Information security at South African universities—implications for biomedical research

In South Africa, a similar regulation strategy to the European Union General Data Protection Regulation, called the Protection of Personal Information Act (No 4 of 2013) (POPIA), will be implemented, with a view to mitigate cybercrime and information security vulnerabilities. A qualitative exploratory analysis of information security management at universities in South Africa, using a Technology, Organisation, and Environment model, highlights the need for maintaining the security infrastructure to facilitate management of security within the university network, while placing emphasis on information security management processes, such as risk analysis, architecture review, code inspection, and security testing. Organizational factors were the most critical factors when compared to the technological and environmental factors which appear to influence the effectiveness of information security measures and, subsequently, data regulation readiness. Universities will have to balance the implementation of tangible solutions to mitigate risks within the scope of their budget while promoting user compliance, despite perceived ‘restrictions.’ For biomedical researchers, questions remain on the impact of POPIA legislation on data sharing, open science, and collaborations. Information has become a common and valuable commodity, with increased attention being focused on how information is handled, stored, and distributed.1 The role of universities as generators of knowledge underscores the importance of information management through the data life cycle from generation, processing, analysis, access, and reuse. Comprehensive information and communication technology (ICT) frameworks exist, such as COBIT 5 and ISO27001, and are aligned to King IV ™ for ICT governance, Prince2 for project management, and the NIST security framework.2 Universities in general and particularly in South Africa, adopt these at different levels. A researcher or academic is one of the stakeholders in a university that would encounter these data-relevant policies at the level of a ‘user’, and the management of personal information of research participants is of direct relevance to biomedical researchers. The Protection of Personal Information Act (No 4 of 2013) (POPIA) was signed into law on 19 November 2013 and at the time that interviews were conducted in this study, the implementation date was not yet known.3 Earlier this year, the office of the Information Regulator (IR) approached the President of SA requesting that 1 April 2020 be the declared date on which the remaining provisions of POPIA commence. Following this implementation date, a one-year grace period will be provided, and organizations would have to be POPIA-compliant by 31 March 2021. In accordance with sections 40 and 65 of the POPIA, the IR is required to assist with development and approval of codes of conduct.4 These codes of conduct operate as additional requirements for POPIA and as such, do not limit the right to privacy of a data subject, which is outlined in the POPIA. The purpose of the code of conduct is to provide a mechanism for compliance and accountability, which is tailor-made to various sectors. However, any code of conduct, which has been developed, must still be approved by the IR to ensure that the requirements of Chapter 7 of the Act have been met.5 In 2018, Universities South Africa, a membership organization which represents public universities in South Africa, launched a project to draft a code of conduct for public universities. A task team of representatives from public universities in South Africa and an external expert were constituted and produced the first draft of the code of conduct which was distributed in May 2019 to the South African universities for comment. Once the code of conduct is approved by the IR, it will be legally binding and apply to the processing of personal information by all ‘public higher education institutions’ as defined in section 1 of the Higher Education Act 101 of 1997.6 As we await the outcome of this national consultative process, it is important to understand the factors that govern data security and how it impacts the implementation strategies of any national policy framework. While South African universities are coming to terms with the need to establish effective governance of information security due to the external forces on the institutional environment from data regulatory agencies, understanding the placement of security in an academic context remains problematic. Therefore, there exists an urgent need for improvement in the way data and information are collected, stored, and disseminated within university systems, and with greater reference to sensitive information and data. Security measures and policies must be in place to guarantee the integrity, confidentiality, and availability of information. To achieve this, technological, organizational, and environmental factors must be investigated without undervaluing any factor. Therefore, the research has used the Technology, Organisation and Environment (TOE) framework to investigate and analyse factors influencing the effectiveness of information security policies and compliance in the participating universities. In order to assess whether SA universities had proper and reliable information security measures, practices, policies, and management in place, a TOE framework was applied to three SA universities. The analysis allowed for the identification of existing gaps within the university IT domain to provide a point of departure for further research, to develop comprehensive policies for information security at tertiary institutions, in line with POPIA compliance. The POPIA is the South African data protection law, promulgated on 26 November 2013, with the aim of protecting identifiable personal information of natural persons, and juristic persons from malicious intent in accordance with privacy rights determined by section 14 of the Constitution of the Republic of South Africa (Act No 108 of 1996).7 The POPIA rests upon the establishment of a set of data protection standards to specify the satisfactory collection, handling, and utilization of data.8 The South African POPIA covers aspects that incorporates: legal or lawful processing of the personal information traversing South Africa, accountability, processing limitation, purpose specification, retention and restriction of records, information quality, security safeguards, data subject participation, transfer of personal information across national boundaries, and codes of conduct.9 Non-compliance with the directives of POPIA may result in the IR imposing fines of up to ZAR10 million, depending on circumstances.10 POPIA is derived from a version of the General Data Protection Regulation (GDPR) of the European Union (EU) and both regulations address the protection of personal information of residents from unauthorized access; however, there are differences between them.11 The GDPR has gone through several versions of review and modification, expanding applicability to real-world problems. POPIA derived some concepts of earlier iterations of the GDPR and as such, POPIA compliance does not necessarily indicate GDPR compliance. In practical terms, and considering that Europe is South Africa’s predominant trade partner, GDPR non-compliance could have a negative impact on scholarly and global research