Chapter 1: Assess security needs

Information and Communication Technology (ICT) security is a critical area for ICT technicians in Kenya, especially as digital transformation accelerates across sectors such as healthcare, education, finance, and government services. Assessing security needs is foundational to protecting ICT assets from evolving threats including cyberattacks, data breaches, and unauthorized access. This chapter focuses on documenting security asset requirements, understanding the regulatory framework, identifying key ICT assets, evaluating the necessity of security measures, and implementing appropriate control mechanisms to safeguard organizational information systems.

1.1 Documentation of ICT security assets

Documenting ICT security assets means writing down what an organisation must protect, where each item is kept, who is responsible for it and which safeguards already surround it. The written record, usually called an asset register, is the starting point of every later security task: nobody can assess a need, install a control or test a measure for an asset that nobody knows exists. A technician at a computer repair and networking workshop, for example, begins by listing the customer-facing laptops, the workshop server, the router, the licensed software and the staff who use them, before deciding which of them need stronger protection.

1.1.1 Introduction to ICT security

ICT security is the protection of computers, networks, software and the information they hold from unauthorised access, damage, theft, misuse and loss. It covers both digital threats, such as malicious software, and physical ones, such as a stolen laptop or a flooded server room. The subject is built on a small set of terms, a clear reason for protecting assets and three guiding principles, which this section introduces before the later topics apply them.

Role of the ICT technician in security

The ICT technician is the person who turns security decisions into working systems. A technician records assets, configures firewalls and accounts, applies updates, watches for unusual activity and responds when something goes wrong. Technicians also hold privileged access, so they are expected to use it only for authorised work and to report anything they notice that could weaken security.

1.1.1.1 Definition of terms

A few terms are used throughout the unit. Each is defined here in one line and developed in the topic where it is applied.

• ICT security: the practices, technologies and policies that protect ICT systems and the information on them.
• Information security: protection of information in any form, including paper records and spoken information, not only data on computers.
• Cybersecurity: the part of security that deals with systems and information connected to networks and the internet.
• Asset: anything of value to an organisation that needs protection, such as a server, a customer database, a licence key or a skilled employee.
• Threat: any person, event or circumstance that could harm an asset, for example a malware infection, a fire or a dishonest insider.
• Vulnerability: a weakness that a threat can use, such as unpatched software, a default password or an unlocked server room.
• Risk: the chance that a threat uses a vulnerability to harm an asset, together with how serious the harm would be.
• Control: a safeguard that reduces risk, for example a lock, a firewall or a backup routine.
• Incident: an event that actually or potentially harms the confidentiality, integrity or availability of an asset.
• Breach: an incident in which protected information is accessed, disclosed, altered or lost without authority.

1.1.1.2 Importance of securing ICT assets

Securing ICT assets protects the work, money and trust that depend on them. A web design studio that loses its client files to a failed disk or to ransomware can miss deadlines and lose clients, even if the equipment itself is cheap to replace.

• Protecting information: customer records, designs, accounts and passwords have value to the organisation and to criminals. Security keeps them in the right hands.
• Keeping services running: a business that depends on a network cannot trade while the network is down. Security reduces the chance and length of outages.
• Meeting legal duties: Kenyan law requires organisations to protect personal data and treats unauthorised access to computers as an offence, so weak security creates legal exposure.
• Protecting reputation and trust: customers leave providers that lose or leak their information, and the loss of trust often costs more than the technical repair.
• Protecting investment: computers, servers and licensed software cost money to buy and replace, and securing them extends their useful life.
• Reducing financial loss: fraud, ransom payments, recovery work and lost trading time all cost money that good security helps avoid.

1.1.1.3 Principles of information security

Three principles guide every security decision: confidentiality, integrity and availability, often called the CIA triad. A control is usually chosen to strengthen at least one of them, and a weakness in one can damage the others. Two further goals support the triad. Accountability means that every action on a system can be traced to a person, which discourages misuse and supports investigation. Resilience is the ability to keep working through, and recover quickly from, an incident or disruption.

1.1.1.3.1 Confidentiality

Confidentiality means that information is available only to people who are authorised to see it. A technician repairing a customer's laptop may need to log in to the machine, but the customer's personal files, photographs and messages remain confidential and must not be opened, copied or discussed. Confidentiality is protected by access control, strong authentication, encryption, classifying information by sensitivity and teaching staff not to share it carelessly. It is lost when a password is shared, a laptop is stolen unencrypted or a printout is left where visitors can read it.

