LOSS OF DATA AND ITS RECOVERY ON DEFENCE

INFORMATION SYSTEMS

BY

BABAJIDE OLUWATONI BAMIDURO

NDAPGS/FMSIS/ICS032019/P04053

SUBMITTED TO THE
DEPARTMENT OF INTELLIGENCE AND CYBER SECURITY
FACULTY OF MILITARY SCIENCE AND INTERDISCIPLINARY
STUDIES NIGERIA DEFENCE ACADEMY KADUNA
IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE
AWARD OF MASTERS IN CYBER SECURITY

AUGUST, 2021

i
 DECLARATION

I, Babajide Oluwatoni Bamiduro with registration number NDAPGS/FMSIS/ICS032019/P04053

hereby declare that this report was written by me under the supervision of my supervisor. It has
not been presented before in any previous application for a certificate. Reference made to
published works of literature was duly acknowledged.

………………………
Babajide Oluwatoni Bamiduro Signature & Date
NDAPGS/FMSIS/ICS032019/P04053

ii
 DEDICATION

This work is dedicated to Almighty God, my creator and maker.

iii
 CERTIFICATION

This seminar entitled "Loss of Data and its Recovery on Defence Information Systems" by
Babajide Oluwatoni Bamiduro meet the requirements governing the award of Masters in Cyber
Security, Department of Intelligence and Cyber Security, Faculty of Military Science and
Interdisciplinary Studies (FMSIS), Nigeria Defence Academy, Kaduna for its contributions to
knowledge and literary representation.

………………………
Dr AE Evwiekpaefe Signature & Date
Supervisor

………………………
Navy Cdr Dr IR Saidu Signature & Date
Head of Department

………………………
Prof FN Ogwueleka Signature & Date
Dean of FMSIS

………………………
Prof YA Umar Signature & Date
Dean of Postgraduate School

iv
 ACKNOWLEDGEMENT

My special thanks goes to my supervisor, Dr AE Evweikpaefe for your guidance and direction. I
like to also thank all the lecturers who participated in imparting knowledge. Thank you and God
bless you. My gratitude goes to the management and staff of the Nigeria Defence Academy,
Kaduna.

To my family, I remain eternally grateful for all your support and encouragement. And I thank
all those who supported me morally and otherwise.

v
 ABSTRACT

Cyber security is a broad term that incorporates a wide range of techniques, technologies, and
concepts that are closely tied to information and operational technology security. Cyber security
is special in that it includes the use of information technology (IT) on the offensive to strike
adversaries. Use of the term “cyber security” as a key challenge and a synonym for information
security or IT security confuses customers and security practitioners, and obscures critical
differences between these disciplines. Recommendation for security leaders is that they should
use the term “cyber security” to designate only security practices related to the defensive actions
involving or relying upon information technology and/or operational technology environments
and systems. For the purpose of this research, cyber security will be described as the
relationships between cyber security, information security, operational security, information
technology security, risk management strategy, and other related disciplines and practices, such
as cyber defense, as they relate to their implementation in accordance with a planned or existing
national cyber security strategy. Organizations will not be able to manage cyber security risks
and they will almost certainly suffer a breach. “Visibility of cyber security status” means having
the complete picture, with measurements that can answer when the next attack or breach will
occur or what is the acceptable tolerance level to data loss, recovery, and response action plan. In
recommending way forward the research acknowledge that any strategy now is for now because
human factor was not only responsible for data loss/breaches but there was always the angle of
natural consequences which cannot be controlled.

vi
 TABLE OF CONTENT

Content Page
Title Page ………………………………………………………………………………………. i
Declaration ……………………………………………………………………………………. ii
Dedication ……………………………………………………………………………………….iii
Certification ……………………………………………………………………………….…… iv
Acknowledgement ……………………………………………………………………………… v
Abstract ………………………………………………………………………………………… vi
Table of Content ……………………………………………………………………………… vii
List of Figures ………………………………………………………………………………....... x
List of Tables …………………………………………………………………………………… xi
CHAPTER ONE..............................................................................................................................1
INTRODUCTION...........................................................................................................................1
1.1 Background of Study...................................................................................................................1
1.2 Statement of Research.................................................................................................................2
1.3 Research Questions......................................................................................................................2
1.4 Aim and Objectives of Study.......................................................................................................2
1.5 Significance of Study...................................................................................................................2
1.6 Scope of Study.............................................................................................................................3
1.7 Limitations of Study....................................................................................................................3
1.8 Seminar Organization..................................................................................................................3
1.9 Definition of Terms.....................................................................................................................4
CHAPTER TWO.............................................................................................................................5
LITERATURE REVIEW................................................................................................................5
2.0 Introduction.................................................................................................................................5
2.1 Conceptualization........................................................................................................................5
2.1.1 What is data?..............................................................................................................................5
2.1.2 What is Information Security?.............................................................................................6
2.1.3 Critical Information Infrastructure (CII)..............................................................................6
2.1.4 Threats and Hazards.............................................................................................................6
2.1.5 Impact of Data Information to Defence................................................................................7

vii
 2.1.6 Risk Management Framework (RMF).................................................................................8
2.1.7 System Development Life Cycle (SDLC)..........................................................................11
2.1.8 Security Awareness and Training Policy and Procedures..................................................12
2.1.8.1 Audit and Accountability Policy and Procedures...............................................................12
2.1.8.2 Specifically, audit records shall contain, at a minimum, the following content:................13
2.1.8.3 Audit Review, Analysis, and Reporting.............................................................................13
2.1.8.4 Security Assessment and Authorization Policy and Procedures.........................................13
2.1.9 Security Impact Analysis...................................................................................................14
2.1.10 Information System Backup...............................................................................................15
2.1.11 Information System Recovery and Reconstitution.............................................................15
2.1.12 Privacy Incident Response.................................................................................................16
2.1.13 Reciprocity.........................................................................................................................16
2.2 Literature Review......................................................................................................................16
2.3 Research Gap.............................................................................................................................21
CHAPTER THREE.....................................................................................................................242
3.0 Introduction...............................................................................................................................22
3.1 Research Design........................................................................................................................22
3.2 Source of Data Collection..........................................................................................................22
3.3 Instruments of Data Collection..................................................................................................22
3.4 Validation of the Instrument......................................................................................................22
3.5 Data Sampling...........................................................................................................................23
3.6 Data Analysis Techniques..........................................................................................................23
3.7 Method of Data Presentation....................................................................................................233
3.8 Ethical Issues...........................................................................................................................233
CHAPTER FOUR.......................................................................................................................244
FINDINGS AND RESULT.........................................................................................................244
4.0 Introduction.............................................................................................................................244
4.1 Demographics..........................................................................................................................244
4.2 Sample question “Were you able to recover your data completely after system restore or
recovery?”...........................................................................................................................................244
4.3 Sample question “What was the cause of your data loss?”......................................................255
4.4 Sample question “How regularly do you backup your database?”...........................................255
4.5 Study Result...............................................................................................................................26

viii
CHAPTER FIVE...........................................................................................................................31
SUMMARY, CONCLUSION, AND RECOMMENDATION.....................................................31
5.1 Summary....................................................................................................................................31
5.2 Conclusion.................................................................................................................................31
5.3 Recommendation.......................................................................................................................32
REFERENCES..............................................................................................................................33
APPENDIX A: QUESTIONNAIRE......................................................................................................35
APPENDIX B: DATABASE.................................................................................................................37

ix
 LIST OF FIGURES

Figure Page
Figure 2.1 Data Transition Diagram ………..………………………………….……….. 6
Figure 2.2 Elements of CI …………………………………………………..………… 7
Figure 2.3 Tiered Risk Management Approach ………………….……………………... 9
Figure 2.4 Alignment of RMF and DoD System Acquisition Activities ……………….... 12

