The intention of this investigation was to evaluate the status of cyber security in the metropolitan municipalities in South Africa. A substantive theory of integrated development cyber-security emerged from the Constructivist Grounded Theory Methodology processes of data collection through comprehensive interviews, initial coding, focused coding, memoing and theoretical coding.
DEMONSTRATION OF HOW THE INTEGRATED DEVELOPMENT
INTEGRATED DEVELOPMENT CYBER-SECURITY THEORY (IDCT)
CHAPTER 7 AN INSTRUMENT TO ASSESS CYBER-SECURITY 155
THE METROPOLITAN MUNICIPALITY CYBER-SECURITY
CHAPTER 8 PROCESS FOR ASSESSING CYBER-SECURITY STATUS 190
List of Tables
List of Abbreviations
RESEARCH INTRODUCTION AND BACKGROUND
- CHAPTER INTRODUCTION
- RESEARCH BACKGROUND
- RESEARCH PROBLEM
- RESEARCH QUESTION
- RESEARCH OBJECTIVES
- RESEARCH RATIONALE
- THEORETICAL FRAMEWORK
- RESEARCH SCOPE
- TERMINOLOGY USED
- Cyber-security
- Information infrastructure
- Critical information infrastructure
- Assessing cyber-security status
- THESIS OUTLINE
- CHAPTER SUMMARY
What methodologies are currently available to assess the cyber security status in South Africa's metropolitan municipalities? Developing a theory that explains the implementation of cyber security in South Africa's metropolitan municipalities.
LITERATURE REVIEW
CHAPTER INTRODUCTION
A national understanding at the level of municipalities is necessary for the strengthening and promotion of the NCPF objectives. Due to the lack of a framework for assessing municipal cyber security capacity, the national remedial package and debate may be ineffective, if it remains merely at the level of theoretical abstraction.
VARIOUS VIEWS ON CYBER-SECURITY
5 NLD is the protection of ICT against risks of abuse, destruction or disruption 6 IND is the protection of information systems, networks and information. 7 GBR is the protection of national interests in the use of cyber space and the wider implementation of national security policy.
INTERNATIONAL ORGANISATIONS ON CYBER-SECURITY 1. The International Organization for Standardization (ISO)
- International Telecommunication Union (ITU)
- Organisation for Economic Co-operation and Development (OECD)
- The European Network of Information Security Agency (ENISA)
- The African Union Convention on Cyber Crime and Personal Data Protection
Cybersecurity definitions vary and the term is widely used (Craigen, Diakun-Thibault, & Purse, 2014). Member States are required to establish a national cyber security framework that includes a national cyber security policy and a national cyber security strategy.
SOUTH AFRICAN NATIONAL CYBER-SECURITY POLICY FRAMEWORK (NCPF)
The NCPF has recognized that there is currently no coordinated approach to dealing with cyber security issues, despite various structures being established to deal with these issues (Phahlamohlaka, Jansen van Vuuren, & Coetzee, 2011). The development of cyber security research is promoted by the NCPF to promote and strengthen cyber security research within South African tertiary institutions, industry and the Department of Science and Technology (Mahlobo, 2015).
CRITICAL INFORMATION INFRASTRUCTURE
KIs mainly perform their functions with the support of IT and industrial control systems, and as a result of this reliance on IT and ICS interconnectivity, there is an increased potential for cyber vulnerability and risk exposure. Municipal critical information infrastructure considerations include strategies for securing and mitigating critical systems, including virtual and physical systems and assets.
IT systems support and improve the services and information received from critical information infrastructures of municipalities, the protection and security of which are municipal responsibilities and therefore should have high priority. It is estimated that Stuxnet was developed by more than four people over five months with access to SCADA systems (Chen, 2010) indicating the manpower required to develop this worm (Matrosov et al., 2010).
DIFFERENCES BETWEEN IT SECURITY AND CYBER-SECURITY Safeguarding the industrial control systems is different from the safeguarding of IT systems
IT systems' new software is often not rigorously tested for compatibility with the IT system. Consequently, the security measures that are acceptable in IT systems may not necessarily be the same for ICSs.
