Information Systems Security Threats and Vulnerabilities: A Case of the Institute of Accountancy Arusha (IAA) ()
1. Introduction
Information security can be defined as the process of maintaining information confidentiality, integrity and availability against both internal and external vulnerabilities. Dependence on ICT infrastructure for daily use in achieving organisation objectives has made higher learning institutions a target of malicious activities from both within and from external factors [1]. Researchers have analysed different factors that contribute to poor Information System security in the learning environment. For example, the use of online learning facilities such as portals, online learning systems and mobile apps have increased security threats to learning environments [2] [3] [4]. Studies show that the number of internet users in Tanzania increased to 43.62 million just by 2018 [5]. This is about 45% of all adult citizens [6] and the majority of these users are from higher learning institutions with no proper knowledge on how to defend themselves/their institutions from hackers and online attacks. The threats to information system security have been reported to increase for both organisations and individuals [7]. The case is more alarming in learning environments of Tanzania as these incidences do not have formal ways of being documented, which are likely to reverse. Security attacks can result in loss of business, trust, reputation and money [8]. For example, researchers in reference [5] had their research showing the impact of cyber security attacks on learning environments in Tanzania. The study aims at identifying and categorising these threats and vulnerabilities and proposing appropriate solutions in the case of the learning environment of Tanzania.
There is a wealth of information on information system security around the world in the literature and international reports. According to Kaspersky’s estimate, there were 445 million attacks in 2020 [9]. According to research in reference [10], 50% of Internet users admit to having experienced security breaches. According to research in reference [11], the typical data breach results in the loss of 25,575 records annually, costing an enterprise an estimated $3.92 million USD. Investors and customers may become less trusting of the impacted companies as a result of the data leak and stop doing business with them [12]. Collectively, it is clear that cyberattacks are on the rise [13]; as a result, it is important for stakeholders to remain aware of the variables affecting the security of information systems in learning environments.
As a result, studies about variables influencing information system security are provided in the literature. By concentrating on users’ compliance with ICT policies, researchers in reference [14] analyse elements that affect the security of information systems. According to the report, disregarding ICT policies has a negative impact on the security of information systems. Reference [15] highlighted low adherence to the security culture as one of the causes of online vulnerability in a different study. The study in reference [16], in contrast, concentrated on the role of people in defending an organisation from attacks. In addition, references [17] and [18] hypothesised that variables including a lack of managerial backing, a woefully inadequate information security policy, and a dearth of information security education programmes all play a role in the deficient security of corporate-owned information systems security. In this context, it is clear that there is no consensus on what influences information system security in the modern world. In order to identify the aspects affecting the security of information systems, this study does such analysis in public higher learning institutions in Tanzania, particularly the Institute of Accountancy Arusha (IAA).
There is evidence that the use of information systems is becoming more and more important to human activity, especially in learning environments like public higher learning institutions. Information systems are necessary for human activities and decision-making. The rising usage of computers and computer systems is due to the requirement for a reliable information system to fulfil consumer satisfaction [18]. In Tanzania, for example, ICT use is growing at a rate of 4.9 percent per year [19]. Currently, 60% of individuals worldwide are subscribers, compared to 50% of people in Tanzania who use the internet [10]. With this rise, it’s clear that efficient use requires reliable information systems to improve the performance of the user organisation [18]. The study focuses on the efficient use of ICT infrastructures within the learning environment to eliminate information system security threats and vulnerabilities.
Evidently, safe supporting infrastructure and accompanying resources are necessary for information system reliability [2] [3] [20]. Nevertheless, according to reference [20] and [21], a number of factors influence the necessary level of online safety in eliminating information system security threats and vulnerabilities. These variables include administrative, technological, and human-related variables. Reference [22] asserts that more information system risks are being published online every day. Phishing, social engineering, supply chain attacks, zero-day and polymorphic attacks, IoT, and infrastructure attacks are a few of these dangers [23] [24]. This study aims to find out if these factors are the same for the higher learning environments in Tanzania.
Policies controlling the use of ICT provide the organisation with a solid administrative basis necessary to combat these challenges [25] [26]. This is why the current study assesses information system security threats and vulnerabilities in the learning environments.
