Outcome of Techniques Employed for Cyber Resiliency by Commercial Banks in Kenya

Abstract

In financial institutions, cyber-attacks have become an inevitable digital hazard that cannot be completely eliminated. Cyber-attacks lead to loss of money among clients leading to discussion and may also lead to inefficient service delivery thus inconveniencing customers. In response to the increasing cyber-attacks, commercial banks are complementing their cyber-security posture with cyber resilience in order to maintain operations in face of adversarial activity. The purpose of carrying out this research was to assess influence of cyber resilience techniques on cyber resiliency in Kenyan commercial banks. Moreover, the study also sought to identify techniques adopted by Kenyan commercial banks; establish the relationship between techniques adopted and level of cyber resiliency in commercial banks in Kenya; and recommend methods to improve cyber resiliency for commercial banks. An explanatory research design was employed as well as target population of 39 departmental heads cybercrime in Commercial Banks situated in Kenya. Census approach was as well deployed in the study and hence all the heads of cybercrime departments in Kenyan Commercial Banks were included in the research. This researcher employed primary and also secondary data. A data collection sheet was utilized to acquire data on the secondary data from annual reports of Kenyan commercial banks. The study utilized semi-structured questionnaires to obtain data from employees working in information and communication technology, cyber security, operations and risk departments. Semi structured questionnaire was used for generation of qualitative and also quantitative data. Additionally, thematic analysis was employed for qualitative data analysis and the results were then presented in form of a narrative. Inferential and also descriptive statistics were utilized for analyzing quantitative data with the support of SPSS version 22. Descriptive statistics in this study comprised of frequency distribution, mean, percentages as well as standard deviation. Additionally, inferential statistics including multivariate regression and also correlation analysis then followed. Tables and figures (pie charts and bar charts) were employed to present the results. Correlation and regression analysis were deployed to assess the association between variables. Moreover, the study found that commercial banks in Kenya had adopted privilege restriction, coordinated protection, dynamic positioning, substantiated integrity, analytical monitoring and dynamic representation to a great extent. However, deception as a cyber resilience technique had been adopted to a moderate extent. Moreover, the study discovered that cyber resilience methods including analytic monitoring, adaptive response, coordinated protection, dynamic representation, dynamic positioning, privilege restriction and substantiated integrity had significant and positive effect on cyber resilience in Kenyan commercial banks. Additionally, deception has insignificant influence on cyber resilience of Kenyan commercial banks. Moreover, this study therefore recommends that the Kenyan commercial banks ought to adopt deception technology to cause adversaries misdirect or waste their resources, delay the effect of attack and confuse and mislead adversaries. Moreover, commercial banks ought to use analytic monitoring to gather, analyse and utilize data to identify vulnerabilities as well as utilize malware and forensic analysis to assess the actual damage by cyber-attacks.