A conceptual framework for assessing information security management practices in selected universities in Uganda

Abstract

The purpose of this paper is to present a conceptual framework for assessing managerial level information security practices, governance, and activities in selected university institutions in Uganda. Extant literature was drawn from existing information security management practices in different organizations. The proposed conceptual framework consisted of four manageable areas, namely, information security governance practices, information security practices, personnel management practices, and physical security practices. These areas are further subdivided into 25 categories that provide a formal checklist for assessing existing information security management practices in university institutions in Uganda.

The Institutionalisation of Information Security Management Practices in selected Organisations in Uganda

“…Whereas literature (see Table 1) shows that organisations have tried to implement technical security practices like proper configuration of firewalls, locking down servers, implementation of intrusion detection services, cryptographic solutions, network security etc., available studies have equally demonstrated that less attention has been given to managerial information security practices such as the implementation of policy, awareness and training, compliance with security standards, etc. (Alshaikh, 2016;Ahimbisibwe and Nabende, 2022;Herath et al, 2022).…”

“…Information Security Management Practices (ISMPs) in organisations have become one of the major concerns as evidenced by some studies (Whitman and Mattord, 2014;Alshaikh et al, 2014;Carcary et al, 2016;Maynard et al, 2018;Schinag and Shahim, 2020;Culot et al, 2021;Ahimbisibwe and Nabende 2022;Herath et al, 2022). Findings from these studies demonstrate that not all organisations implement the recommendations suggested.…”

“…According to the current study, eleven information security management practices were covered. These include the state of information security policy, asset management, secure information sharing, supply chain security, access management, network security controls, portable and removable media security, remote access security, protective monitoring of information systems, implementation of information security back-ups, and security accreditation by professional bodies (Ahimbisibwe and Nabende, 2022). A critical examination of these practices reveals that there was a need to fill the knowledge gap exposed by investigating the real situation in the selected organisations, hence the need for the study.…”