2. Methodology
Through a descriptive design, the study employed a quantitative methodology. The 302 employees (both teaching and supporting staff) at IAA made up the study’s population. Using the n = N/1 + N(e)2 formula proposed by Kothari [27], through a random sampling procedure, a sample of 170 participants was obtained at a 95% confidence level, 5% margin of error, and 50% population proportion from the population size of 302. Participants were instructed to select their thoughts by checking only one cell in the concept column on questionnaires that contained items ordered in the logical sequence of a 5-point Likert scale. Passionately 1) strongly disagree, 2) disagree, 3) neither agree nor disagree, 4) agree, and 5) strongly agree. The validity and reliability of the data were ensured. Before distributing questionnaires, the participants’ permission was taken into account. Additionally, questionnaires were forwarded to specialists for evaluation of their validity and reliability in relation to the goal of the study. A descriptive analysis was used in the study to analyse the information gathered through SPSS V26.
3. Findings and Discussions
This section concentrates its analysis of information system security threats and vulnerabilities on the Institute of Accountancy Arusha (IAA). The study was inspired by the fact that, like all other organisations, more and more security events affecting all kinds of businesses are being reported from the continent but very few within learning environments. The purpose of this study was to ascertain why information system security remains a concern for most learning institutions as well as for individual users. According to the research in reference [17], the elements affecting the security of information systems should be divided into a human, information security policy, work environment, and demographic aspects. Quantitative data were collected through questionnaires consisting of statements arranged in the logical order of a 5-point Likert scale, directing participants to choose their ideas by ticking only one cell in the concept column. 1) Strongly disagree, 2) disagree, 3) neither agree nor disagree, 4) agree, and 5) agree strongly.
![]()
![]()
![]()
Table 1. Determinants of information system security threats and vulnerabilities.
Source: Researchers (2022).
3.1. Human Factor
Reference [16] takes into account human variables, including how people behave physically and psychologically in connection to information system security. Additionally, the study in reference [28] noted that the suitability of user behaviours when using the system is crucial to an organisation’s information system security success. This area of human variables includes carelessness, lack of skills, and trust. Details on the information in Table 1 are provided in the next section.
Trust: According to this study, trust is the human component having the greatest impact on the security of information systems. Because of recommendations from co-workers or personal experience, one comes to trust another individual [29]. Although trust seems admirable, if safety measures are not implemented, it can turn into a point of attack [30]. Employees exchanging login information or data without taking security into account are one of the dangerous behaviours related to trust [31] [32]. These actions exacerbate the risks to information system security [33]. Though findings show that about 73.5% of respondents know the risk of sharing personal credentials, there is still a small number of people who do not understand this risk, which can result in catastrophic information system security risks and vulnerabilities at the institute. The same applies to the restriction of information based on public, protected, and restricted (secret) (Item 1.2).
Carelessness: According to reports, human carelessness also has an impact on the security of information systems in a learning environment. Carelessness is defined as an individual’s activity or behaviour that deliberately or unknowingly jeopardises the information system’s security. For instance, discussing work-related matters in emails or on public networks, where it is estimated that the average email user sends up to 112 emails per day and that about one in every seven of these emails is connected to office gossip [34]. Social media chitchat about work- related issues can be irresponsible and reveal confidential information to unwanted or unauthorised parties, increasing security risks and vulnerabilities for a firm. Results showed that more than half of respondents (Item 1.3) agreed to discuss office-related issues on social media, which results in numerous information system security threats and vulnerabilities. Additionally, additional actions like allowing a visitor to use a company computer or connecting a personal computer to the network without taking the proper security procedures raise alarms about security (Item 1.4). Security hazards can also be brought about by leaving workplace computers unattended (Item 1.5), introducing new hardware or software to users without proper training (Item 1.6), and operating ICT infrastructures without an ICT/IS security policy (Item 1.7). Additionally, employing old technology and software, among many other negligent practices (Item 1.8), is thought to put corporate information security at risk.
Lack of skills: Table 1 found a further human element affecting information security in a learning environment, namely a lack of skills. According to research by in reference [35], many people lack faith in the information system security expertise and experience of their specialists to handle current security concerns. Due to the high cost of most information security certifications for individuals (Item 1.9), this is a challenge. Additionally, the majority of businesses are reluctant to sponsor their staff members for professional qualifications [36]. On the other hand, as demonstrated the study in reference [37], common users also lack capabilities. This combination eventually has an impact on initiatives to protect the security of information systems.