1.1.1.3.2 Integrity

Integrity means that information and systems stay accurate, complete and unaltered except by authorised people through approved changes. If a price list, a configuration file or a customer record is changed without authority, decisions made from it become wrong without anyone noticing. Integrity is protected by permissions that stop unauthorised editing, version control, audit logs, digital signatures and checksums. For example, a technician can compare the published checksum of a downloaded software installer with the checksum of the file received: if they differ, the file was corrupted or tampered with and must not be installed.

1.1.1.3.3 Availability

Availability means that systems and information can be used by authorised people whenever they are needed. A small internet service provider whose billing server is offline for a day cannot collect payments or serve customers, even though no data was stolen. Availability is protected by backups, redundant equipment, uninterruptible power supplies, timely patching, capacity planning and protection against denial of service. It is lost through hardware failure, power cuts, malware, human error and deliberate attacks.

1.1.2 ICT security regulations, standards and policies

Rules about ICT security come from three levels. Laws set what an organisation must do and what is a crime. Standards describe good practice that an organisation can adopt and be assessed against. Policies are the organisation's own written rules, which apply the laws and standards to its daily work. A technician needs to know all three because they decide what must be protected, how, and what happens when a rule is broken.

1.1.2.1 Computer misuse and cyber-crimes act, 2018

The Computer Misuse and Cybercrimes Act, 2018 (Act No. 5 of 2018) is the main Kenyan law on offences involving computers and networks. Its stated purposes include providing for offences relating to computer systems, enabling the detection, prevention, investigation and prosecution of computer and cybercrimes, and supporting international co-operation. The Act was amended in 2025 by the Computer Misuse and Cybercrimes (Amendment) Act, 2025, and parts of that amendment have been contested, so a technician should always read the current text on the Kenya Law website instead of relying on a summary.

The offences that matter most to a technician include:

• Unauthorised access: entering a computer system without permission, even if nothing is changed or stolen.
• Access with intent to commit a further offence: gaining access in order to commit fraud or another crime.
• Unauthorised interference and interception: altering or damaging data or systems, or capturing data in transmission, without authority.
• Illegal devices and access codes: making, selling or possessing tools or codes mainly to commit offences.
• Unauthorised disclosure of a password or access code: giving away a code that lets others enter a system.
• Computer forgery, computer fraud, identity theft and impersonation, and phishing: using computers to deceive people or take their property.
• Employee responsibility to relinquish access codes: an employee leaving an organisation must hand over the access codes they hold.
• Reporting of cyber threat: a person who operates a computer system or network must report attacks, intrusions and disruptions without delay to the National Computer and Cybercrimes Co-ordination Committee; the 2018 text sets a limit of 24 hours.

In practice a technician works only with written authority from the system owner, never keeps access after a job ends, never shares administrator passwords, and records every privileged action. Security testing without written permission can itself be an offence.

1.1.2.2 The data protection act 2019

The Data Protection Act, 2019 (Act No. 24 of 2019) protects personal data, which is information about an identifiable living person such as a name, national identity number, phone number, photograph or location. It is overseen by the Office of the Data Protection Commissioner. The Act gives names to the main parties: the data subject is the person the data is about, the data controller decides why and how the data is processed, and the data processor handles it on the controller's behalf. A cyber café that scans customers' identity cards is a data controller, and a technician who maintains its computers may be acting for it as a processor.

The Act sets principles for handling personal data. Data must be processed lawfully, fairly and transparently, collected for a specified and legitimate purpose, limited to what is necessary, kept accurate, kept no longer than needed, and transferred outside Kenya only where the Act's conditions are met. Data subjects have rights that include being informed how their data is used, accessing it, objecting to its processing, and having false or misleading data corrected or deleted. Controllers and processors must register with the Commissioner unless exempted, must put appropriate security safeguards in place, and must report a breach to the Commissioner without delay, within 72 hours of becoming aware of it, and inform the people affected.

For the technician, these duties become concrete tasks: restrict who can open customer files, encrypt laptops and backups, log access, delete data when it is no longer needed, and escalate any suspected breach immediately so the organisation can meet its reporting duty.

1.1.2.3 Information security management systems standard (KS ISO/IEC 27001:2022)

KS ISO/IEC 27001:2022 is the Kenya Standard that adopts the international standard ISO/IEC 27001:2022, titled Information security, cybersecurity and privacy protection, information security management systems, requirements. An information security management system (ISMS) is the set of policies, processes and responsibilities an organisation uses to manage information security in a planned and continuous way. An organisation can build an ISMS on the standard, and may ask an accredited body to certify it, but adoption is voluntary unless a client or regulator requires it.

The standard asks an organisation to understand its context, secure leadership commitment, plan by assessing risks, provide resources and awareness, operate its controls, evaluate performance through monitoring and audit, and keep improving, as a continuing cycle of planning, operating, checking and improving. Its Annex A lists 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). The organisation selects the controls that suit its risks and records the choice in a statement of applicability. One of the organisational controls requires an inventory of information and other associated assets, which is exactly the asset register this topic describes.

