Cyber Security Practices and Challenges at Selected Critical Infrastructures in Ethiopia: Towards Tailoring Cyber Security Framework

ADDIS ABABA UNIVERSITY COLLEGE OF NATURAL AND COMPUTATIONAL SCIENCES SCHOOL OF INFORMATION SCIENCE CYBER SECURITY PRACTICES AND CHALLENGES AT SELECTED CRITICAL INFRASTRUCTURES IN ETHIOPIA: TOWARDS TAILORING CYBER SECURITY FRAMEWORK By TEWODROS GETANEH JUNE, 2018 ADDIS ABABA, ETHIOPIA ADDIS ABABA UNIVERSITY COLLEGE OF NATURAL AND COMPUTATIONAL SCIENCES SCHOOL OF INFORMATION SCIENCE CYBER SECURITY PRACTICES AND CHALLENGES AT SELECTED CRITICAL INFRASTRUCTURES IN ETHIOPIA: TOWARDS TAILORING CYBER SECURITY FRAMEWORK A Thesis Submitted to School of Graduate Studies of Addis Ababa University in Partial Fulfillment of the Requirements for the Degree of Master of Science in Information Science By: TEWODROS GETANEH Advisor: Tebebe Beshah (PhD) JUNE, 2018 Addis Ababa, Ethiopia ADDIS ABABA UNIVERSITY COLLEGE OF NATURAL AND COMPUTATIONAL SCIENCE SCHOOL OF INFORMATION SCIENCE CYBER SECURITY PRACTICES AND CHALLENGES AT SELECTED CRITICAL INFRASTRUCTURES IN ETHIOPIA: TOWARDS TAILORING CYBER SECURITY FRAMEWORK By: Tewodros Getaneh Name and signature of Members of the Examining Board Tebebe Beshah (PhD) Advisor __________ Signature _________ Date Lemma Lenssa (PhD) Examiner ___________ Signature __________ Date Dereje Teferi Examiner <ul style="display: flex;"><li style="flex:1">(PhD) </li><li style="flex:1">__________ </li></ul>Signature _________ Date Declaration This thesis has not previously been accepted for any degree and is not being concurrently submitted in candidature for any degree in any university. I declare that the thesis is a result of my own investigation, except where otherwise stated. I have undertaken the study independently with the guidance and support of my research advisor. Other sources are acknowledged by citations giving explicit references. A list of references is appended. Signature: ________________________ Tewodros Getaneh This thesis has been submitted for examination with my approval as university advisor. Advisor’s Signature: ________________________ Tebebe Beshah (PhD) i | P a g e Dedication This work is dedicated to my beloved sister Eleni Getaneh. ii | P a g e Acknowledgements I would like to thank my research advisor Dr. Tebebe Beshah for his extrovert guidance and support. He has shown me the right path of research and encouraged me to move forward throughout the study. I would also like to extend my sincere gratitude to Dr. Andualem Admassie , CEO of Ethio Telecom, for his assistance in time of Data collection. I am thankful to Ato Mekonnen Tesfaye, ICT Security Head of Ethiopian Electric Utility for his valuable comments and assistance in time of data collection and review of the tailored framework. Your positive attitude towards the research, heartily assistance and encouragement was my energy to move forward throughout this research. I would like to thank Ato FikreSilase Wosen, an ICT Technician at Ethiopian Electric Utility, for his un - reserved cooperation and assistance throughout this research. My heartfelt thanks goes Ato Yeman Gebre Hiwot of Ethio Telecom and to the whole IT security and Network Security staff at Ethio Telecom. This work was not possible without your support and cooperation. This study would not have been possible without the help of INSA’s Staff for their cooperation and valuable comments. Last but not least I would like to thank my friend Ato Muluken Belete who encourages me to pursue cyber security and for his valuable assistance in evaluating the tailored framework. My heartfelt thanks goes to Mr. Lee Sung Hoon, Director of World Together Ethiopia, for his assistance and positive cooperation. iii | P a g e Table of Contents <a href="#4_0">Declaration</a><a href="#4_0">..................................................................................................................................................... i </a><a href="#5_0">Dedicatio</a><a href="#5_0">n</a><a href="#5_0">..................................................................................................................................................... ii </a><a href="#6_0">Acknowledgements</a><a href="#6_0">...................................................................................................................................... iii </a><a href="#10_0">List of Tables </a><a href="#10_0">.............................................................................................................................................. vii </a><a href="#11_0">List of Graphs </a><a href="#11_0">............................................................................................................................................ viii </a><a href="#12_0">List of Figure</a><a href="#12_0">s</a><a href="#12_0">.............................................................................................................................................. ix </a><a href="#13_0">List of Acronyms </a><a href="#13_0">.......................................................................................................................................... x </a><a href="#14_0">Abstrac</a><a href="#14_0">t</a><a href="#14_0">........................................................................................................................................................ xi </a><a href="#16_0">CHAPTER ON</a><a href="#16_0">E</a><a href="#16_0">..........................................................................................................................................</a><a href="#16_0">.