3.2. Inadequate Information Systems Security Policies
An organisation’s personnel’s duties and responsibilities for safeguarding its information systems are specified in its information security policy [38]. Policies ensure proper administration of technology resources if they are followed [39]. If not addressed properly, this group of factors can lead to information system security threats and vulnerabilities, as explained in the following subsections.
Lack of Information System Security Policy Training: The most prevalent component within the policy category is a lack of information security policy training. Users would receive training to equip them with the necessary knowledge to ensure information system security [25] [40]. Users who go through training are given reliable tools and the know-how to keep company information secure. Table 1 shows that most of the people who answered the survey at IAA did not get any training on ICT or information system security policies (Item 2.1). This means that they use ICT facilities without knowing the right rules and safety features to protect themselves and their institution.
Poor Creation of Information System Security Policies: one of the information system security threats and vulnerabilities cause is the poor creation of information system security policy. Findings of this study show that participants were unaware of such policies, which means they were not involved in their creation as stakeholders (Item 2.2). Studies in reference [13] provide guidelines to adhere to and minimum standards for a security policy. Data security, Internet and network services governance, use of company-owned devices, physical security, incident handling and recovery, monitoring and compliance, and policy administration are the parts of the security policy that they advise including. In addition to these requirements, reference [25] stressed how important it was to include all security stakeholders in the process of writing the policy. They will be able to share their expertise, thoughts, and ideas because the organisation’s weak spots will be exposed [41]. A good policy will be made if you make sure to include important stakeholders and follow the standards that are suggested.
Poor Implementation of Information Systems Security Policies: Poor information systems security policy application, as shown in Table 1, is one of the variables that without proper addressing, can lead to information system security threats and vulnerabilities in an organisation (item 2.3). According to the study in reference [42], policy implementation challenges arise because the majority of policies are created for compliance reasons rather than to address actual security requirements. Also, say that when information systems policies aren’t put into place properly, they become useless documents that make the system more vulnerable. With the right implementation of information system security policies [20], the company could find implementation issues, limitations, and technological changes that need to be taken into account when making policies.
3.3. Work Environment
This definition is adapted from refence [43] and [44] and refers to the social elements and physical circumstances in which users of information systems carry out their work. The category of elements most frequently identified to have an impact on the security of information systems in the workplace is Individual factors of this sub-category are detailed in the next sub-section according to Table 1.
Inadequate Management Support: inadequate management support for information system security in an organisation can lead to security threats and vulnerabilities. Findings show that IAA management does not provide awareness and training in information system security policies to employees (item 3.1). Senior managers should serve as role models for the organisation by ensuring appropriate training and awareness campaigns, as well as by positively influencing their security behaviour [15] [45]. Other strategies used by management to assist subordinates include idealising security impact inside an organisation, giving each person special consideration, and inspiring drive [46]. According to researchers in reference [47] and [48], management’s failure to support security programmes increases the organisation’s information system security risk and vulnerabilities.
Organizational Security Culture: Another issue that is frequently mentioned in relation to information system security is organisational security culture. Establishing policies, norms, and guidelines that direct employees’ behaviour within a company becomes part of the organisation’s culture [16]. The organisation’s inability to establish the proper security culture has led to a rise in security threats associated with information systems [15] [33]. Themanagement must establish the proper security culture and integrate it into the long-term agenda. Sadly, research indicates that IAA does not operate in this way (Item 3.2).
Workload: Another aspect included in the work environment category that has been noted is workload. The workload in this essay refers to the volume of work that must be finished within the allotted time and resources [49]. Findings show that there are no restrictions on the use of optimisation software at IAA, which can lead to information system security threats and vulnerabilities. According to studies, employees’ ambition to optimise production with limited resources leads to a number of information system security threats and vulnerabilities. Over time, the organisation’s pressure on workers to meet higher financial targets raises the possibility that they will violate security [50]. Because of the constant pressure to stretch resources, employees put performance over security concerns [51].
Internet and Network Use: This describes how much a company relies on the Internet and networks to run its operations. The need for an Internet connection in the current business climate is essential to being competitive [7] [52]. The usage of the Internet becomes a risk to the security of information systems if the organisation uses it to support its operations without properly weighing the security concerns [53]. Findings show that respondents are unaware of any restrictions regarding the use of internet and network facilities at IAA (Item 3.4). This can result in the inappropriate use of such services, which leads to information system security risks and vulnerabilities.
