Managing Students’ Academic Information:

How Are Public Higher Education Institutions In Uganda Prepared To Deal With Internal Cyber-Attacks?

Abstract

Information systems in developed and developing c ountries have been equally threatened by cyber-attacks which are deliberate exploitations of computer systems, technology dependent enterprises and networks that can compromise data and lead to cybercrimes like information and identity theft. The study established the magnitude of cyber-attacks in Public Higher Education Institutions (HEIs) in Uganda by insiders likely to access vital information. Investigations into the likely causes of internal cyber-attacks and the level of preparedness on the part of Public HEIs to counteract any cyber threats associated with internal staff or trusted vendors were undertaken. A self-administered questionnaire and an interview guide were developed to solicit respondents’ views on whether 1) internal cyber-security threats are a reality 2) the magnitude of cyber attacks in Public Higher Education Institutions in Uganda 3) the likely causes of internal cybersecurity threats and 4) the level of preparedness on the part of Public HEIs to counteract any cyber threats associated with internal staff. Four purposively selected Public Higher Education Institutions that have computerised students’ information systems and in recent times suffered loss of students’ information were included in the study. Respondents were randomly selected from functional departments’ staff lists while key informants were purposively selected from functional departments and their views analyzed both qualitatively and quantitatively. Findings show that cyber-attacks are a real threat and do occur regularly although HEIs are sometimes not forthcoming in reporting their existence for fear of damaging their reputation and credibility. Results indicated lack of user education, unethical conduct, absence of policies, inadequate budget provisions, and cultures not easily adaptable to change, suggesting low levels of information security preparedness in many HEIs. The article provides recommendations including but not limited to: adequate information security budgets, strengthening of information security policies and disaster