</a><a href="#16_0">1 </a><a href="#16_1">1. Introduction</a><a href="#16_1">..............................................................................................................................................</a><a href="#16_1">.</a><a href="#16_1">1 </a><a href="#16_2">1.1 Background .........................................................................................................................................................1 </a><a href="#22_0">1.2 Statement of the Problem ....................................................................................................................................7 </a><a href="#24_0">1.3 Research Questions .............................................................................................................................................9 </a><a href="#25_0">1.4 General objective of the Researc</a><a href="#25_0">h</a><a href="#25_0">.</a><a href="#25_0">....................................................................................................................10 </a><a href="#25_1">1.5 Specific objectives of the Researc</a><a href="#25_1">h</a><a href="#25_1">.</a><a href="#25_1">..................................................................................................................10 </a><a href="#25_2">1.6 Scope and Limitations of the Research .............................................................................................................10 </a><a href="#26_0">1.7 Significance of the Research .............................................................................................................................11 </a><a href="#26_1">1.8 organization of the Thesis .................................................................................................................................11 </a><a href="#28_0">CHAPTER TWO </a><a href="#28_0">.......................................................................................................................................</a><a href="#28_0">.</a><a href="#28_0">1</a><a href="#28_0">3 </a><a href="#28_1">2. Literature Review and Related Work</a><a href="#28_1">s</a><a href="#28_1">...................................................................................................</a><a href="#28_1">.</a><a href="#28_1">1</a><a href="#28_1">3 </a><a href="#28_2">2.1 Overvie</a><a href="#28_2">w</a><a href="#28_2">.</a><a href="#28_2">..........................................................................................................................................................13 </a><a href="#28_3">2.2 Computer Security, Information Security and Cyber security ..........................................................................13 </a><a href="#30_0">2.3 Cyber Security Threat Actors............................................................................................................................15 </a><a href="#0_0">2.4 Methods of Cyber Attack ..................................................................................................................................19 </a><a href="#0_1">2.4.1 Social Engineerin</a><a href="#0_1">g</a><a href="#0_1">....................................................................................................................</a><a href="#0_1">.</a><a href="#0_1">1</a><a href="#0_1">9 </a><a href="#0_2">2.4.2 Denial-of-Service /DoS/</a><a href="#0_2">............................................................................................................</a><a href="#0_2">.</a><a href="#0_2">2</a><a href="#0_2">0 </a><a href="#0_3">2.4.3 Website Defacement </a><a href="#0_3">.................................................................................................................</a><a href="#0_3">.</a><a href="#0_3">2</a><a href="#0_3">1 </a>iv | P a g e <a href="#0_4">2.4.4 Malicious Code </a><a href="#0_4">.........................................................................................................................</a><a href="#0_4">.</a><a href="#0_4">2</a><a href="#0_4">1 </a><a href="#0_5">2.5 Cyber security in Ethiopi</a><a href="#0_5">a</a><a href="#0_5">.</a><a href="#0_5">................................................................................................................................22 </a><a href="#0_6">2.5.1 Critical Mass Cyber Security Requirement Standard /CMCSRS/ Version 1.0</a><a href="#0_6">.........................</a><a href="#0_6">.</a><a href="#0_6">2</a><a href="#0_6">4 </a><a href="#0_5">2.6 Global Cyber Security Initiative........................................................................................................................30 </a><a href="#0_7">2.6.1 Global Cyber Security Index /GCI/ 2017</a><a href="#0_7">..................................................................................</a><a href="#0_7">.</a><a href="#0_7">3</a><a href="#0_7">0 </a><a href="#0_5">2.7 NIST Framework...............................................................................................................................................33 </a><a href="#0_2">2.8 Related Work</a><a href="#0_2">s</a><a href="#0_2">.</a><a href="#0_2">..................................................................................................................................................35 </a><a href="#0_8">2.9 Chapter Summary..............................................................................................................................................41 </a><a href="#0_5">CHAPTER THREE </a><a href="#0_5">...................................................................................................................................</a><a href="#0_5">.