Information Security Risk Management in the South African Small, Medium and Micro Enterprise Environment
Total Page:16
File Type:pdf, Size:1020Kb
INFORMATION SECURITY RISK MANAGEMENT IN THE SOUTH AFRICAN SMALL, MEDIUM AND MICRO ENTERPRISE ENVIRONMENT: THE PECULIUM MODEL By LIESL VAN NIEKERK DISSERTATION Submitted in fulfilment of the requirement for the degree MASTER OF SCIENCE in INFORMATICS in the FACULTY OF SCIENCE at the UNIVERSITY OF JOHANNESBURG SUPERVISOR: PROF L LABUSCHAGNE NOVEMBER 2005 ABSTRACT The small, medium and micro enterprise (SMME) environment of South Africa contributes 42% to the national gross domestic product. This is a high number for a largely under-regulated environment. The corporate governance and IT governance standards that apply to South African companies are not feasible for SMMEs, and neither are they enforced, although 80% of failures of SMMEs are attributable to lack of enterprise management skill. The first objective of this dissertation is to examine the South African SMME, and in so doing determine whether local regulatory standards can be used for this unique enterprise formation. The second objective of this dissertation is to determine whether international methodologies for information security risk management, as an inclusive of IT governance, may be used in the unique local SMME formation. The result of these two objectives creates a gap in a typical information security risk management methodology that is suitable for the South African regulatory and economic environment for SMMEs. A model has been created as a possible answer for filling the gap. The dissertation includes the Peculium Model, which answers the regulatory and economic requirements that resulted from the second objective. The Model allows the small enterprise a simple but effective method for managing risks to its information assets, with the control of corporate governance and IT governance included in its framework. The Model answers the methods for identifying and assessing risk in a tradition-based but feasible new qualitative technique. ii OPSOMMING Die omgewing van klein, medium en mikro-ondernemings (KMMO’s) in Suid- Afrika dra 42% tot die nasionale bruto binnelandse produk by. Dit is ’n groot persentasie vir ’n omgewing wat nie veel regulering geniet nie. Die standaarde vir korporatiewe regering en IT-regering wat op die Suid- Afrikaanse maatskappy van toepassing is, is nie noodwendig gepas vir KMMO’s nie en word ook nie afgedwing nie, al faal 80% van KMMO’s as gevolg van ’n gebrek aan bestuursvernuf. Die eerste doelwit van hierdie verhandeling is om die Suid-Afrikaanse KMMO te ondersoek en sodoende uit te vind of plaaslike reguleringstandaarde wel vir hierdie unieke ondernemingstruktuur gebruik kan word. Die tweede doelwit van die verhandeling is om uit te vind of internasionale metodologieë vir inligtingsekerheid-risikobestuur (ISRB) as deel van IT- regering gebruik kan word in die unieke plaaslike KMMO-struktuur. Die uitslag van hierdie twee doelwitte skep ’n gaping in ’n tipiese ISRB- metodologie ten opsigte van wat geskik is vir die Suid-Afrikaanse regulerende en ekonomiese omgewing van KMMO’s. ’n Model is as moontlike oplossing geskep om hierdie gaping te vul. Hierdie verhandeling sluit die Peculium-model in wat inpas by die regulerende en ekonomiese vereistes wat uit die tweede doel voortspruit. Die Model verskaf ’n effektiewe dog eenvoudige metode vir die bestuur van risiko’s wat inligtingsbates bedreig, terwyl die beheer van korporatiewe regering en IT- regering in die raamwerk ingesluit word. Die metode behels die identifisering en assessering van risiko’s met behulp van ’n tradisiegebaseerde, maar bruikbare nuwe kwalitatiewe tegniek. iii Acknowledgements This has been both a stimulating and exciting adventure which can never be reduced in its meaning or importance in my academic career. I have been close to the plight of the SMME and as such, I am satisfied that I have contributed to the body of knowledge for the South African SMME community. I wish to thank my family and friends for their unwavering support in this journey. Your frowns and raised eyebrows spurred me ever on in trying to simplify my explanations. I have since given up that thankless route. The journey would have been a distinctly lonely path without you all. Thank you. The financial assistance of the South African Department of Labour (DoL) in this research is hereby acknowledged. Opinions expressed and conclusions arrived at are those of the author and are not necessarily to be attributed to the DoL. iv L1 Contents 1 INTRODUCTION......................................................................................................... 1 1.1 THE SOUTH AFRICAN SMME............................................................................. 1 1.2 THE PROBLEM STATEMENT................................................................................ 