x
 LIST OF TABLES

Table Page
Table 3.1 Age Bracket …………………………………………………..………………. 26
Table 3.2 Gender …………………...…………………………………...….…………… 26
Table 3.3 Highest Education ………………….………………..….…………………..... 26
Table 3.4 Data Loss …………………………….……...………………………………... 27
Table 3.5 Data Loss Cause ……………….. ……........................……………….….……27
Table 3.6 Backup Personally ………..……………………………………………….….. 27
Table 3.7 Backup Frequency …………………………………………...…………...…... 27
Table 3.8 Data Policy Cover ………………………………………………………....…. 27
Table 3.9 Scale (1-5)……………….. ………………..………...…………………..…… 28
Table 3.10 Security Policy ………………………………………………...……….….…. 28
Table 3.11 Public Wifi ……………………………………………………………….…... 28
Table 3.12 Stolen Device Accessibility ………………………………………………..… 29
Table 3.13 Security Measure on Device …...……………………………………….…… 29
Table 3.14 Password Characteristic …………………………………………..……….…. 30

xi
 CHAPTER ONE
INTRODUCTION

1.1 Background of Study

As per Cavelty (2010), there are numerous interlocking talks around the field of online
protection. The term network safety assists with arranging the conversation inside the two spaces
of "digital" and "security" and uncovers a portion of the inheritance issues. "Digital" suggest the
internet and alludes to electronic correspondence organizations and augmented reality (Oxford,
2014). It developed from the expression "robotics", which alluded to the "field of control and
correspondence hypothesis, regardless of whether in the machine or in the creature" (Wiener,
1948). The expression "the internet" was promoted by William Gibson's 1984 novel,
Neuromancer, in which he depicts his vision of three-dimensional space of unadulterated data,
moving among PC and PC bunches where individuals are generators and clients of the data
(Kizza, 2011).

What we currently know as the internet was planned and planned as a data climate (Singer and
Friedman, 2013), and there is an extended enthusiasm for the internet today. For instance, Public
Safety Canada (2010) characterizes the internet as "the electronic world made by interconnected
organizations of data innovation and the data on those organizations. It is a worldwide lodge
where individuals are connected together to trade thoughts, administrations, and fellowship."
Cyberspace isn't static; it is a dynamic, advancing, staggered biological system of actual
foundation

Network safety is an extensively utilized term, whose definitions are profoundly factor,
frequently emotional, and now and again, uninformative. The shortfall of a brief,
comprehensively adequate definition that catches the multidimensionality of network safety
blocks mechanical and logical advances by building up the prevalently specialized perspective
on online protection while isolating disciplines that ought to be acting in show to determine
complex network safety challenges.

1
1.2 Statement of Research
The attack on critical information infrastructure has continued to be on the increase. This could
either be manmade or natural consequence. Today, with the Covid-19 pandemic, it is evidence
that pandemic can also be a contributing factor to data vulnerability and degradation. A data
defence strategy is key for recovery and disaster management; hence, every organization should
be always prepared against attack and be capable to punish culprits within their influence.

1.3 Research Questions

Data administration is carried out by humans who are vulnerable and can make honest mistakes.
Why investigations and findings may review that such was an honest mistake, the attacker would
have done catastrophe damage to the information asset of a target. In this scenario, every
concerned and serious business will prioritize security cyber asset. However, some pertinent
questions need to be answered in achieving cyber hygiene. These include;
i. What are the major causes of computer system failure?
ii. What methods can be used to save the system's data for easy access in case of a system
failure?
iii. How can data be recovered from a failed system?
iv. What are the costs associated with system recovery by alternative methods?

1.4 Aim and Objectives of Study

The aim of the study is to review the impact of data loss and recovery plan to securing defence
information system. The objectives include:
i. To identify causes of data loss;
ii. How to prevent data loss;
iii. To establish data recovery strategy;
iv. To determine the impact of data loss on defence information system;

1.5 Significance of Study

Data is sometimes described as the new oil. This connotes that it is very important to the
functioning of any economy in comparison to actual oil that was once dubbed the black gold.
The study will therefore postulate means and measures to ensure its defence and protection

2
against damage and losses as well as recovery plan. The findings of the study will be useful to
cyber intelligence analyst, corporate businesses, law enforcement agencies, government, and
guide for future research.

1.6 Scope of Study

The scope of the study will involve the collection of relevant literatures on the subject. Design of
research approach that will collate data from reviewed literatures and primary data obtained via
quantitative approach with the use of questionnaire. The study will analyze and juxtapose
existing practices to evolve more efficient strategies.

1.7 Limitations of Study

The study is restricted to data losses and recovery of information system only. The nature of the
research is quantitative method. The questionnaire was designed with close-ended questions.

1.8 Seminar Organization

The study has been structured in a way that different aspects of the research findings will be
categorized under five chapters in the report. This will allow for a well organized and structured
report on the seminar align with is academic format for reporting and presenting research
findings. Meanwhile, the preceding pages will contain the title page, dedication, certification and
acknowledgement.
i. Chapter one: The background of the research will be introduced. Among others, the
research questions for why the study is being carried out will be articulated, the aim and
objectives of the study will be stated. And, definition of key terms that will be used in
conveying information will be described and in addition abbreviated where necessary.
ii. Chapter two: This chapter will introduce the idea that will be discussed for the framework
of the study. These ideas will be drawn from the work of previous scholars on the subject.
The gaps identified will also form the research questions and questions to be tested under
sampling and analysis.
iii. Chapter three: Research methodology will be discussed under this chapter. First, an
overview of the methodologies will be introduced. The study will then proceed to discuss
these methods one after the other.

3
 iv. Chapter four: This chapter will discus and report the findings of the study.
v. Chapter five: The entire study will be captured in this chapter under summary. The
conclusion will be presented in one paragraph, and the recommendation will bring the
report final conclusion in regards to the main work.

1.9 Definition of Terms

Commercial Off-The-Shelf (COTS):
Critical Information Infrastructure (CII):
Cyber: This can be described as anything that has to do with computer.
Data loss: Damage or losses suffered from an attack or system failure.
Data recovery: Any strategic plan that will enable recovery of a system operations after an
attack or failure with minima interruption and unavailability of operation.
Defense Information System for Security (DISS):
Department of Defense (DoD):
Information Security (INFOSEC):
Risk Management: Risk management is a practice that enable resources and equipment to be
examine for potential vulnerability and threat and therefore prioritize security in a layered form.
Risk Management Framework (RMF)

System Development Life Cycle (SDLC)

System security plan (SSP)

Total Hospital Information System (THIS):

4
 CHAPTER TWO
LITERATURE REVIEW

2.0 Introduction
Economy, technology, military, etc, are among the very few indices used in ranking a stable and
strong nation. A country like Nigeria, before discovering oil in commercial quantities, sustained
itself through agricultural produces. This soon paved way for oil, which became the mainstay
and source of income. It was once dogged the black gold. However, in the present day, data have
been dogged the new oil. The significance of data to Nigeria’s economy or that of any other
country cannot be overstated. Rather, this should be explored and leveraged to build strong
economy, which can be adjudged as being equal to strong a nation. This study is faced with the
heaculean challenge of discussing data loss and recovery on defence information systems and of
course, contributing to knowledge in alleviating and mitigating the factors that are most likely to
undermine the cyber hygiene. But first, the framework of the research will be developed from a
careful plan and ideas. These ideas will be outlined under conceptualization while existing
opinion on the subject will be discussed under literature review and the identified gaps in them
will contribute to the research questions.

2.1 Conceptualization
The Cambridge Advanced Learner's Dictionary defines concept as means, a principle or idea. In
the analytical school of philosophy, the subject matter of philosophy is held to be the salient
features of the language in which men speak of concepts at issue. Concepts are thus logical, not
mental entities. This study will look at empirical evidence postulated by scholars in existing
literatures to make inferences along with the primary data that will be obtained for data analysis.

2.1.1 What is data?

The study will want to go with a simple definition of data in a layman’s term; can be described
as raw information, unprocessed information, meaningless information, figures, numbers, etc.
That is anything that does not convey meaning or make sense to the recipient.

5
The definition in item 2.1.1, contradicts the postulation in item 2.1. Fortunately, the layman’s
term expressed the meaning of data as “meaningless-information”. If this compound phrase were
to be separated, there will be “meaningless information” on one hand and “unprocessed
information” on another. In the two phrases cited, there is a recurring decimal; that is
“information” while the other words used along are meaningless and unprocessed.

Prepare Informatio Intelligence

Data Process n

Figure 2.1: Data Transition Diagram

2.1.2 What is Information Security?

Information systems security, more commonly referred to as INFOSEC, refers to the processes
and methodologies involved with keeping information confidential, available, and assuring its
integrity.

