The Integration of Legal Aspects in Information Security: Is Your Organisation

Up-to-Date??

Rabelani DagadaDevelopment Economist

Paper presented during Institute for International Research's Conference on Information Technology Risk Management - 11 November 2010, IIR Conference Centre, Rosebank,

Johannesburg

AGENDA

• Introduction and background• Motivation for the research• Research methodology and findings• Findings of the study• Contribution of the study• Conclusion

Rabelani Dagada lectures ICT and Knowledge Management at the Wits Business School

INTRODUCTION & BACKGROUND

• Today most organisations use the Internet for information and business related purposes.

• The Internet revolution is developing rapidly due to the electronic commerce (e-commerce).

• The use of the Internet for commercial purposes has brought with it a number of challenges.

• These include information security risks, threats, and cyber crime.• The government of South has introduced several laws to deal with the IT

related risks, threats, and cyber crime.• One such law is the highly acclaimed Electronic Communications and

Transactions Act of 2002 (ECT Act, 2002).

MOTIVATION FOR THE RESEARCH

• The 2002 and 2004 website compliance survey conducted by the Buys Attorneys found that most companies in SA were not complying with the laws and regulations and regulations governing e-commerce.

• In 2002 most webmasters claimed that they were not even aware of the compliance requirements.

• In 2004 this number increased by 31%.• Buys attorneys claimed that failure to comply with law led to an increase in

website crime. • SA companies did not seem to realise that failure to comply with the

provision of the law exposes their websites to huge risk and liability.• Of the 1 550 websites surveyed by Buys Incorporated Attorneys in 2004, the

Telkom website was the only one to score 100% compliance rate.• It is on this premise that this study was conducted.

Source: Buys Incorporated Attorneys

RESEARCH METHODOLOGY & SAMPLING

• 22 organisations from various industrial sectors participated in this study.• The banking sector dominated all other industrial sectors.• Purposive sampling was employed due to the perceived value participants

would add.• This study used the generic techniques for qualitative collection and

analysis.• The study satisfied the principle of triangulation by employing multiple data-

gathering methods and sources.• Data gathering methods included interviews, observation, and policy

document analysis.• Interviews were analysed by using open coding.• Data collected through document analysis was analysed by comparing it

with the SA legal framework for information security.

FINDINGS OF THE STUDY

FINDINGS OBTAINED THROUGH INTERVIEWS

• The Board of Directors are not involved in the formulation of information security policies.

• Very few organisations in SA incorporates legislation requirements in the information security policies.

• Government has not yet implemented some legal provisions to fight cyber crime; e.g.

- the appointment of the Cyber Inspectors as required by the ECT of 2002 is not yet implemented; and

- the registration of the buyers and owners of the cell phone SIM cards as required by the Regulation of Interception of Communications and Provision of Communication-related Information Act of 2002 only came into effect on 1 July 2009.

• Legal provision in the ECT Act that deal with unsolicited communication has serious loophole.

FINDINGS OBTAINED THROUGH DOCUMENT COLLECTION AND ANALYSIS

• Policies related to hacking include Information Security Policies, and Interception & Surveillance Policy. Relevant legislations are the Promotion of Access to Information Act; ECT Act; and Interception Act.

• Policies related to the intellectual property, copyright, and trademarks include Intellectual Property Policy and Data Privacy Policy.

• The majority of organisations that participated in this study did not have policies that address intellectual property, copyright and trademarks.

• None of the organisations that participated in this study had a separate policy on patents.

• Most companies in SA perceive the Patents Act of 1978 to be ineffective.• Some of the laws pertaining to information security are very old,.• They were introduced before the Internet was used for commercial

purposes.

FINDINGS OBTAINED THROUGH OBSERVATION

ASPECT OBSERVED NUMBER

Websites with legal notices at all 17

Websites with terms and conditions available as hyperlinks

7

Websites with liability disclaimers available as hyperlinks

11

Websites with legal notices that address the provisions of Chapter 3, Part II and Chapter 7 of the ECT Act

5

Websites that position and implement legal notices correctly

2

Website legal notices that are printable or saveable as required by section 11(3) of the ECT Act

2

Organizations that have policies that address websites legal compliance

5

Table 1: Number of organizations that are compliant with the legislation governing websites and e-commerce.

CONTRIBUTION OF THE STUDY

CONCEPT MODEL OF LEGAL COMPLIANCE

• This study suggests a Model whereby legal requirements are incorporated into the information security endeavors.

• The Model was necessitated by the main findings of the study which reveals that both the government and corporate SA were not implementing some of the information security legal provisions.

• The Model may be very useful to policy formulators, directors of the boards, ICT executives, and information security practitioners.

• According to the King III Report, IT strategic planning, risk management, and information security are the primary responsibility of the Board of Directors.

Make ICT strategic pronouncement. These

would include information security within the corporate

governance framework.

Identify relevant information security

legislation, standard and related governance compliance duties.

Integrate legislation and compliance duties into ICT and Information Security

Allocate duties to business units and for individual

position

Audit compliance and identity gaps attend to gaps and monitor compliance.

Each employee signs the consent form, new

employee sign this as part of the employment contract

Approve the policies and delegation of duties. Gives go ahead for the implementation.

All employees are receiving education and training on

Information security policies

Whole organisation Whole organisation Boards sub-committee risk management

Boards sub-committee risk management

ICT Steering committee

ICT DepartmentICT Steering committee Board of Directors

Figure 1: A concept of legal compliance for Information security policies formulation, implementation and multitasking

CONCLUSION

• There are more than ten laws that deal with information security in SA.• Most information security provisions contained in laws are not yet

implemented.• There is also a deliberate disregard of information security legal provisions

by some companies and government entities.• This study found that most IT and information security practitioners were not

familiar with the information security legal requirements.• It perhaps in this premise that most organisations do not comply with the

legal requirements.• In some instances the attitude of the SA government towards its own laws

has been lukewarm.• The proposed Model will help in mitigating information security challenges.• The overall intention of the Model is to priorities information security, elevate

the profit and ultimately address corporate security lapses.