</a><a href="#0_5">4</a><a href="#0_5">3 </a><a href="#0_9">Research Methodology </a><a href="#0_9">..............................................................................................................................</a><a href="#0_9">.</a><a href="#0_9">4</a><a href="#0_9">3 </a><a href="#0_10">3.1 </a><a href="#0_11">3.2 </a><a href="#0_5">3.3 </a><a href="#0_5">3.4 </a><a href="#0_12">3.5 </a> <a href="#0_10">Overview....................................................................................................................................................43 </a><a href="#0_11">General Approach ......................................................................................................................................43 </a><a href="#0_5">Research Pillars and Sub Pillars.................................................................................................................47 </a><a href="#0_5">Study Populatio</a><a href="#0_5">n</a><a href="#0_5">.</a><a href="#0_5">.......................................................................................................................................49 </a><a href="#0_12">Data Collection Techniques and Procedures..............................................................................................49 </a><a href="#0_13">Ethiopian Electric Power and Utility </a><a href="#0_13">.................................................................................</a><a href="#0_13">.</a><a href="#0_13">4</a><a href="#0_13">9 </a><a href="#0_13">3.5.1 </a><a href="#0_14">3.5.2 </a><a href="#0_14">Ethio Teleco</a><a href="#0_14">m</a><a href="#0_14">....................................................................................................................</a><a href="#0_14">.</a><a href="#0_14">5</a><a href="#0_14">0 </a><ul style="display: flex;"><li style="flex:1"><a href="#0_15">3.6 </a></li><li style="flex:1"><a href="#0_15">Data Analysis and Evaluation Technique ..................................................................................................51 </a></li></ul><a href="#0_16">Reliability and Validity Testing .................................................................................................................53 </a><a href="#0_17">Chapter Summary ......................................................................................................................................53 </a> <a href="#0_16">3.7 </a><a href="#0_17">3.8 </a><a href="#0_5">CHAPTER FIVE </a><a href="#0_5">.......................................................................................................................................</a><a href="#0_5">.</a><a href="#0_5">5</a><a href="#0_5">5 </a><a href="#0_9">Data Presentation, Analysis and Discussio</a><a href="#0_9">n</a><a href="#0_9">..............................................................................................</a><a href="#0_9">.</a><a href="#0_9">5</a><a href="#0_9">5 </a><a href="#0_10">4.1 Overvie</a><a href="#0_10">w</a><a href="#0_10">.</a><a href="#0_10">..........................................................................................................................................................55 </a><a href="#0_18">4.2 Demographic Properties of Respondents ..........................................................................................................56 </a><a href="#0_19">4.3 Cyber Security Challenges at Critical Infrastructures .......................................................................................58 </a><a href="#0_6">4.4 Trends of Growth in Cyber Security Threats ....................................................................................................64 </a><a href="#0_5">4.5 Preparedness to Cyber Security Threats at Critical Infrastructure</a><a href="#0_5">s</a><a href="#0_5">.</a><a href="#0_5">..................................................................68 </a><a href="#0_20">4.5.1 Preparedness to Detect Cyber Security Threat</a><a href="#0_20">s</a><a href="#0_20">........................................................................</a><a href="#0_20">.</a><a href="#0_20">6</a><a href="#0_20">8 </a><a href="#0_21">4.5.2 Preparedness to Prevent Cyber Security Threats </a><a href="#0_21">......................................................................</a><a href="#0_21">.</a><a href="#0_21">7</a><a href="#0_21">0 </a><a href="#0_22">4.5.3 Preparedness to Respond to Cyber Security Breac</a><a href="#0_22">h</a><a href="#0_22">.................................................................</a><a href="#0_22">.</a><a href="#0_22">7</a><a href="#0_22">1 </a><a href="#0_23">4.6 Discussion .........................................................................................................................................................74 </a><a href="#0_24">4.7 Cyber Security Practices: Legislations, Policies, Institution and Standard .......................................................77 </a><a href="#0_25">4.8 Chapter Summary..............................................................................................................................................80 </a><a href="#0_5">CHAPTER SI</a><a href="#0_5">X</a><a href="#0_5">..........................................................................................................................................</a><a href="#0_5">.</a><a href="#0_5">8</a><a href="#0_5">1 </a>v | P a g e <a href="#0_9">The Tailored Cyber Security Framework for Critical Infrastructures</a><a href="#0_9">........................................................</a><a href="#0_9">.</a><a href="#0_9">8</a><a href="#0_9">1 </a><a href="#0_10">5.1 Overvie</a><a href="#0_10">w</a><a href="#0_10">.