CURRENT RESEARCH PERSPECTIVES ON CYBER-SECURITY IN SOUTH AFRICA
- National cyber-security in South Africa
- Fostering a cyber-security culture: A case of South Africa
- Cyber-security awareness initiatives in South Africa: A synergy approach One of the top cyber-crime types reported in South Africa is phishing attacks and the country
- An e-safety educational framework in South Africa
South Africa aims to promote a cyber security culture which is envisaged to advance the national cyber security policy framework. The volatility and dynamism of cyberspace warrants robust research in the area of cyber security in South Africa (Van Vuuren, Leenen & Zaaiman, 2014).
SOUTH AFRICAN CYBER-SECURITY STATISTICS
It has been recognized that a multi-layered structure of key stakeholders exists in the cyber security environment and that the responsibilities and roles overlap more often than not. The picture that is clearly articulated in the report is related to the lack of the necessary capacity to systematically implement cyber security strategy in the country.
LOCAL GOVERNMENT LEGISLATIVE FRAMEWORK IN SOUTH AFRICA
- Constitution of the Republic of South Africa
- The Municipal Finance Management Act, No.56 of 2003
- Municipal Systems Act, no 32 of 2000 (MSA)
- Local government: Municipal Structures Act 117 of 1998
- Definition of a metropolitan municipality in South Africa
The Municipal Finance Management Act (MFMA) is the cornerstone of local government reform and aims to provide a framework for financial management to maximize the capacity of municipalities to deliver embedded services. Cyber security breaches can be one of the serious risks that can negatively affect the municipality to provide some of these basic services.
CHAPTER SUMMARY
The Facilities Act requires municipalities in the country to prepare a Comprehensive Development Plan (CRP), which is a strategic planning document for municipalities (RSA, 1998). Finally, there was a speech on the legal framework of the RSA on local self-government, where the constitution, MFMA, MSA and the Structures Act were presented.
RESEARCH DESIGN AND METHODOLOGY
CHAPTER INTRODUCTION
PHILOSOPHICAL WORLDVIEWS
- Positivist/post-positivist worldview
- Constructivist worldview
- Pragmatic worldview
The questions the researcher asks in the study and the approach used to find solutions to those questions are influenced by the researcher's worldview (Morgan, 2007). JUSTIFICATION FOR CHOOSING A CONSTRUCTIVIST WORLDVIEW In conducting the research, the researcher aims to develop theory through the process of data.
JUSTIFICATION FOR CHOOSING CONSTRUCTIVIST WORLDVIEW In executing the study, the researcher aims to develop theory through the process of data
GROUNDED THEORY METHODOLOGY (GTM)
- Classic grounded theory methodology overview
- Straussian grounded theory methodology overview
- Constructivist grounded theory overview
- Rationale for adopting ConGTM
It is therefore important for the researcher to make known the specific perspective applied in the study. At the beginning of GT, the researcher moves from inductive logic to abductive reasoning. The researcher is not an observer in the analysis of research data, but an active participant.
STUDY POPULATION
During the research process, the researcher can create and see a direct link connecting data and conceptual categories. Constructivist grounded theory considers broader environmental and contextual factors that influence the phenomenon under study. It is recognized that the broad goal of all grounded theory approaches is theory generation.
DATA COLLECTION
The positivist principle of a neutral observer, as advocated by Glaser and Strauss, appeared problematic for the researcher's beliefs, which align with social constructivist ontology. The researcher was able to ask for more details during the interview process as he could probe back and forth on an issue being discussed as important points emerged and could ask for more clarification (Charmaz, 2006). During the interview process, the researcher participated in the content of what the respondents alluded to as the researcher and the participants were active participants in the data collection.
THEORETICAL SAMPLING
The choice was motivated by the fact that the researcher is a resident of this municipality and therefore collecting data was not expensive because little travel was involved. The researcher used understandable and correct language, communicated clearly and let the participant know how the interview was progressing, built a bond with the participant and showed respect for the participant as a person. Emergent categories form the basis of theoretical sampling and, as a result, the researcher cannot anticipate where theoretical research will lead them.