2.1.3 Critical Information Infrastructure (CII)

i. Critical infrastructure (CI) includes the assets, systems, facilities, networks, and other
elements that society relies upon to maintain national security, economic vitality, and public
health and safety. We know critical infrastructure as the power used in homes, the water we
drink, the transportation that moves us, the stores where we shop, and the Internet and
communications we rely on to maintain our contact with friends, family, and colleagues.
ii. CI Ownership: In the U.S., physical and cyber infrastructure are typically owned and
operated by the private sector, though some are owned by federal, state, or local
governments.

2.1.4 Threats and Hazards

Threats and hazards may be specific to geographic regions, or across an entire country, and
may even have global ramifications; such as:
i. Climatological Events (extreme temperatures, drought, wildfires)
ii. Hydrological Events (floods)

6
 iii. Meteorological Events (tropical cyclones, severe convective storms, severe winter storms)
iv. Geophysical Events (earthquakes, tsunamis, volcanic eruptions)
v. Pandemics (global disease outbreaks)
vi. Space Weather Events (geomagnetic storms)
vii. Technological and Industrial Accidents (structural failures, industrial fires, hazardous
substance releases, chemical spills)
viii. Unscheduled Disruptions (aging infrastructure, equipment malfunction, large scale power
outages)
ix. Criminal Incidents and Terrorist Attacks (vandalism, theft, property damage, active shooter
incidents, kinetic attacks)
x. Cyber Incidents (denial-of-service attacks, malware, phishing)
xi. Supply Chain Attacks (exploiting vulnerabilities to cause system or network failure)
xii. Foreign Influence Operations (to spread misinformation or undermine democratic
processes)
xiii. Untrusted Investment (to potentially give foreign powers undue influence over American
critical infrastructure)

Figure: 2.2: Elements of CI (Source: NIPP, 2013)

2.1.5 Impact of Data Information to Defence

What is the Defense Information System for Security (DISS)?
According to a report by Defense Manpower Data Center (2017), DISS serves as the system of
record for personnel security, suitability and credential management of all DoD employees,
military personnel, civilians and DoD contractors. DISS also provides secure communications
between Adjudicators, Security Officers and Component Adjudicators in support of eligibility
and access management.

7
2.1.6 Risk Management Framework (RMF)
a. NIST, in partnership with DoD, the Office of the Director of National Intelligence (ODNI),
and CNSS, developed a common information security framework for the federal government and
its contractors to improve information security, strengthen risk management processes, and
encourage reciprocity among federal agencies. NIST SP 800-37, developed by the Joint Task
Force (JTF) Transformation Initiative Working Group, transforms the traditional C&A process
into the six-step RMF. The revised process emphasizes:
i. Building information security capabilities into federal information systems through the
application of community best practices for management, operational, and technical
security controls;
ii. Maintaining awareness of the security state of information systems on an ongoing basis
through enhanced monitoring processes; and
iii. Providing essential information to senior leaders to facilitate decisions regarding the
acceptance of risk to organizational operations and assets, individuals, other
organizations, and national security arising from the operation and use of information
systems.

b. The six-step RMF is depicted in Figure 2-1. The RMF steps include:
i. Categorize the IS and the information processed, stored, and transmitted by the system
based on an analysis of the impact due to a loss of confidentiality, integrity, and
availability.
ii. Select an initial set of baseline security controls for the IS based on the security
categorization; apply overlay(s), if applicable; then tailor the security control baseline as
needed based on an organizational assessment of risk and local conditions.
iii. Implement the security controls and describe how the controls are employed within the
IS and its environment of operation.
iv. Assess the security controls using appropriate assessment procedures to determine the
extent to which the controls are implemented correctly, operating as intended, and
producing the desired outcome with respect to meeting the security requirements for the
system.

8
 v. Authorize IS operation based on a determination of the risk to organizational operations
and assets, individuals, other organizations, and national security resulting from the
operation of the IS and the decision that this risk is acceptable.
vi. Monitor the security controls in the IS on an ongoing basis to include assessing control
effectiveness, documenting changes to the system or its environment of operation,
conducting security impact analyses of the associated changes, and reporting the security
state of the system to designated organizational officials.

b. Each RMF step includes associated tasks to be carried out by the appropriate organization or
individual. These steps and the tasks associated with them, as they apply to the DoD SAP
Community and to all IS under the purview of the cognizant SAP AO. For additional details
regarding RMF, see NIST SP 800-37.

Figure 2.3: Tiered Risk Management Approach

(Source: Department of Defense (DoD), 2016)

According to a DoD (2016) document, Tier 1 addresses risk from an organizational perspective
with the development of a comprehensive governance structure and organization-wide risk

9
management strategy. For the DoD SAP Community, this includes governance provided by the
DoD, DoD SAPCO and respective Service/Agency SAPCOs and includes the:
i. Techniques and methodologies the organization plans to employ to assess information
system-related security risks and other types of risk of concern to the organization;
ii. Methods and procedures the organization plans to use to evaluate the significance of the
risks identified during the risk assessment;
iii. Types and extent of risk mitigation measures the organization plans to employ to address
identified risks;
iv. Level of risk the organization is willing to accept (i.e., risk tolerance);
v. Organization’s plans to monitor risk on an ongoing basis given the inevitable changes to
organizational information systems and their environments of operation; and
vi. Degree and type of oversight the organization plans to use to ensure that the risk
management strategy is being effectively carried out.

Level 2 tends to hazard from a mission and business measure point of view and is directed by the
danger choices at Level 1. Level 2 exercises are firmly connected with big business engineering,
to incorporate Wide Region Organization (WAN) administrations (i.e., spine interchanges),
venture administrations, (for example, review decrease devices, network observing instruments,
character the executive's frameworks), and administrations gave across a site/grounds (e.g.,
physical and faculty security). Since subordinate associations answerable for doing subsidiary or
related missions and business cycles might have effectively put resources into their own
techniques for surveying, assessing, relieving, tolerating, and observing danger. Parent
associations might permit a more noteworthy level of self-governance inside pieces of the
association or across the whole association to limit costs. At the point when a variety of hazard
evaluation strategies is permitted, associations might decide to utilize, when practical, a few
methods for reconciliation of the danger-related data to guarantee that the yield of the diverse
danger appraisal exercises can correspond in a significant way. (DoD, 2016).

Level 3 tends to chance from a data framework viewpoint and is directed by the danger choices
at Levels 1 and 2. Hazard choices at Levels 1 and 2 affect a definitive determination and sending
of required shields and countermeasures (i.e., security controls) at the data framework level. Data

10
security necessities are fulfilled by the choice and fruitful execution of fitting administration,
functional, and specialized security controls from NIST SP 800-53. For all DoD SAP data
frameworks under the domain of the insightful SAP AO, security control choice is directed by
the RMF cycle as coordinated by DoDM 5205.07, DoD SAP Security Manual, and depicted in
the JSIG. (DoD, 2016).

2.1.7 System Development Life Cycle (SDLC)

According to DoD (2016), all federal information systems, including operational systems,
systems under development, and systems undergoing modification or upgrade, are in some phase
of a SDLC. NIST identifies five phases of a general SDLC as Initiation,
Acquisition/Development, Implementation/Assessment, Operations/Maintenance, and
Disposition/Sunset. Risk management tasks begin early in the SDLC and are important in
shaping the security capabilities of the information system. If these tasks are not adequately
performed during the initiation, development, and acquisition phases of the SDLC, the tasks will,
by necessity, be undertaken later in the life cycle and be more costly to implement. In either
situation, all tasks must be completed prior to placing the information system into operation, or
continuing its operation, to ensure that information system-related security risks are adequately
addressed on an ongoing basis and that the Authorizing Official (AO) explicitly understands and
accepts the risk to organizational operations and assets, individuals, other organizations, and
national security based on the implementation of the defined set of security controls and the
current security state of the information system.

11
 Figure 2.4: Alignment of RMF and DoD System Acquisition Activities
(Source: DoD, 2016)

2.1.8 Security Awareness and Training Policy and Procedures

a. Develops, documents, and disseminates to organization-defined personnel.
i. A security awareness and training policy that addresses purpose, scope, roles,
responsibilities, management commitment, coordination among organizational entities,
and compliance; and
ii. Procedures to facilitate the implementation of the security awareness and training policy
and associated security awareness and training controls; and
b. Reviews and updates the current:
i. Security awareness and training policy at least annually; and
ii. Security awareness and training procedures at least annually.

