Organizational Factors that Influence Information Security in State Corporations: A Case Study of Kenya National Highways Authority

A Research Project by Kihara Peter Karichu Submitted to the Chandaria School of Business in Partial Fulfillment of the Requirement for the Degree of Masters in Business Administration (MBA)Many organizations and businesses are currently dependent on information systems to conduct their business process and transactions. The security of the information being handled by systems has become the challenge in the corporate world today, as organizations strive to take measures to safeguard their information and maintain confidentiality. The purpose of the study was to investigate the factors that influence information security in state corporations in Kenya: A case study of Kenya National Highways Authority. The study was guided by the following research questions: i. How does organizational characteristics affect information security in state corporations? ii. How does data management practices in organizations affect their information security in state corporations? iii. How does employee characteristics in organizations affect information security in state corporations? A quantitative descriptive research design was used in this study, whereby the population consisted of 85 employees of KeNHA out of which a sample size of 70 respondents was obtained, spread out across eight departments. The researcher applied the stratified random sampling technique to select employees from the eight departments namely finance, legal and public affairs, ICT, HR and Administration, risk and compliance, special projects, engineering and procurement departments. The elements selected from the population had interacted with information systems and were well qualified to respond to the research questions. The researcher used self-administered structured questionnaires, whereby the respondents were required to point out the measure of appropriateness of the three main factors that influence information security in state corporations. The questionnaire used a five-point Likert-type scale, that ranged from strongly disagree (1) to strongly agree (5). The respondents were also asked to indicate demographic information that comprised of gender, age, years of work with the organization and years of computer usage, based on their perception and understanding. The study took the form of a quantitative research design, whereby a total of seventy (70) questionnaires were distributed and fifty two (52) were obtained back from the respondents, indicating a response rate of 74%. The analysis of the data was performed in a quantitative nature so as to obtain numerical data and made use of descriptive and correlation statistics, and was analyzed using Microsoft Excel and SPSS software. The data was structured according to the research objectives and displayed in form of tables and figures, with the help of computer applications. With regards to the level at which organizational characteristics influence information security in state corporations, the results from the findings established that 89% of the respondents agreed that they are aware of the organization’s information security policies. 58% of the respondents agreed that the policies and standards have been implemented and 42% affirmed that the IS policies are updated regularly so as to combat new security vulnerabilities. In trying to establish whether data management practices influence information security in state corporations, the findings revealed that 90% of the respondents agreed that there is a wireless network managed by the organization while 82% agreed that there exists a local area network in the organization. 47% of the respondents stated that they agreed that the organization has an existing business continuity plan. Further analysis of the findings established that 46% of the respondents agreed that the organization has awareness programs. 41% confirmed that the organization has IS policy training programs and 29% of the respondents agreed that the organization keeps staff updated on emerging threats and risks in information security. Regarding whether employee characteristics influence information security in state corporations, it was observed that 83% of the respondents agreed that it is likely that the majority of other employees comply with the organization’s IS policies to help protect the organization’s information systems. It was also recorded that 94% of the respondents agreed that the can make a difference in helping to secure their organization’s information systems if they follow the organization’s information security policies. The study went ahead to conclude that the awareness, implementation and management of information security policies as part of organizational characteristics, has a strong influence on information security. On data management practices, the findings aided in drawing the conclusion that data management was observed to be a key factor in view of backup and recovery practices. The study concluded that proper implementation of backup and recovery practices is a key contributor towards achieving information security. It was also concluded that the ICT department plays a major role in assisting employees to understand and properly utilize the various information systems set in place. Regarding employee characteristics, the study concluded that it is a critical factor towards achieving information security. Employee characteristics was indicated as highly important amongst respondents in view of their attitudes and willingness to comply with the set information security policies. The study recommended state corporations to adopt the culture of developing information security policies and also hold frequent awareness and training programs for their employees. The study also recommended state corporations to undertake information systems auditing as part of their standard procedures. Penetration testing, as a means to establish secure perimeters around ICT networks was also recommended for state corporations. The study also highly recommended that management should constantly encourage employees to adapt to organizational change, as it brings enhanced and more secure ways of managing information. Finally, the study recommended for further research to be carried out on whether operations between state corporations and the government has any influence on their information security, and also whether the nature of their establishment and responsibility dictates how state corporations handle the various information aspects including its security. It was also recommended for future research to be carried out on the banking industry