Access Control: As users demand greater privileges when interacting with the system, access controls typically become less effective [54]. Instead of just making someone happy at the expense of overall security, the company must regulate system accessibility based on an individual’s tasks and responsibilities [55]. The information must be classified into three types: public, protected, and restricted. A system is vulnerable to threats if system access policies are not defined [56]. Respondents of the study have mixed feelings on the exitance of such controls at IAA (Item 3.5).
3.4. Demographic Variables
This section presents information on a variety of demographic variables that have been implicated in information system security threats and vulnerabilities. Gender, age, level of education, experience, and managerial function, according to reference [57], can all be used to predict a person’s intention to adhere to information system security as described below.
Gender: According to this study, gender can lead to various information system security threats and vulnerabilities. Findings show that it is the perception of the majority of respondents that information system security is more likely to be a male practice than a female one (Item 4.1). This perception leaves behind the majority of female employees, who are competent enough and can bring the required change in securing the organisations’ information systems. Researcher in reference [58] found that females are more likely than males to perceive high levels of security threats. In a different study, reference [20] found that men are more likely than women to exhibit superior information security behaviours. Researchers in reference [36] say that since information system is thought of as a male-dominated field, it is important to get more women to sign up for information systems security courses and get them interested in a career in information system security.
Work Experience: The presumption is that an individual’s employment history, both technical and non-technical, has some bearing on how appropriate their information security behaviour is. According to reference [59], experienced staff are safer thanks to their prior exposure to handling various security events. Additionally, work experience offers the chance for training, which imparts important knowledge for defence against assaults [56]. According to the findings of this study, experience in a less secure environment cannot provide an employee with security knowledge and experience (item 4.2). As explained in previous subcategories, without an adequate information system security training and awareness program, it is likely for the institute to have vulnerabilities and threats in its information systems.
Internet User Age: These study findings show that the internet use habits of young people have more information system security incidents compared to senior employees (items 4.3 and 4.4). According to the researcher in reference [60], younger individuals are more likely than older people to be aware of information system security threats and vulnerabilities. They are similarly irresponsible with their security knowledge [61]. Additionally, when undergoing new changes, youthful people are simple to teach, which is important when the firm changes its security procedures [60]. Based on these results, more work needs to be done to deal with how careless young people are and to teach adults more about security vulnerabilities and threats at IAA.
Level of Education: The results of this study show that the people who took part in it think that a level of education in the internet, cyber security, and information system security can protect the institute from vulnerabilities and threats to information system security (Item 4.5). According to research in reference [62], businesses face a variety of information security risks as a result of the information being shared via the Internet. These difficulties with maintaining information integrity and confidentiality depend on the understanding, education, and conduct of the end user. A trained cyber-literate workforce and an education system that can create such a workforce are necessary for successfully defending the organisation’s vital infrastructure against cyberattacks [63].
4. Conclusion and Recommendations
The Institute of Accountancy Arusha (IAA) was used as a case study to understand the main factors that contribute to the information system security threats and vulnerabilities in a learning environment. This research put information system security threats and vulnerabilities into four groups. The first category comprises human elements, including carelessness, level of skill, and trust. The inadequacy of information security policies, which includes problems with policy creation, implementation, and a lack of security training, was the second category. The study also looked at the “work environment”, which includes things like support from management, organisational security culture, workload, Internet and network use, and access control. Last but not least, the study included variables related to gender, age, education level, and work experience under the category of “demographic variables”. The study findings showed that almost all these categories received negative responses and contributed highly to the information system risk and vulnerabilities at the institute. Moreover, there is an unregulated level of trust, negligence, and inadequate security measures. According to these results, the study suggests that:
1) Organisations should regularly train their staff to improve their information system security proficiency.
2) Given that women are disproportionately affected, the institutes should make a concerted effort to increase their awareness.
3) The institute should create up-to-date policies that fully handle the issues with contemporary information system security and update in a minimum of every four (4) years.
4) The institute ought to promote actions that lessen exposure to information system security concerns.
5) The institute should consider creating an independent information system security policy document as currently, information system security policy is just a section within ICT policy which hinder its adequacy and relevance.