2.1.8.1 Audit and Accountability Policy and Procedures

a. Develops, documents, and disseminates to organization-defined personnel:

12
 i. An audit and accountability policy that addresses purpose, scope, roles, responsibilities,
management commitment, coordination among organizational entities, and compliance;
and
ii. Procedures to facilitate the implementation of the audit and accountability policy and
associated audit and accountability controls; and
b. Reviews and updates the current:
i. Audit and accountability policy at least annually; and
ii. Audit and accountability procedures at least annually.

2.1.8.2 Specifically, audit records shall contain, at a minimum, the following content:
i. USERID
ii. Type of event/action
iii. Success or failure of event/action
iv. Date
v. Time
vi. Terminal or workstation ID
vii. Entity that initiated event/action
viii. Entity that completed event/action
ix. Remote Access

2.1.8.3 Audit Review, Analysis, and Reporting

i. Reviews and analyzes information system audit records at least weekly for indications of
any inappropriate or unusual activity; and
ii. Reports findings to organization-defined personnel.

2.1.8.4 Security Assessment and Authorization Policy and Procedures

a. Develops, documents, and disseminates to organization-defined personnel:
i. A security assessment and authorization policy that addresses purpose, scope, roles,
responsibilities, management commitment, coordination among organizational entities,
and compliance; and

13
 ii. Procedures to facilitate the implementation of the security assessment and authorization
policy and associated security assessment and authorization controls; and
b. Reviews and updates the current:
i. Security assessment and authorization policy at least annually; and
ii. Security assessment and authorization procedures at least annually.

2.1.9 Security Impact Analysis

The organization analyzes change to their information system to determine potential security
impacts prior to change implementation. Security impact analysis is the deliberate consideration
of the impact of a change on the security state of the information system. (ISs) are typically in a
constant state of change, it is important to understand the impact of changes on the functionality
of existing security controls. Security impact analysis must be incorporated into the documented
configuration change control process. The ISSM/ISSO shall be involved in determining if a
configuration change has a security impact. Factors considered in assessing software risk
involve:
i. Importation of Malicious Content: This is essentially a supply chain issue. Although
we perceive that US sources are less likely to target the US, with multi-national firms and
commercial open source, software (like hardware) comes from everywhere. That said,
most of the repositories attempt to be malware free.
ii. Importation of Vulnerable Content: This factor relates to code quality including
software assurance that the libraries used by applications are updated and that latent
vulnerabilities in the executables are addressed/mitigated/removed.
iii. Remediation of Functional or Security Deficiencies in Operational Software: This
factor addresses effective sustainment to determine if the developer addresses identified
vulnerabilities in a timely manner. It’s not uncommon to have open source firms have
patches posted in a few days where the commercial firms may lag for months. When
developers and vendors abandon products (for various reasons), it can leave the consumer
with orphan or zombie software. It can take deep pockets to pay for sustainment and
delay an end-of-life deadline.

14
 iv. Legal Compliance: Licensing, copyrights, and intellectual property rights vary
dependent on the software type, e.g., open source software, commercial off-the-shelf
(COTS).
v. Costs of (i - iv): Cost is often linked to platform and applications. For example, open
source software is more common in the *nix environments (e.g., UNIX, LINIX), than in
Windows, where the greatest cost tends to be for sustainment and licensing.

2.1.10 Information System Backup

i. Conducts backups of user-level information contained in the information system at least
weekly or as defined in the contingency plan;
ii. Conducts backups of system-level information contained in the information system at
least weekly or as defined in the contingency plan;
iii. Conducts backups of information system documentation including security-related
documentation when created, received, updated, or as defined in the contingency plan or
at least annually; and
iv. Protects the confidentiality, integrity, and availability of backup information at storage
locations.

2.1.11 Information System Recovery and Reconstitution

Control: The organization provides for the recovery and reconstitution of the information system
to a known state after a disruption, compromise, or failure.
Supplemental Guidance: Recovery is executing information system contingency plan activities
to restore organizational missions/business functions. Reconstitution takes place following
recovery and includes activities for returning organizational information systems to fully
operational states. Recovery and reconstitution operations reflect mission and business priorities,
recovery point/time and reconstitution objectives, and established organizational metrics
consistent with contingency plan requirements. Reconstitution includes the deactivation of any
interim information system capabilities that may have been needed during recovery operations.
Reconstitution also includes assessments of fully restored information system capabilities,
reestablishment of continuous monitoring activities, potential information system

15
reauthorizations, and activities to prepare the systems against future disruptions, compromises, or
failures.

2.1.12 Privacy Incident Response

i. Develops and implements a Privacy Incident Response Plan; and
ii. Provides an organized and effective response to privacy incidents in accordance with the
organizational Privacy Incident Response Plan.

2.1.13 Reciprocity
Reciprocity is defined as a “Mutual agreement among participating enterprises to accept each
other’s security assessments in order to reuse information system resources and/or to accept each
other’s assessed security posture in order to share information.” [CNSSI 4009]

This agreement, however, does not imply blind acceptance. The body of evidence used for
assessments of the subject system will be provided to the other participant(s) who have a vested
interest in establishing a mutual agreement. The receiving party will review the assessment
evidence (e.g., system security plan (SSP), test plans, test procedures, test reports, exceptions)
and determine if there are any deltas in the evidence, (e.g., baseline/overlay controls that were
tailored, a test item that was omitted), and identify items that may require negotiations. [CNSSI
4009]. Reciprocity means that the system(s) will not be retested or undergo another full
assessment. In the spirit of reciprocity, the existing assessments will be accepted; only controls,
test items or other pertinent items that were initially omitted are subject to evaluation/testing to
assure the system meets any additional protections required for a successful reciprocal
agreement. [CNSSI 4009].

2.2 Literature Review

As per Samy et al. (2010) in their investigation, they noticed that the most fundamentally saw
danger for the Total Hospital Information System (THIS) was a force disappointment. Past
studies additionally observed force inability to be perhaps the most basic dangers to HIS.
Accordingly, power disappointment was a significant issue in HIS and requires quick reaction to
forestall security occurrences. Also, data frameworks and crucial help hardware disappointment

16
because of absence of force supply would disturb the typical activities of the frameworks. For
instance, the interviewees communicated concern especially about prompt loss of information
because of strange closure or after power returns. A portion of the staff additionally clarified that
the circumstance turns out to be more regrettable if power disappointment influences the worker
rooms and the forced air systems. Be that as it may, there are a few ways to deal with taking care
of force disappointment as a security danger. The initially was double or isolated feeder lines for
HIS and supporting gear. Another was to give power-level alarm screens as a recognition
measure. Another was the utilization of uninterruptible force supplies (UPS) in mix with full-
scale backup power offices like generators, inside an adequate expense. As indicated by Samy et
al. (2010), specialists, data security officials, and policymakers perceive the seriousness and
importance of innovative factors like mechanical out of date quality, equipment disappointments,
and programming disappointments, and rate these as huge data security dangers in HIS. Non-
mechanical factors, for example, human blunder likewise show a high recurrence of event,
however tragically, dangers emerging from human mistake were to a great extent ignored.
Besides, work resolving this issue stayed restricted, and the issues have not been altogether
examined. That the examination tried to investigate such human mistakes more meticulously, yet
further exploration was required.

In an investigation directed by Ochi et al. (2014), during any catastrophe, drug support was
tricky because of individuals not having satisfactory measurements for an adequate timeframe,
not having solutions with them, not recalling the medicine they were on, and almost certain not
having any prescription with them whatsoever. These individuals have been portrayed as 'drug
exiles'. In the Incomparable East Japan Tremor in 2011, for instance, countless 'drug evacuees'
were accounted for, and no less than 283 individuals were accounted for to have passed on from
the worsening of previous conditions because of absence of admittance to medical services. The
wellbeing impacts on drug evacuees have had, little exploration led among the influenced
populace. For instance, as per a review survey on the patients seen by a Catastrophe Clinical
Help Group during four outrageous occasions in New Mexico, US, the extent of the patients
visiting for prescription reorder was 6.0% inside 7 days from the occasions and 7.6% following 7
days. The examination noticed that the study was led on comfort tests, which made it difficult to
sum up past that specific populace. Ochi et al. (2014) likewise saw that the greater part of the

17
important articles were from the US, and a huge extent explicitly centered around typhoon
Katrina. Regardless of whether the issue of prescription misfortune was less an issue in
agricultural nations or basically less habitually contemplated or potentially distributed was not
satisfactory. There was an unmistakable requirement for proof from everywhere the world, and
from the most underestimated, in this manner seldom detailed, populaces.