Other frameworks are met in the same field. The NIST Cybersecurity Framework organises security work into the functions govern, identify, protect, detect, respond and recover. COBIT is a framework for governing and managing enterprise IT. PCI DSS applies to organisations that store, process or transmit payment card data. They are not required reading for this unit, but a technician may be asked to follow them by a client.

Organisational ICT security policies

A security policy is a short written statement, approved by management, that sets the rules for protecting ICT assets. Policies create a common understanding of what is allowed, give technicians authority to enforce rules, and provide a basis for discipline and audit. Typical policies cover acceptable use, passwords, access control, backups, incident response and the handling of personal devices.

An effective policy has these components:

• Purpose and scope: what the policy is for and which systems, people and locations it covers.
• Roles and responsibilities: who owns the policy, who carries out each task and who is accountable.
• Rules and procedures: the actual requirements, such as minimum password length or who may approve access.
• Incident reporting: how, to whom and how quickly a suspected breach must be reported.
• Compliance and enforcement: how compliance is checked and what happens after a violation.
• Review: the date the policy was approved and when it will next be reviewed, since policies become outdated.

1.1.3 ICT security assets

An ICT security asset is any item that has value to the organisation and therefore needs protection, or that is used to protect other items. Assets are identified first, because an unrecorded asset cannot be protected, patched, insured against loss or recovered. Seven groups are used here: software, hardware, data, network, physical, policy and people.

Asset register

The asset register is the document in which every asset is recorded. A useful register has one row per asset and enough columns to answer who, what, where and how well protected. A small example for a computer repair workshop follows.

1.1.3.1 Software

Software assets are the programs that run on the organisation's computers: operating systems, office and business applications, security tools, development tools and the licences that allow them to be used. Software is a target because its flaws can be exploited and because unlicensed or modified copies often carry malware. For each item the register records the name, version, licence type and key holder, installation locations and patch status.

1.1.3.2 Hardware

Hardware assets are the physical computing devices: desktop computers, laptops, servers, printers, phones, tablets, external drives and flash disks. They can be stolen, damaged or tampered with, and they hold the data stored on them. The register records make, model, serial number, asset tag, assigned user, location and warranty, and it is updated whenever a device is moved, repaired or disposed of.

1.1.3.3 Data

Data assets are the information the organisation creates and keeps: customer records, financial files, designs, passwords, system configurations, logs and backups. Data is a high-value asset because lost data cannot be bought back. The register records what the data is, where it is stored, who owns it, how sensitive it is and how it is backed up.

1.1.3.4 Network

Network assets are the devices and services that connect systems: routers, switches, firewalls, wireless access points, cabling, internet links, IP address plans and VPN connections. A weakness here can expose every connected device. The register records each device's role, address, firmware version, configuration backup and physical location, together with a diagram showing how they connect.

1.1.3.5 Physical

Physical assets are the buildings and facilities that house or support ICT: server rooms, racks, doors and locks, cabling routes, power supplies, generators, cooling and fire-protection equipment. If these fail, the devices inside them fail too. A back office with no lock on its door puts every computer in it at risk, however well configured they are. The register records the location, access arrangements and protective equipment of each space.

1.1.3.6 Policy

Policy assets are the written rules and procedures that govern ICT use, such as the acceptable use policy, the backup procedure and the incident response plan. They are assets because the organisation depends on them and because an outdated or lost policy leaves staff without guidance. Each document is recorded with an owner, version number, approval date and next review date.

1.1.3.7 People

People are assets because their knowledge and access determine how safely systems are run. Employees, contractors, vendors and other users all hold accounts or physical keys. They are also a common route for phishing and mistakes. The register records each person's role, the access they hold, training completed and a named backup for key skills, so that the loss of one person does not leave the organisation unable to run a system.

Asset classification and valuation

Assets are classified by how damaging their loss or exposure would be, so that protection is matched to value. A common four-level scheme is public (may be seen by anyone), internal (for staff only), confidential (limited to named roles) and restricted (very limited, with the strongest protection). A public price list can be shared freely, while the customer job database is confidential. Valuation also considers how critical an asset is to operations: a public website may carry little secret information but be vital to availability.

Asset ownership and accountability

Every asset has a named owner who is responsible for deciding who may use it and for making sure it is protected. The owner is usually a manager of the department that depends on the asset, while the technician is the custodian who maintains it. For example, the accounts clerk owns the accounting data, and the technician who maintains the computer holding it is its custodian. Without a named owner, no one is accountable and assets are neglected.

