloped compared to the rest of the world regarding electronic payment, internet banking, telephone banking, online shopping etc. Such systems are at an embryonic or infant stage. The reason for this weak or evolutionary development is being numerous, the main one that is cited by different scholar is security threats or poor implementation of cyber security in the country [18] [37] Currently, for banking industry there is no cyber security standards provided and there is no clear guidance regarding what would constitute an acceptable minimum baseline body of cyber security knowledge for end users in the country [18].
The preliminary literature survey shows organizations in Nigeria are at different level of understanding and acting with regard to security auditing and various threat mitigation. There is no standard format to conduct a cyber-security audit framework by the regulatory body and to follow up the work done by other external parties in case of outsourcing cyber security audit framework task to the third parties[18].
In addition, from my preliminary investigation it was revealed that many banks have invested on IT security devices as part of CORE Banking Solution project. However, managing these IT security devices may be challenging since they do not have overall or comprehensive cyber security framework which serve as a guide to develop and implement their own cyber security measures based on their own requirement in line with the valid national cyber security policy, besides lack of skilled manpower, security management resources and finance [15].
Research Questions
The study intended to address the following research questions:
- What are the existing practices and processes of cyber security measures, techniques, standards and tools used in Nigerian banking sector
- What are the major challenges that the Nigerian banking sector are facing on cyber security
- What framework can support Nigerian banking industries to perform effective cyber security measures and ensure that cyber resources are well protected?
Objective of the Study
General Objective
The general objective of this study is proposing a cyber-security auditing framework that enables bank industries to perform effective and efficient cyber security measures.
Specific Objectives
The specific objective of the research included:
- assess the existing practices and process of cyber security measures systems and the methods and techniques used in selected Nigerian banks
- identify variations in cyber security systems and process and major causes of their
- identify the predominant problems that impedes the cyber security measures process in the banking sector in
- assess different cyber security frameworks which are done by different scholars across the world.
- propose a cyber-security auditing framework that can address the current challenges and, standardize the process of cyber security management, this can be applied in Nigerian bank
- validate the framework based on the actual environment
Scope of the Study
The scope of this research mainly focuses on proposing a workable cyber security measures that can serve as guideline for banking sector in Nigerian to overcome cyber security risks by focusing on the existing practices, challenges, methods, techniques currently applied in Nigerian banking sectors.
Significance of the Study
The researcher believes that this study has the following significance for different parties. These are:
- The study shall serve as a guideline for developing and implementing cyber security measures in banking industry in
- It enables all banks to have a common cyber security framework in
- It adds a new way of thinking in the existing body of
- It also serves for practitioners and researchers to conduct more comprehensive research in cyber security
Limitation of the Study
The result of the research would be more comprehensive if it covers the entire Banks and their branches in Nigeria. However, due to time constraints the researcher only focused on headquarters of selected banks.
Organization of the Thesis
This study is organized in six chapters. These are:
Chapter One: focuses on the background of the study, statement of problem, objectives and significant of the study.
Chapter Two: is the literature on cyber security, Auditing activities and implication process, Cyber security measures standards (CSAS), and Tools, Cyber security Audit Frameworks, Basic criteria to assess cyber security audit readiness, and presented for further description of the research area. Related works are presented.
Chapter Three: this chapter presented research design and methodology which includes general insight on the existing research methods, Selection of sample for the study, data collection techniques, and data analysis methods was stated clearly.
Chapter four: is where the data collected through questionnaire, interview, and document collection was analyzed and presented. And the findings from the analysis were discussed, interpreted and summarization was made as related to the research problems statement.
Chapter five: focus on conclusions, recommendations and future works of the study.
References
- Tan, M.T.K. and Hall, W. Beyond Theoretical and Methodological Pluralism in Interpretive IS Research: The Example of Symbolic Interactions Ethnography, Communications of the Association of Information Systems, 19(1), (2008).
- . Tarimo, C. N. “ICT Security Readiness Checklist for Developing Countries, Stockholm; Department of computer and Systems Science, Stockholm university, 2006
- T and Robert K., “Intrusion Detection and Information Security Audit, IGI Global, 2007, retrieved from http: // www.hiltbrand.net/docs/auditing.pdf,Last accessed on December 01, 2012.
- Venkatesh, V., Brown, S. A., & Bala, H. Bridging the qualitative-quantitative divide: Guidelines for conducting mixed methods research in information systems.MIS quarterly, 37(1), 21-54. (2013)
- Wikipedia free encyclopedia, http: // en.wekipedia.org/wiki/wikipedia:free encyclopedia.
- B, “Information System Security Audit readiness in case of Nigerian government organizations. 2011, retrieved from http: // www.spidercenter.org/sites/defult/files/master- thesessponsoret/Ms-thesis-jorro.pdf.lastaccesses on July 2012.
IF YOU CAN'T FIND YOUR TOPIC, CLICK HERE TO HIRE A WRITER»