In an online distribution still on typhoon Katrina, Krousel-Wood (2009) believed that medical
services suppliers ought to urge their patients to incorporate arrangement ahead of time for
getting to meds for persistent sicknesses and illness the board in their fiasco arrangements (e.g,
satisfactory stockpile of drugs, plan for reordering solutions, and checking circulatory strain and
another infection status); use update frameworks and family/companion support for patients
inclined to accidental non-adherence; and have a printed copy, exceptional rundown of their
ailments and the prescriptions they take for every one. Medical care suppliers dealing with
patients in post-debacle circumstances ought to consider medicine non-adherence as a potential
contributing variable when ailments were not controlled. Medical services frameworks in
misfortune inclined regions ought to guarantee admittance to patient clinical and drug store
records (e.g, electronic clinical records) to work with recordkeeping and medicine tops off. In
patients going through hemodialysis, postponed clearing (ie, under two days before Storm
Katrina), arrangement in a haven (versus other departure areas), absence of clearing plan
mindfulness, and a more drawn out relocation were identified with poor psychosocial wellbeing
(e.g, adapting, personal satisfaction, and additionally melancholy) after the fiasco.

Walker (n.d.) in an investigation noticed that network protection has gotten a question of public,
financial, and cultural significance. That assaults on the country's PC frameworks don't just harm
a confined machine or disturb a solitary endeavor framework. All things being equal, current
assaults target foundation that are essential to the economy, public protection, and every day life.
PC networks have joined food, water, transportation, and energy as basic assets for the working
of the public economy. At the point when one of these key cyberinfrastructure frameworks is
assaulted, similar outcomes exist for a catastrophic event or psychological oppressor assault.
Public or nearby assets should be conveyed. Choices are made to figure out where to send assets.
The inquiry would be who settles on these choices? The information needed to settle on and

18
screen the choices, and the area of accessible information to drive them may some of the time be
obscure, inaccessible, or both.

Occasions on the global stage show a comparable absence of network protection situational
mindfulness concerning cyberinfrastructure assets. In January 2009, the Service of Guard in the
Unified Realm detailed that for about fourteen days it didn't approach PC frameworks inside the
Illustrious Naval force due to a malware assault that had left the framework difficult to reach to
its faculty. During a similar period in the Assembled Realm, a few emergency clinics
experienced a comparable assault, and after a month in February, London emergency clinics lost
all organization network due to malware diseases that happened toward the finish of 2008.
Simultaneously in the U.S., the civil court framework in Houston, TX was tainted likewise
bringing about a suspension of court procedures and compelling nearby cops to suspend
capturing people for minor offenses (Amin, Litrico, Sastry, and Bayen, 2010; Bayer, Kirda, and
Kruegel, 2010; Maughan, 2010; Neumann, 2010).

A Country wherein physical and digital basic framework stay secure and versatile, with
weaknesses diminished, results limited, dangers distinguished and upset, and reaction and
recuperation rushed. This vision drives the fundamental way to deal with basic foundation
security and versatility, to, fortify the security and strength of the Country's basic framework, by
overseeing physical and digital dangers through the communitarian and coordinated endeavors of
the basic framework local area. (NIPP, 2013).

Galinec et al. (2017) in their exploration noticed that network protection breaks, for example,
those at Ashley Madison, the US Office of Staff The board, and JP Morgan Pursue had exhibited
the genuine danger from digital breaks. Overseer of the Public safety Office and top of the US
Digital Order, Chief of naval operations Mike Rodgers was moved to an express that It was not
about in the event that you will be entered yet when'. Accordingly, there was a dire requirement
for associations to genuinely comprehend their network safety status and where important make
critical therapeutic moves to correct shortcomings. In case there was not adequate perceivability
of network safety status, associations can not oversee online protection dangers and they will
very likely experience a break. "Perceivability of network protection status" signifies having the

19
total picture, with estimations so we can address the accompanying inquiries: (1) What are our
present estimated levels of network protection hazard across the Endeavor from the various
dangers that we face? (2) Are these network protection hazards decent? (3) If not, what is our
advocated and focused on arrangement for dealing with these dangers down to average levels?
(4) Who is capable and by when?

As indicated by Murphy et al. (2006), information the executives inside EM is an act of

specifically applying information from past encounters of chiefs to the current and future
exercises fully intent on working on individual or hierarchical adequacy as far as the necessary
crisis the board (EM) undertakings. Information the board and dispersal for current EM
undertakings are connected straightforwardly and in a roundabout way by cyberinfrastructure
structures which, comprises of PC frameworks, information and data the executives, progressed
instruments, perception conditions, and the internet all connected together by programming and
complex organizations (Elmagarmid et al., 2008; Feng and Lee, 2010; Hong and Lindu, 2009).
Subsequently, cyberinfrastructure empowers the capacity and move of monstrous measures of
information to empower arranging, asset allotment, staff sending, and coordination of crisis
circumstances (Becerra-Fernandez et al., 2008).

As per Laxmi, et al. (2018), reinforcements can be utilized for essential recuperation of
information after its misfortune, be it by information cancellation or defilement and the optional
motivation behind reinforcements was to recuperate information from a prior time, as per a client
characterized information maintenance strategy, regularly arranged inside a reinforcement
application for how long duplicates of information were required. However, reinforcements
address a straightforward type of catastrophe recuperation and ought to be essential for any
calamity recuperation plan, reinforcements without help from anyone else ought not be viewed
as a total fiasco recuperation plan. One justification this was that not all reinforcement
frameworks had the option to reconstitute a PC framework or other complex design, for example,
a PC group, dynamic registry worker, or data set worker by basically reestablishing information
from a reinforcement.

20
Basic framework is the establishment on which day by day indispensable cultural and monetary
capacities depend, and disturbance or misfortune to any component of basic foundation can
possibly seriously affect our lives. Cooperating and sharing great practices, approaches, and
encounters will help advance and improve public and worldwide basic framework security and
versatility today and later on. (NIPP, 2013).

2.3 Research Gap

The study reviewed a number of literatures related to the research topic, the study identified gaps
in the literatures which this study sought to fill. These gaps include;
i. The observation of Galinec et al. (2017) in their studies that breaches are impossible,
however risk management response must be up and doing;
ii. That there was no enough awareness and seamless harmonious working relationships
contemporaries;
iii. Organizational structure can affect response to emergency,
iv. That the data required to make and monitor the decisions, and the location of available
knowledge to drive them may sometimes be unknown, unavailable, or both.
v. Study noted that according Murphy & Jennex (2006), knowledge management within EM
was a practice of selectively applying knowledge from past experiences of decision
makers to the current and future activities with the purpose of improving individual or
organizational effectiveness in terms of the required emergency management (EM) tasks.

21
 CHAPTER THREE
RESEARCH METHODOLOGY

3.0 Introduction
This chapter discusses the methods adopted for as methodology for the study, which are on
research design, sources of data collection, instruments of data collection and validation of
instruments, sampling specimen, data analysis technique, method of data presentation, and
ethical issues.

3.1 Research Design

The research design approach was that of quantitative. The research nature of the research was a
close-ended questions where questions were posed to the respondents and choice of answers
were listed from where the respondent was expected to choose from, the research was designed
to factor in both primary and secondary sources of the for the analysis. The sample
questionnaire is listed as Appendix A,

3.2 Source of Data Collection

The sources of data collection were primary and secondary data. The study made use of
questionnaire to obtain primary data while secondary data was collected via online material such
as the internet, NDA library, magazines, journals, literatures on related work. The questionnaire
was uploaded via Google form for participants to fill online.