1.1.4 Importance of assessing Security needs

A security needs assessment compares the organisation's assets with the threats they face, the weaknesses in them, the controls already in place and the legal duties that apply. Its output is a clear statement of what needs protecting and how strongly. Without it, an organisation tends to buy tools it does not need and leave real gaps open.

Risk identification and prioritisation

Assessment shows which assets are exposed and which gaps are most serious. A cyber café, for instance, may find that all its public computers use one shared administrator account, which is a more urgent gap than the colour of its screen lock. Ranking the gaps tells the technician what to fix first. The detailed method is taught in the risk assessment topics of this chapter.

Efficient use of resources

Money, time and skill are limited, so controls should be spent where they reduce the most risk. An assessment prevents expensive protection of low-value assets while high-value data sits unprotected, and it gives managers evidence to support a budget request.

Legal and regulatory compliance

Laws such as the Data Protection Act, 2019 oblige organisations to protect personal data. Regular assessment shows whether current controls meet those duties and records the steps taken, which supports the organisation if it is questioned by a regulator or client.

Preparedness for incidents

Knowing which systems matter most, and how they could fail, lets a technician write practical response and recovery plans in advance. A data entry bureau that has already listed its critical machines and backup locations restores service faster after a ransomware infection than one that must work this out under pressure.

Business continuity

Assessment identifies the systems that the business cannot do without and the points where a single failure would stop work, such as one router connecting the whole office. This supports planning for backups, spare equipment and alternative arrangements so that essential services continue during disruption.

1.1.5 ICT security Control Measures

A control measure, also called a safeguard or countermeasure, is anything that reduces the likelihood or the impact of a security incident. Once the assets are documented and the needs assessed, controls are chosen and applied to each kind of asset. This section introduces the controls by the type of asset they protect; the installation of physical and logical controls is taught in full in the next chapter.

1.1.5.1 Software

Software controls protect programs and the systems they run on. They include installing updates and patches promptly, using only licensed software from trusted sources, removing programs that are not needed, running anti-malware protection, restricting who can install software, and configuring each application securely instead of leaving default settings. For example, a technician can limit installation rights on staff computers to the administrator account so that a user cannot install an unknown program by accident.

1.1.5.2 Hardware

Hardware controls prevent theft, damage and tampering of devices. They include asset tags and registers, lockable cases and racks, cable locks for laptops, restricted access to rooms, protection from power surges and outages with surge protectors and UPS units, and secure disposal in which drives are wiped or destroyed before a device leaves the organisation. A laptop used by a field technician should also have its disk encrypted so that theft does not expose its contents.

1.1.5.3 Firmware

Firmware is the low-level software stored on a device's chip that starts and controls the hardware, such as the BIOS or UEFI on a computer and the operating software of a router. Firmware controls include setting a password on the BIOS or UEFI settings, enabling secure boot where it is available, disabling boot from external devices that are not needed, changing default administrator passwords on network devices and applying firmware updates published by the manufacturer. Firmware should be downloaded only from the manufacturer, because a corrupted or fake image can give an attacker control that is hard to detect.

1.1.5.4 Data

Data controls protect the information itself wherever it is stored or sent. They include access permissions based on need, encryption of stored files and of data sent over networks, regular backups with at least one copy kept away from the main site, classification labels that tell users how to handle each file, and secure deletion when data is no longer required. Data controls also support legal duties, since personal data must be protected and kept no longer than necessary.

Controls by nature: technical, administrative and physical

Controls can also be grouped by the kind of safeguard they are.

They are also grouped by purpose. Preventive controls stop an incident, detective controls discover one, and corrective controls limit damage and restore normal operation. A sound security design uses several layers of each, so that if one control fails another still protects the asset.

Chapter Summary

This chapter provides a comprehensive overview of assessing security needs within ICT environments, beginning with the documentation of ICT security assets which include software, hardware, data, networks, physical infrastructure, policies, and people. It highlights the importance of understanding ICT security principles and complying with relevant regulations such as the Computer Misuse and Cybercrimes Act 2018, the Data Protection Act 2019, and standards like KS ISO/IEC 27001:2022. The chapter then explores the variety of ICT security threats including malware, viruses, phishing, hacking, and denial of service attacks, while also addressing system vulnerabilities that expose assets to risk. A detailed approach to ICT security risk assessment is presented, covering identification, conducting assessments, prioritizing risks, categorizing risk levels, and developing appropriate mitigation measures. Finally, the chapter emphasizes the significance of compiling an ICT security risk assessment report, detailing its essential components and the process of preparing a comprehensive document to guide security management decisions. This structured approach equips learners to systematically evaluate and protect ICT resources against evolving security challenges.