DATA ANALYSIS
- Coding data
- Memo writing
- Theoretical saturation
Theoretical saturation occurs when collecting more data does not provide further insight into the properties of the theoretical category. Theoretical saturation is when the researcher reaches a point where no additional information or new concepts are emerging from the new data being collected. Theoretical saturation is a situation where all research concerns are clear and the theoretical framework does not change or improve at all.
CREDIBILITY, ORIGINALITY, RESONANCE AND USEFULNESS
Has your research provided enough evidence for your claims to allow the reader to make an independent assessment – and agree with your claims?”. Have you drawn connections between larger 'collectives' or institutions and individual lives, if the data suggests so. Does your grounded theory make sense to your interviewees or people who have the same circumstances.
GROUNDED THEORY GUIDELINES FOR IS STUDIES
This recommendation recommends increasing the amount of abstraction and categories of connections through iterative conceptualization. It promotes the development of theory that is truly data-driven, thus ensuring the integrity of emerging theory. Scaling up This recommendation advocates a solution to what is believed to be a common grounded theory problem, ie.
CHAPTER SUMMARY
It involves repeatedly associating instances of data labeled as a particular class with other instances of data in the same classification. This recommendation helps the researcher to relate the emergent theory to other theories in the similar field. Putting the 'theory' back into grounded theory: Guidelines for grounded theory studies in information systems.
EMPIRICAL STUDY
- CHAPTER INTRODUCTION
- THE STUDY SITE
- RESEARCH PARTICIPANTS
- RESEARCH DESIGN AND DATA COLLECTION The road map of the enquiry design adopted is outlined in Figure 4.2
- Ethical review and approval
- Data collection
- The two coding processes
Municipal mandate and authority to deliver services
A competent workforce is at the heart of the provision of efficient and quality services in the municipality. Continuity risk, if it materializes, results in the municipality not being able to provide services to the municipal community. The municipality has set up an executive committee (Exco), which is the municipality's main committee.
Utilisation of process control systems in service delivery
In order to strengthen administrative management, the municipality has incorporated risk insurance in an effort to provide efficient and effective service delivery. This committee also advises the Ex on the risk management and governance process the municipality has put in place to achieve organizational goals and mandates. ICT systems such as e-mail, internet system and business resource planning systems are examples of support systems in the municipality.
Information security
Strong leadership at the business unit level has a positive influence on the cyber security culture in the municipality. Management reporting to various structures and committees also positively influences the culture of cyber security in the municipality. The positive culture can provide valuable insight into the municipality's readiness to manage cyber security.
Cyber-security Technical Operations Category 1: Cyber-security Governance
Human Issues in Cyber-security
Integrated Development Cyber-security
- Theoretical coding
- CHAPTER SUMMARY
Cyber security strategy is an important element to address the cyber security challenges in the municipality.
THE EMERGENT THEORY
- CHAPTER INTRODUCTION
- HOW THE THEORY EMERGED
- THE CORE CONSTRUCT
- THE THEORY CONSTRUCTS
- DEMONSTRATION OF HOW THE INTEGRATED DEVELOPMENT CYBER-SECURITY THEORY WORKS
- INTEGRATED DEVELOPMENT CYBER-SECURITY THEORY (IDCT) EVALUATION
- CHAPTER SUMMARY
The ConGTM revealed this latent topic, with the dependent variable called Integrated development cyber-security. The cyber security management domain ensures that cyber security is in the strategic risk management agenda. The human issues in the cyber security category involve individual employees who operate the information infrastructure in the municipality.
