The management of information security and control at Kynoch Fertilizer (Pty) Ltd

Abstract

The growing misuse of information technology and the increased dependence on computer technology and systems heightened the requirements for information security. Unfortunately there often is a feeling of apathy towards information security by management, which leads to an ad hoc approach to information security and resultant information and financial losses. The main objective of the study thus was to determine the current state of information security at Kynoch Fertilizer (Pty) Ltd and to provide practical and feasible managerial recommendations for an information security framework and multilevel plan that will withstand the current and future information security threats. To realise this objective, and to establish a sound theoretical background to the problem, firstly, a literature study was done regarding three major aspects of information security and control. The results were:

❖ The major information security threats currently experienced are external threats, hardware misuse, masquerading, pest programs, bypasses, active misuse, passive misuse, inactive misuse, and indirect misuse. ❖ Although it is not possible to build a -completely secure information system and to eliminate all threats and problems, it is possible to minimise the impact and business disruption by implementing administrative, physical, procedural, operational, information systems, systems development and last resort control measures. ❖ The information security controls should be managed properly by the implementation of an information security policy, objectives, standards and guidelines; security requirements; a control strategy; and an information security control framework. Secondly, an empirical field investigation was done at the central region of Kynoch Fertilizer (Pty) Ltd, a large fertiliser manufacturer in Potchefstroom, by means of a field study of which three structured questionnaires on information security were an important component. The results of the three questionnaires were processed statistically. Based on the literature study concerning the ideal information security and control situation, and the empirical results, it was possible to determine the gap, problem areas and issues of information security and control at Kynoch Fertilizer (Pty) Ltd. The research clearly showed that numerous areas for improvement exist. To bridge the present information security gap that exists at Kynoch Fertilizer (Pty) Ltd a practical and feasible information security framework and plan was recommended. Although a completely secure information system at Kynoch Fertilizer (Pty) Ltd may not be attainable, the valuable information asset can to a large extent be protected. Information security may sometimes be a journey without end, but can provide a cost-effective solution to information security threats if implemented properly.