3.3 Instruments of Data Collection

The instrument for the data collection questionnaire. This instrument as choice for the survey
comes with the benefits of reaching large respondents to completed the form thereby hitting
sizeable population. The questionnairewas deployed online. The platform used was Google form.

3.4 Validation of the Instrument

The use of questionnaire has the robustness to sample huge population compared to other
instruments that may be restrictive. The case study used multiple sources to provide validity and
reliability to the study (Yin, 2014).

22
3.5 Data Sampling
Random sampling was used to choose the sample questions and variables to conduct the test on.
This resulted in frequency tables and charts. The full models are indicated in Item 3.7 while the
narrative was discussed in Chapter four.

3.6 Data Analysis Techniques

The nature of the questionnaire used was closed-ended questions. Statistical Package for the
Social Sciences (SPSS) was used to evaluate the data collected. Analysis is a process that allows
the data to be examined so as to make sense out of the data analyzed. Microsoft Excel was used
for the database.

3.7 Method of Data Presentation

The method of data presentation are numerous. These include text, figures, charts and tables.
This study deployed most of these methods in presenting the analyzed data. Only then that the
data collected can make sense to the target audience.

3.8 Ethical Issues

The study applied all cautions in conformity to ethics and professional conducts required for
conducting research. The respondents were made abundantly clear that they were participating in
a survey. Their privacy was respected, in fact the study ensured but not providing fields that will
reveal their identity without rigorous efforts.

23
 CHAPTER FOUR
RESULTS AND DISCUSSION

4.0 Introduction
Discussed in this chapter were the findings for the research. The discussion was present in
infographics using bar charts and pie charts highlighting the responses and behavioural pattern of
the participants. The demographics of the targeted population is described under item 4.1. The
result and interpretation are discussed under item 4.5.

4.1 Demographics
The population of the participants were between the age range of 20 to 69 years old, made up of
Nigerians residing within the country as at the time of the study, compromising of 69.1% male
and 30.9% female. Their educational level range between HND and PhD, though Masters degree
educated, representing 58.8%, were of the majority population.

4.2 Sample question “Were you able to recover your data completely after system
restore or recovery?” Table 3.5: Data Loss Cause

90

80

70

60

50

40

30

20

10

0
Fully Partially Never experienced

24
4.3 Sample question “What was the cause of your data loss?”

Data Loss Cause

100%
90%
80%
70% 2.9
60%
50% 16.2
26.5
40%
30% 54.4
20% 1
10%
2
0%
3
Change my device 4
Lost my device
Stolen
Storage corrupted

4.4 Sample question “How regularly do you backup your database?”

Data Policy Cover

Daily None Twice monthly
Twice weekly Weekly Whenever I feel like
10%
9%
43%
10%

7%
21%

25
4.5 Study Result
The data analysis presented in the frequency Table 4.5 to Table 4.18 under this result highlighted
the targeted population response to the research questions which the sample cases were discussed
in infographics under item 4.2 to item 4.4 with the use of bar and pie charts suggested the human
factor was largely a contributing ingredient to data losses through deviant and nonchalant
attitude while that of natural consequence can only be awaited. It is in this regard that the
research proffers way forward in chapter five in minimizing this sad reality.

Table 4.5: Age Bracket

Cumulative
Frequency Percent Valid Percent Percent

Valid 20 - 29 yrs 30 44.1 44.1 44.1

30 - 39 yrs 31 45.6 45.6 89.7

40 - 49 yrs 4 5.9 5.9 95.6

50 - 59 yrs 3 4.4 4.4 100.0

Total 68 100.0 100.0

Table 4.6: Gender

Cumulative
Frequency Percent Valid Percent Percent
Valid Female 21 30.9 30.9 30.9

Male 47 69.1 69.1 100.0

Total 68 100.0 100.0

Table 4.7: Highest Education

Cumulative
Frequency Percent Valid Percent Percent

Valid HND/PGD/BSc 28 41.2 41.2 41.2

Masters 40 58.8 58.8 100.0

Total 68 100.0 100.0

26
Table 4.8: Data Loss

Cumulative
Frequency Percent Valid Percent Percent

Valid No 7 10.3 10.3 10.3

Yes 61 89.7 89.7 100.0

Total 68 100.0 100.0

Table 4.9: Data Loss Cause

Cumulative
Frequency Percent Valid Percent Percent

Valid Fully 11 16.2 16.2 16.2

Never experienced 4 5.9 5.9 22.1

Partially 53 77.9 77.9 100.0

Total 68 100.0 100.0

Table 4.10: Backup Personally

Cumulative
Frequency Percent Valid Percent Percent

Valid Change my device 2 2.9 2.9 2.9

Lost my device 11 16.2 16.2 19.1

Stolen 18 26.5 26.5 45.6

Storage corrupted 37 54.4 54.4 100.0

Total 68 100.0 100.0

Table 4.11: Backup Frequency

Cumulative
Frequency Percent Valid Percent Percent

Valid No 11 16.2 16.2 16.2

Yes 57 83.8 83.8 100.0

Total 68 100.0 100.0

Table 4.12: Data Policy Cover

27
 Cumulative
Frequency Percent Valid Percent Percent

Valid Daily 7 10.3 10.3 10.3

None 6 8.8 8.8 19.1

Twice monthly 7 10.3 10.3 29.4

Twice weekly 5 7.4 7.4 36.8

Weekly 14 20.6 20.6 57.4

Whenever I feel like 29 42.6 42.6 100.0

Total 68 100.0 100.0

Table 4.13: Scale (1-5)

Cumulative
Frequency Percent Valid Percent Percent

Valid Maybe 26 38.2 38.2 38.2

No 15 22.1 22.1 60.3

Yes 27 39.7 39.7 100.0

Total 68 100.0 100.0

Table 4.14: Security Policy

Cumulative
Frequency Percent Valid Percent Percent

Valid 1 14 20.6 20.6 20.6

2 4 5.9 5.9 26.5

3 29 42.6 42.6 69.1

4 18 26.5 26.5 95.6

5 3 4.4 4.4 100.0

Total 68 100.0 100.0

Table 4.15: Public Wifi

Cumulative
Frequency Percent Valid Percent Percent

Valid Maybe 6 8.8 8.8 8.8

No 11 16.2 16.2 25.0

Yes 51 75.0 75.0 100.0

28
 Total 68 100.0 100.0

Table 4.16: Stolen Device Accessibility

Cumulative
Frequency Percent Valid Percent Percent

Valid Maybe 19 27.9 27.9 27.9

No 36 52.9 52.9 80.9

Yes 13 19.1 19.1 100.0

Total 68 100.0 100.0

Table 4.17: Security Measure on Device

Cumulative
Frequency Percent Valid Percent Percent

Valid Biometric 2 2.9 2.9 2.9

Biometric;Pattern codes 2 2.9 2.9 5.9

None 2 2.9 2.9 8.8

Password 6 8.8 8.8 17.6

Password;Biometric 1 1.5 1.5 19.1

Password;Biometric;Pattern 11 16.2 16.2 35.3

codes

Password;Pattern codes 1 1.5 1.5 36.8

Pattern codes 2 2.9 2.9 39.7

PIN codes 5 7.4 7.4 47.1

PIN codes;Biometric 4 5.9 5.9 52.9

PIN codes;None 1 1.5 1.5 54.4

PIN codes;Password 6 8.8 8.8 63.2

PIN 14 20.6 20.6 83.8

codes;Password;Biometric

PIN 8 11.8 11.8 95.6

codes;Password;Biometric;P
attern codes

PIN codes;Password;Pattern 3 4.4 4.4 100.0

codes

Total 68 100.0 100.0

29
Table 4.18: Password Characteristic

Cumulative
Frequency Percent Valid Percent Percent

Valid Combination of text and 57 83.8 83.8 83.8

special characters such as
commas, asterisks, harsh

I do not use password 5 7.4 7.4 91.2

Plain numerals (less than 6 8.8 8.8 100.0

seven digits)

Total 68 100.0 100.0

30
y

CHAPTER FIVE
SUMMARY, CONCLUSION, AND RECOMMENDATION

5.1 Summary
The study combined the research questions, research gap, and analyzed data collected using
frequency tables and coding of the data with SPSS software, developed the answers to the
research questions, and research gap. The findings of the study were limited to data loss and
recovery of information systems. The findings of the research indicated that data breach in the
first instance cannot totally be avoided which could be as a result of intentional cyberattack, theft
or damage of computer systems or natural consequences while the need for operations to be
restored by merely replacing the damaged computer system or rebuilding the database from
backups or from the scratch.