MUNICIPAL CYBER-SECURITY FRAMEWORK
- CHAPTER INTRODUCTION
- Strategy development relates to the development of a municipal-wide cyber-security strategy, allocation of implementation structures across municipal sectors, and an
- Organisation of cyber-security efforts relates to the formation and maintenance of an overarching programme for cyber-security coordination, including authorit y
- Research and development entails continuous exploration of how best to safeguard information infrastructure against cyber-threats. Research and development is driven
- Cyber-security steering committee is a technical competent body that has no executive authority but advises management on the current trends, best practices, and
- Domain 1: Cyber-security governance
- Cyber-security assurance entails providing an independent guarantee that the controls that management has implemented are working as intended to achieve the
- Oversight committees are the governance structures within the municipality that strengthen accountability through monitoring and evaluation. Examples include the
- IT governance refers to executive management’s processes that delineate how the organisation directs and controls technology use and information infrastruc t ure
- Corporate governance is defined to mean setting and steering strategic direction of the organisation through ensuring accountability, development of policies, and
- Domain 2: Cyber-security technical operations
- Cyber-security tools and technologies refer to the actual deployment of technologies and methodologies that are intended to provide information infrastructure protection
- Information infrastructure certification entails meeting international and or national standards related to a specific information infrastructure. It also involves
- Cyber-security monitoring and evaluation refers to systems that have been implemented to ascertain that the tools and technologies deployed to safeguard
- International standards and industry best practices involve accredited institut io ns that provide guidelines on the implementation of information infrastructures protection
- Catalogue of critical information infrastructure is a list of all critical informa t io n infrastructures in the municipality. The information infrastructures become critical
- Information infrastructure asset management relates to the identification of these assets and keeping an inventory thereof. Maintaining the asset inventory assists
- Contingency planning and procedures relate to proactively preparing for the unforeseen eventualities that have the potential of disrupting the normal
- Independent auditing on information infrastructures entails assessing the controls design, and operational effectiveness of the controls that are implemented to achieve
- Allocation of resources involves scheduling and assigning resources according to the operational requirements to operate a particular information infrastructure. Some
- Programme performance management involves setting targets and operational plans against which to measure performance. Achieving optimum security requires
- Domain 3: Human issues in cyber-security
- Education and training relates to providing employees and consultants with the required skills and knowledge in relation to cyber-security policies and procedures as
- Cyber-security policy enforcement includes making users of the Internet and e-mail systems to sign acknowledgement and understanding of the acceptable usage of these
- Affiliation to professional institutes relates to joining occupational institutes or organisations that promote specific occupations. For example, internal auditors join or
- Individual performance assessment relates to setting employee-based performance targets driven by the job description of the employee. Assessing individ ua l
- Ethical conduct and behaviour entail prescribing moral standards that clearly distinguish acceptable behaviour from unacceptable behaviour. The informa t io n
- PROPOSED MUNICIPAL CYBER-SECURITY FRAMEWORK
- APPLYING THE MUNICIPAL CYBER-SECURITY FRAMEWORK
- BENEFITS OF MUNICIPAL CYBER-SECURITY FRAMEWORK
- CHAPTER SUMMARY
Furthermore, the cyber security policy specifies the role players involved in securing the information infrastructure. Information infrastructure asset management is also linked to the cyber security help desk or service desk. Executive management's buy-in to the successful implementation of cyber security in the municipality is essential.
AN INSTRUMENT TO ASSESS CYBER-SECURITY
CHAPTER INTRODUCTION
THE METROPOLITAN MUNICIPALITY CYBER-SECURITY ASSESSMENT TOOL
- The design of the questionnaire
I know what to do if I want to report violations or violations of the cybersecurity policy. Protection of the information infrastructure in my organization is guided by the industry's best practices CYBER SECURITY MANAGEMENT DOMAIN. My organization conducts ongoing cyber security assessments to determine how employees are complying with the cyber security policy.
RATIONALE BEHIND THE ASSESSMENT INSTRUMENT
The allocation of cybersecurity resources can be misdirected, thereby jeopardizing the protection of information infrastructure assets. Funding the implementation of cybersecurity policy therefore promotes the preservation of information infrastructure assets. The allocation of a budget for the implementation of cyber security policies should be commensurate with the expected protection for critical information infrastructure assets.
Management is monitoring the services provided by the service providers/consultants against the service level agreements
To be enforceable, a Service Level Agreement must be signed by both parties, in this case the municipality and the service provider. Management monitors the services of the service providers/consultants on the basis of the Service Level Agreements.
My organisation has deployed technologies to protect informatio n infrastructures against cyber threats
There must be proper identification and authentication mechanisms for all users accessing information infrastructure resources. Industry standards provide critical and credible guidelines that the municipality can use to secure the information infrastructure. virus software is used as a proactive mechanism to prevent known viruses from infecting the information infrastructure.