4 1.3 THE RESEARCH PROJECT OBJECTIVES ............................................................. 5 1.4 STRUCTURE OF THIS STUDY................................................................................ 5 1.4.1 RESEARCH METHODOLOGY .................................................................................. 6 1.4.2 BRIEF DESCRIPTION OF THE CHAPTERS ................................................................ 7 1.5 CONCLUSION ........................................................................................................ 8 PART 1: THE HYPOTHESES .............................................................................................. 9 2 DEFINING THE HYPOTHESIS ENVIRONMENT............................................... 10 2.1 INTRODUCTION .................................................................................................. 10 2.2 COMPARISON OF THE SMALL ENTERPRISE IN DEVELOPING AND DEVELOPED COUNTRIES......................................................................................................... 11 2.2.1 ECONOMIC DATA ON DEVELOPED AND DEVELOPING COUNTRIES..................... 12 2.2.2 THE SMALL ENTERPRISES IN THE SAMPLE OF DEVELOPED COUNTRIES............. 16 2.2.3 THE SMALL ENTERPRISES IN THE SAMPLE OF DEVELOPING COUNTRIES ........... 18 2.2.4 SMALL ENTERPRISES IN DEVELOPED VERSUS DEVELOPING COUNTRIES ........... 20 2.3 DEFINING CORPORATE AND IT GOVERNANCE................................................ 21 2.3.1 CORPORATE GOVERNANCE ................................................................................. 21 2.3.2 IT GOVERNANCE ................................................................................................. 23 2.4 DEFINING INFORMATION SECURITY RISK MANAGEMENT............................. 23 2.4.1 RISK..................................................................................................................... 25 2.4.2 RISK IDENTIFICATION.......................................................................................... 26 2.4.3 RISK ASSESSMENT OR ANALYSIS........................................................................ 27 2.4.4 RISK MITIGATION................................................................................................ 29 2.4.5 RISK MONITORING .............................................................................................. 31 2.5 SPECIALISING IN INFORMATION SECURITY RISK MANAGEMENT.................. 33 2.5.1 SECURITY ............................................................................................................ 33 2.5.2 INFORMATION SECURITY .................................................................................... 33 2.5.3 THE DEFINITION OF ISRM .................................................................................. 35 2.6 CONCLUSION ...................................................................................................... 35 3 EVALUATING INDUSTRY CORPORATE GOVERNANCE AND IT GOVERNANCE FOR USABILITY AND CONFORMANCE............................... 37 3.1 INTRODUCTION .................................................................................................. 37 v 3.2 CORPORATE GOVERNANCE IN SOUTH AFRICA COMPARED TO THE INTERNATIONAL STANDARDS ........................................................................... 38 3.2.1 CORPORATE GOVERNANCE IN AFRICA ............................................................... 38 3.2.2 CORPORATE GOVERNANCE IN THE AMERICAS, AUSTRALASIA AND EUROPE..... 40 3.2.3 KING II VS. AUSTRALIAN STOCK EXCHANGE CORPORATE GOVERNANCE COUNCIL.............................................................................................................. 42 3.3 THE USABILITY OF KING II IN SOUTH AFRICAN SMMES .............................. 49 3.4 IT GOVERNANCE IN SOUTH AFRICA ................................................................ 51 3.5 USABILITY OF COBIT IN SOUTH AFRICAN SMMES ........................................ 54 3.6 CONCLUSION ...................................................................................................... 58 4 INFORMATION SECURITY RISK MANAGEMENT FOR SMALL BUSINESSES............................................................................................................... 60 4.1 INTRODUCTION .................................................................................................. 60 4.2 FRAMEWORK FOR THE EVALUATION OF ISRM METHODOLOGIES............... 61 4.2.1 THE FRAMEWORK EXPLAINED............................................................................ 61 4.2.2 ELEMENTS OF THE FRAMEWORK......................................................................... 62 4.3 OCTAVE-S EVALUATED .................................................................................. 68 4.3.1