5.2 Conclusion
In conclusion, the watch word for any business or organization into data mining or
administration will be to anticipate the next attack as succinctly put by Admiral Mike Rodgers It
was not about if you will be penetrated but when’. In response, there was an urgent need for
organizations to truly understand their cyber security status and where necessary take urgent
remedial actions to rectify weaknesses. If there was not sufficient visibility of cyber security
status, organizations will not be able to manage cyber security risks and they will almost
certainly suffer a breach. “Visibility of cyber security status” means having the complete picture,
with measurements so that can answer the following questions:
i. What are our current measured levels of cyber security risk across the Enterprise from the
multiple threats that we face?
ii. Are these cyber security risks tolerable?
iii. If not, what is our justified and prioritized plan for managing these risks down to
tolerable levels?
iv. Who is responsible and by when?

31
5.3 Recommendation
The research noted that data breaches is an ongoing discussion, and research in this area
regrettable can never be exhaustive as future research will always address the now, nevertheless,
the study in chatting a way forward on data losses and recovery on defense information systems
will not be concluded without recommendations in dealing with challenges of the now as they
appear include;
i. Every enterprise must know their like attack agent whether human or natural
consequences in their domain through regular vulnerability and risk assessment of their
critical information infrastructure;
ii. Every enterprise should define their tolerable/acceptable risks;
iii. Specific role should be assigned to employees who will be responsible and answerable
for performance and non-performance of such function;
iv. Have policy for disaster management that addresses data loss, recovery, and response
plan and backup, and backup, and backup your database.

32
 REFERENCES

Amin, S., Litrico, X., Sastry, S. S., & Bayen, A. M. (2010). Stealthy deception attacks on water
SCADA systems. Paper presented at the Proceedings of the 13th ACM international
conference on Hybrid systems: computation and control.
Bayer, U., Kirda, E., & Kruegel, C. (2010). Improving the efficiency of dynamic malware
analysis. Paper presented at the Proceedings of the 2010 ACM Symposium on Applied
Computing.
Becerra-Fernandez, I., Madey, G., Prietula, M., Rodriguez, D., Valerdi, R., & Wright, T. (2008).
Design and Development of a Virtual Emergency Operations Center for Disaster
Management Research, Training, and Discovery. Paper presented at the Proceedings of
the Proceedings of the 41st Annual Hawaii International Conference on System Sciences.
Department of Defense (DoD) (2016) Joint Special Access Program (SAP) Implementation
Guide (JSIG).
Elmagarmid, A. K., Samuel, A., & Ouzzani, M. (2008). Community-CyberinfrastructureEnabled
Discovery in Science and Engineering. Computing in Science & Engineering, 10(5), 46-
53.
Feng, Y.-H., & Lee, C. J. (2010, 20-23 April 2010). Exploring Development of Service-Oriented
Architecture for Next Generation Emergency Management System. Paper presented at
the Advanced Information Networking and Applications Workshops (WAINA), 2010
IEEE 24th International Conference on.
Galinec, D., Možnik, D. & Guberina, B. (2017) Cyber security and cyber defence: national level
strategic approach, Automatika, 58:3, 273-286, DOI: 10.1080/00051144.2017.1407022.
https://doi.org/10.1080/00051144.2017.1407022
Hong, T., & Lindu, Z. (2009, 19-21 May 2009). Knowledge Management System of Intercity
Emergency Decision Making. Paper presented at the Software Engineering, 2009. WCSE
'09. WRI World Congress on.
Krousel-Wood M. A. (2009). Moving beyond the Katrina crisis: from danger to opportunity
overview of key lessons learned for better disaster preparedness from the American
journal of the medicine sciences third post-katrina anniversary symposium issue. The
Ochsner journal, 9(2), 60–62.

33
Laxmi, K., Deepika, K., Pranay, N., & Supriya, V. (2018). Data Backup and Recovery
Techniques in Cloud Computing. 2018 IJSRCSEIT | Volume 3 | Issue 4| ISSN: 2456-
3307
Defense Manpower Data Center (DMDC) (2017). Defense Information System for Security
(DISS) Frequently Asked Questions (FAQs).
https://www.cdse.edu/documents/cdse/DISS-FAQs.pdf
Maughan, D. (2010). The need for a national cyber security research and development agenda.
Commun. ACM, 53(2), 29-31.
Murphy, T., & Jennex, M. (2006). Knowledge Management, Emergency Response, and
Hurricane Katrina. International Journal of Intelligent Control and Systems, 11(4), 199-
208.
National Infrastructure Protection Plan (NIPP) NIPP 2013: Partnering for Critical
Infrastructure Security and Resilience
Neumann, P. G. (2010). Risks to the public. SIGSOFT Softw. Eng. Notes, 35(3), 24-32.
Ochi, S., Hodgson, S., Landeg, O., Mayner, L., & Murray, V. (2014). Disaster-driven evacuation
and medication loss: a systematic literature review. PLoS currents, 6,
ecurrents.dis.fa417630b566a0c7dfdbf945910edd96.
https://doi.org/10.1371/currents.dis.fa417630b566a0c7dfdbf945910edd96
Samy, G.N., Ahmad, R. & Ismail, Z. (2010). Security threats categories in healthcare
information systems. http://jhi.sagepub.com. DOI: 10.1177/1460458210377468
Walker, J. J. (n.d.).Cyber Security Concerns for Emergency Management.
https://cdn.intechopen.com/pdfs/26817/InTech-
Cyber_security_concerns_for_emergency_management.pdf

34
APPENDIX A: QUESTIONNAIRE

Section A:
1. Age bracket?
a. Under 20
b. 20 – 29 years
c. 30 – 39 years
d. 40 – 49 years
e. 50 – 59 years
f. Over 60 years

2. Gender
Male
Female

3. Highest qualification?
Diploma
ND/NCE
HND/BSc/PGD
Masters
PhD

4. Have you ever suffered data loss?

Yes
No

5. Were you able to recover your data completely after system restore or recovery?
Fully
Partially
Never experienced

6. What was the cause of your data loss?

Lost my device
Stolen
Storage corrupted
Change my device

7. Can backup your by yourself?

Yes
No

8. Do you regularly update and backup your database?

Yes
Sometimes
No

35
9. Do backup your data before performing any major activity on your device?
Yes
No

10. Does your organization have disaster management policy?

Yes
No
I do not know

11. Do you understand security risks of using your device(s) on public Wi-Fi networks?
Yes
No

12 Could someone access your data if your Smartphone/laptop/tablet were stolen right now?
O Yes
O No
O Undecided
O
13. What security measures do you have enforced on your device(s) such as laptops/tablets
and/or Smartphone? (Tick all that apply)
PIN codes
Passwords
Biometrics
Pattern codes
None

14. If you use password, what comprises of your passwords?

O Plain text of less than seven characters
O Plain text of more than seven characters
O Plain numerals (less than seven digits)
O Plain numerals (more than seven digits)
O Combination of text and special characters such as commas, asterisks, harsh etc
O I do not use password