partnerships and coupled with the possibility of fines (the upper limit of which is 20 million euro, or 4 per cent of global turnover) the financial implications of non-compliance would be disastrous for South African Universities.12 Recent research has recognized that technological factors are not the only key to effective information security controls; there is also a need to understand the impact of human and organizational factors.13 A better understanding of how different factors such as technological, organizational, and environmental factors influence the implementation and effectiveness of information security policies and compliance is essential, as this may elucidate how different factors could lead to potential sources of security breaches and vulnerabilities within organizations.14 A TOE IT/IS adoption framework that was developed by Tornatsky & Fleischer based on assumption that IT/IS adoption in organizations is influenced by three elements—technology, organization, and environment— was used in a small comparative case study based on findings from interviews with ICT professionals from three SA universities.15 The TOE framework is a recognized adoption framework in the information systems field with several researchers having employed this framework in studies. For this qualitative research study, a questionnaire was designed using concepts of the TOE framework as a basis to guide semi-structured interviews. The purposeful sampling design used for this study in order to select participants in accordance with the research objectives.16 Purposeful sampling ensures that the study population delivers adequate information needed for the study, and research by Baskarada surmised that with purposeful sampling, three individual participants would be sufficient to provide reliable, adequate, and valuable data that are appropriate for a study, thereby negating a reliance on a large sample set.17 While the current study involved one respondent from each university who participated in the semi-structured interviews, the participants have a high level of expertise and are involved in all day-to-day functional activities within the IT/IS domains at the universities. Only consenting participants were interviewed. Interviews were digitally recorded and transcribed by two individuals in the research team to ensure accuracy. The transcribed interviews produced over 29,000 words of text, responses were grouped and coded, and themes were formulized to facilitate a rich data set for analysis. Interview text was analysed with ATLAS.ti and the graphical representation of data was performed using the Freeplane application.18 To maintain agreed confidentiality with the participant institutions, the three universities were labelled A–C. Below, the issues which occurred in common at the three participating universities are presented (Figure 1). Graphic illustration of a common identified trait from responses of the respondents (all the participated universities) Graphic illustration of a common identified trait from responses of the respondents (all the participated universities) The major concern highlighted by two of the three participants under technological factors relates to poor security infrastructure at their institution. The focus of security infrastructure relates to the ability to best use new or existing technological solutions to monitor security processes such as authorization mechanisms, system patching, firewalls, and anti-virus software. At the time of the interviews, participants indicated that both the application and network patches were not in good standing. Some of the factors identified by the respondents which contributed to this included: network patches not being updated as they ought to be, authentication challenges, complexity of the systems, poor data management, lack of classification mechanism, lack of adequate budget to acquire needed tools, staff, and mechanisms to perform routine maintenance. With regards to data classification, the authors suggest that the first practical solution required is the development of a universally applied data classification scheme with special personal information having a separate and defined classification. All data types cannot be given the same level of data encryption, due to the cost and risk (a successful breach attempt on one database exposes the encryption key of other databases). Applying the same encryption to biomedical data and other sensitive data such as study participant metadata, as is applied to financial records, for example, is not acceptable practice. The results from the study highlighted the value of maintaining the security infrastructure as it facilitates the management of security within the university network. Tools such as firewalls, encryption mechanisms, authentication mechanisms, and non-repudiation mechanisms are essential for a university system. Security measures must be taken to ensure that data quality and integrity and these measures must be continuously checked for consistency and proper functionality. In order to achieve this, the authors highlight the need to place increased emphasis on the information security management processes such as risk analysis, architecture review, code inspection, and security testing. In addition, the above processes need to be monitored on a regular basis, as malfunction of these tools can lead to failure of effective security management and drive up costs associated with Information Technology, which will negatively influence compliance to information security practices. Digital transformation in the university environment has seen a shift in Bring Your Own Device (BYOD) to Bring Your Own Everything (BYOE).19 All respondents in the study eluded to BYOD policy on IT capacity and security with one respondent speaking to the fact that, on average, a student may own between three to four internet-enabled devices, each of which can be connected to the university network at any time. It is predicted that the number of connected devices on campus networks will continue to increase each year, as smartphones, laptops, tablets, and wearable devices become ubiquitous in daily life.20 BYOD policy not only burdens IT teams in the areas of authentication, explosive bandwidth consumption, access control, and university server security, but also in terms of protection of information. In addition, interviewees made mention of IT risk associated with mobile computational devices. Users often switch between devices for work purposes and commonly make use of hardware elements, such as external drives, to transfer data, including sensitive data. Users frequently travel externally with these devices, increasing information security risk through physical theft and data corruption when connected to untrusted networks. There is, therefore, a need to provide tangible solutions to mitigate this externally driven risk, and this may involve imposing a level of control on users—which would undoubtedly be perceived by users as ‘too restrictive’. From responses in the interviews, it was noted that formalized data management policy and strategy was lacking, and this had negative implications not only on internal compliance but also on legislative compliance. It is the authors’ strong suggestion that for successful data security implementation and maintenance, management structures should equip the IT teams with the necessary tools and mechanisms to overcome the challenges faced on a daily basis. This