</a><a href="#0_10">..........................................................................................................................................................81 </a><a href="#0_26">3.2 </a><a href="#0_27">3.3 </a><a href="#0_5">3.4 </a> <a href="#0_26">Cyber Security Units and INS</a><a href="#0_26">A</a><a href="#0_26">.</a><a href="#0_26">................................................................................................................85 </a><a href="#0_27">Bags of Existing and Growing Threats ......................................................................................................85 </a><a href="#0_5">Evaluation of the Proposed Framework .....................................................................................................88 </a><a href="#0_5">Chapter six </a><a href="#0_5">.................................................................................................................................................</a><a href="#0_5">.</a><a href="#0_5">9</a><a href="#0_5">0 </a><a href="#0_9">Conclusion and Recommendations</a><a href="#0_9">............................................................................................................</a><a href="#0_9">.</a><a href="#0_9">9</a><a href="#0_9">0 </a><a href="#0_0">6.1 Conclusion.........................................................................................................................................................90 </a><a href="#0_28">6.2 Recommendations .............................................................................................................................................92 </a><a href="#0_29">6.3 Recommendations for Future Research.............................................................................................................92 </a><a href="#0_30">References</a><a href="#0_30">..................................................................................................................................................</a><a href="#0_30">.</a><a href="#0_30">9</a><a href="#0_30">4 </a>vi | P a g e List of Tables Pages 41 Table 2.1 Related Works Table Table 3.1 Ethiopian Electric Power utility Study Population Table 3.2 Ethio Telecom Study Population 50 51 Table 4.1 Response Rate 55 Table 4.2 Reliability Statistics of the Questionnaire Table 4.3 Educational Status 56 56 Table 4.4 Reliability Statistics for Eight Items on challenges of Cyber Security Table 4.5 Percentile distribution of Cyber Security challenges Table 4.6 Percentile Distribution of Level of Preparedness to Detect Cyber Security Threats 59 63 70 Table 5.1 Design Research Guide Line 83 vii | P a g e List of Graphs Pages 57 Graph 4.1 Graph 4.2 Graph 4.3 Graph 4.4 Graph 4.5 Security certification at critical Infrastructures Years of Experience 58 Trend Level of Preparedness to Prevent Cyber security Threats Level of Preparedness to Respond to Cyber Security Threats Management Team or Executives Understanding towards Cyber security 71 73 74 viii | P a g e List of Figures Pages 6Figure 1.1 Global Cyber security Agenda /GCA/ Tree Structure Illustrating all Pillars /Simplified/ Figure 2.1 The Relationships between information and Communication security , Information Security and Cyber Security 15 Figure 2.2 Cyber Security Strategic Management Model Figure 2.3 Capability building Architecture 26 28 28 29 31 46 48 87 Figure 2.4 CMCSRS Process Framework Figure 2.5 CMCSRS the OPDCA Process Cycle Figure 2.6 GCI Pillars and Sub Pillars Figure 3.1 Simplified Research Process Figure 3.2 The Research Three Pillars and Sub pillars Figure 5.1 Graphical Representation of the Tailored Framework for Technical Processes of Cyber Security ix | P a g e List of Acronyms BYOD BYOA CERT CIs Bring Your Own Devices Bring Your Own Applications Computer Emergency and Response Unit Critical Infrastructures CMSCRS CSF Critical Mass Cyber Security Requirement Standard Cybersecurity Framework CSFs CIO Cybersecurity Frameworks Chief Information Officer CSUs DDoS: DoS: Cyber Security Units Distributed Denial of Service Denial of Service GCA: GCI: Global Cybersecurity Agenda Global Cybersecurity Index ICT: Information Communication Technology Information Network Security Agency Internet of Things INSA: IoTs: IS: Information System ISS: IT: Information Systems Security Information technology NIST: UNCTAD: National Institute of Standards and Technology United Nations Conference on Trade and Development x | P a g e Abstract Cyber security is the activity of protecting information and information systems (networks, computers, data centers and applications) with appropriate procedural and technological security measures (Tonge, Kasture and Chaudhari, 2013, p.1). Cyber security threats and breaches are increasing from year to year. A Cyber security breach has the potential to disrupt the proper functioning of nation states. It affects the reputation of organization and erodes customers trust. Cyber security breaches at critical infrastructures can affect the existence of a nation and can disrupt the social, economic and political realm of governments. Critical infrastructures mean any infrastructure vulnerable to information communication network security threats having considerable impact to the social, economic, or political interest of the country.

Cyber Security Practices and Challenges at Selected Critical Infrastructures in Ethiopia: Towards Tailoring Cyber Security Framework

Details

Download

Copyright

We respect the copyrights and intellectual property rights of all users. All uploaded documents are either original works of the uploader or authorized works of the rightful owners.

Support