36
APPENDIX B: DATABASE

Scal
dataLos pBacku incidencePolic e (1- secPolic
Age Sex education s dRestore dlossCause p backupFreq y 5) y pWifi sto
30 - 39 Storage Whenever I feel
yrs Male Masters Yes Partially corrupted Yes like No 3 Yes Yes PIN
30 - 39 HND/PGD/BS Whenever I feel Mayb PIN
yrs Male c Yes Partially Lost my device Yes like Maybe 4 Maybe e cod
50 - 59 PIN
yrs Male Masters Yes Partially Lost my device Yes Daily Yes 3 Yes No cod
20 - 29 HND/PGD/BS Storage
yrs Male c Yes Partially corrupted Yes None Maybe 4 Yes No PIN
40 - 49 Whenever I feel
yrs Male Masters Yes Partially Stolen Yes like Maybe 3 Yes Yes PIN
30 - 39 HND/PGD/BS Storage Whenever I feel Mayb
yrs Male c Yes Fully corrupted No like No 4 No e PIN
30 - 39 Storage
yrs Male Masters Yes Partially corrupted Yes Weekly Maybe 3 Yes No Pas
30 - 39 Femal Storage
yrs e Masters Yes Partially corrupted Yes Weekly Maybe 3 No No PIN
20 - 29
yrs Masters Yes Partially Lost my device Yes Twice weekly Yes 1 Yes Yes Pas
30 - 39 HND/PGD/BS Storage Whenever I feel Mayb
yrs Male c Yes Partially corrupted Yes like Maybe 4 Yes e Pas
20 - 29 Storage Whenever I feel
yrs Male Masters Yes Partially corrupted Yes like No 5 No No PIN
30 - 39 Femal Storage
yrs e Masters Yes Partially corrupted No None Yes 1 Yes No PIN
20 - 29 Femal Mayb
yrs e Masters Yes Partially Stolen Yes Twice monthly Yes 3 Yes e Pas
20 - 29 Mayb
yrs Male Masters Yes Partially Stolen Yes Weekly Yes 4 Yes e PIN

37
20 - 29
yrs Male Masters No Fully Stolen Yes Weekly Yes 4 Yes No Bio
30 - 39 Storage
yrs Male Masters Yes Fully corrupted Yes Daily Yes 1 Yes No PIN
20 - 29 HND/PGD/BS Storage Whenever I feel
yrs Male c Yes Partially corrupted Yes like Maybe 3 Yes Yes No
30 - 39 Femal HND/PGD/BS Whenever I feel
yrs e c No Never experienced No like No 1 Yes No PIN
20 - 29
yrs Male Masters Yes Partially Stolen Yes Weekly Yes 3 Yes No Pas
40 - 49 Storage Whenever I feel Mayb
yrs Male Masters Yes Partially corrupted Yes like Yes 1 Yes e Bio
30 - 39 Storage Whenever I feel
yrs Male Masters Yes Partially corrupted Yes like Maybe 3 Maybe No Pas
20 - 29 Femal Storage Whenever I feel
yrs e Masters Yes Partially corrupted Yes like Maybe 3 Yes No Pas
30 - 39 Storage Whenever I feel
yrs Male Masters Yes Partially corrupted No like No 1 Yes No Patt
20 - 29 Femal Whenever I feel Mayb
yrs e Masters Yes Partially Stolen Yes like Maybe 2 Yes e PIN
30 - 39 Femal HND/PGD/BS Change my Mayb
yrs e c Yes Partially device Yes Twice monthly No 2 Yes e Patt
30 - 39 Femal Storage Whenever I feel Mayb
yrs e Masters Yes Partially corrupted Yes like Maybe 3 Yes e PIN
Never
30 - 39 HND/PGD/BS experience Change my
yrs Male c No d device Yes Daily No 1 Yes No Pas
20 - 29
yrs Male Masters No Fully Yes Twice monthly Yes 2 Yes Yes PIN
30 - 39 Femal HND/PGD/BS
yrs e c Yes Partially Lost my device Yes Twice monthly No 1 Yes Yes Pas
20 - 29 Whenever I feel
yrs Male Masters Yes Fully Stolen Yes like Yes 3 Yes No PIN
20 - 29 Femal HND/PGD/BS No Never experienced Yes Daily No Bio

38
yrs e c
20 - 29 Femal HND/PGD/BS Storage
yrs e c Yes Partially corrupted No Weekly No 3 No Yes PIN
20 - 29 HND/PGD/BS Storage
yrs Male c Yes Partially corrupted Yes Twice weekly Yes 3 Yes No Pas
20 - 29 HND/PGD/BS Whenever I feel Mayb
yrs Male c Yes Partially Stolen Yes like Maybe 3 Maybe e PIN
30 - 39 HND/PGD/BS Storage PIN
yrs Male c Yes Fully corrupted Yes Twice monthly Yes 4 Yes No cod
30 - 39 HND/PGD/BS Whenever I feel Mayb PIN
yrs Male c Yes Partially Lost my device Yes like Maybe 4 Maybe e cod
50 - 59 PIN
yrs Male Masters Yes Partially Lost my device Yes Daily Yes 3 Yes No cod
20 - 29 HND/PGD/BS Storage
yrs Male c Yes Partially corrupted Yes None Maybe 4 Yes No PIN
40 - 49 Whenever I feel
yrs Male Masters Yes Partially Stolen Yes like Maybe 3 Yes Yes PIN
30 - 39 HND/PGD/BS Storage Whenever I feel Mayb
yrs Male c Yes Fully corrupted No like No 4 No e PIN
30 - 39 Storage
yrs Male Masters Yes Partially corrupted Yes Weekly Maybe 3 Yes No Pas
30 - 39 Femal Storage
yrs e Masters Yes Partially corrupted Yes Weekly Maybe 3 No No PIN
20 - 29
yrs Masters Yes Partially Lost my device Yes Twice weekly Yes 1 Yes Yes Pas
30 - 39 HND/PGD/BS Storage Whenever I feel Mayb
yrs Male c Yes Partially corrupted Yes like Maybe 4 Yes e Pas
20 - 29 Storage Whenever I feel
yrs Male Masters Yes Partially corrupted Yes like No 5 No No PIN
30 - 39 Femal Storage
yrs e Masters Yes Partially corrupted No None Yes 1 Yes No PIN
20 - 29 Femal Mayb
yrs e Masters Yes Partially Stolen Yes Twice monthly Yes 3 Yes e Pas
20 - 29 Male Masters Yes Partially Stolen Yes Weekly Yes 4 Yes Mayb PIN

39
yrs e
20 - 29
yrs Male Masters No Fully Stolen Yes Weekly Yes 4 Yes No Bio
30 - 39 Storage
yrs Male Masters Yes Fully corrupted Yes Daily Yes 1 Yes No PIN
20 - 29 HND/PGD/BS Storage Whenever I feel
yrs Male c Yes Partially corrupted Yes like Maybe 3 Yes Yes No
30 - 39 Femal HND/PGD/BS Whenever I feel
yrs e c No Never experienced No like No 1 Yes No PIN
20 - 29
yrs Male Masters Yes Partially Stolen Yes Weekly Yes 3 Yes No Pas
20 - 29 Femal HND/PGD/BS Storage
yrs e c Yes Partially corrupted No Weekly No 3 No Yes PIN
20 - 29 HND/PGD/BS Storage
yrs Male c Yes Partially corrupted Yes Twice weekly Yes 3 Yes No Pas
20 - 29 HND/PGD/BS Whenever I feel Mayb
yrs Male c Yes Partially Stolen Yes like Maybe 3 Maybe e PIN
30 - 39 HND/PGD/BS Storage PIN
yrs Male c Yes Fully corrupted Yes Twice monthly Yes 4 Yes No cod
30 - 39 HND/PGD/BS Whenever I feel Mayb PIN
yrs Male c Yes Partially Lost my device Yes like Maybe 4 Maybe e cod
50 - 59 PIN
yrs Male Masters Yes Partially Lost my device Yes Daily Yes 3 Yes No cod
20 - 29 HND/PGD/BS Storage
yrs Male c Yes Partially corrupted Yes None Maybe 4 Yes No PIN
40 - 49 Whenever I feel
yrs Male Masters Yes Partially Stolen Yes like Maybe 3 Yes Yes PIN
30 - 39 HND/PGD/BS Storage Whenever I feel Mayb
yrs Male c Yes Fully corrupted No like No 4 No e PIN
30 - 39 Storage
yrs Male Masters Yes Partially corrupted Yes Weekly Maybe 3 Yes No Pas
30 - 39 Femal Storage
yrs e Masters Yes Partially corrupted Yes Weekly Maybe 3 No No PIN
20 - 29 Masters Yes Partially Lost my device Yes Twice weekly Yes 1 Yes Yes Pas

40
yrs
30 - 39 HND/PGD/BS Storage Whenever I feel Mayb
yrs Male c Yes Partially corrupted Yes like Maybe 4 Yes e Pas
20 - 29 Storage Whenever I feel
yrs Male Masters Yes Partially corrupted Yes like No 5 No No PIN
30 - 39 Femal Storage
yrs e Masters Yes Partially corrupted No None Yes 1 Yes No PIN

41