can, however, only be achieved if management starts to perceive security and privacy issues as a universal problem and understands the true (though mostly indirect) benefits of prioritizing information security. As such, the addition of security and related IT issues to the institutions’ core function and mandates will enable IT teams to deliver the needed technical support and insight, aligned with mission and vision of the university and leading to a successful digital transformation journey. Organizational factors define the influential factors that contribute to the success or failure of information security according to the users. Findings from the analysis of interview responses in the current study showed that organizational factors were the most critical, when compared to the technological and environmental contexts examined. Some of the major issues highlighted by respondents within the organizational context include: lack of top management support, funding, or financial constraints; lack of effective awareness training, information security practices not being part of the management core priority functions; lack of coordinated functions among units and departments; long approval times for IT policies by the councils, decentralization of systems, staff behaviour, and perception towards information security processes; lack of competent staff as a result of limited resources, IT directors and managers not being a part of university decision-making and in of for information security to the and impact of human to the information vulnerabilities or which occurred in These human may be due to or a lack of or breaches not security is but security is not A lack of knowledge on information security has also been identified as the to information security in other and human was identified in the current The authors that universities should user awareness which should address issues such as best practices, security practices of or when and drive awareness of existing information security In addition, security should not be perceived as an IT problem but as a this can be the will the knowledge to information security to their core functions as an which must be one of the participants had identified additional challenges with regards to human The IT team at this has been with financial thereby to into other risks to policy implementation and compliance. The authors that if the financial issues at the other two universities were there is a high possibility that they would similar by human This a for the universities to and for who are to from and knowledge by to information security challenges could be developed by at these teams from each other and risks which may not the authors the need for security professionals to security issues to the management in a they will understand of and not in To this it may be for managers and to in IT in order to better understand the technical used in the information security In information security, communication is and effective communication of the implications of poor IT strategies would be a for structures to ensure that this is factors how of and national standards and regulations impact security and the security policies, and standards to information security in a proper and acceptable With regards to POPIA, information management is not outlined in the Act but must be for compliance. At the time of the interviews, there was still on the date of implementation of POPIA and it that there was external from in the study made mention to how the of adoption and a lack of policy context had in a lack of understanding of how to POPIA respondents highlighted that or from the to organizations at a as to how to the required for compliance. The authors that the cost of compliance will from one to and have identified this financial as a key that is the implementation of information security measures and may result in of POPIA compliance. from participants a general lack of practical regulatory and from POPIA IR and which may lead to poor implementation and security there are and awareness from the law and respondents that of this regulation would be that POPIA not be taken such time that non-compliance is and that on the part of the IR, to be focused on with all The authors that this would be in that universities would be to greater on requirements for compliance, and practical related to the current of the legislation and codes of In this study, it was noted that participants to be with the GDPR with POPIA, which may be due to the public to the European It is the of the authors that a of to increase awareness of the POPIA regulation may to highlight the need to security measures by and organizations in South participants highlighted that an compliance to GDPR would make compliance to POPIA but not This is a to organizations in South Africa, considering the perceived need to with both At this that have or to as part of the may one framework over participant that the South African to a similar to these regulations as with the These two on a that the policy privacy legislation to be recognized as to the a similar can be for POPIA, the required for compliance would be and the adoption among universities and other organizations could In the authors that the first which must be by university IT/IS to with the requirements of POPIA is to the value of information to all this may result in all users of and when handling, processing, and data their day-to-day In addition, this would also the value of prioritizing information security and data management compliance to decision-making of the thereby the perception that in this is a Recent research has recognized that technological factors are not the only key to effective information security there exists an additional need to the impact of human and organizational Universities are on their networks and information infrastructure and as this does the importance of their IT Information security is not a technical and technical can only be effective if users to policy cannot the integrity, confidentiality, and availability of information in systems environment without that each involved understands and and is to perform It is of importance for university management and IT to and to provide solutions that not only current but also the as the technology In accordance with data security universities must personal information from data using both technological and organizational POPIA compliance will that universities develop and policies and define and and focused while considering the information security and management A better understanding of how different factors such as technological, organizational, and environmental factors influence the implementation and effectiveness of information security policies and compliance at tertiary education is as it on the and challenges being faced by these The required to and practical solutions for data can be when with biomedical data first and how these critical issues impact the of the data collection, of higher are with to associated with the POPIA the authors suggest that conducted in this should research on the impact of POPIA with regards to the use of biomedical data in universities. These should be in order to and in practice. This study was by SA and the South African of the of and and of South Africa, number The authors to the participants of this study for their valuable to this This study was approved by the of the of the with The authors that there is of the of this