By the end of this chapter, you will be able to:
Mastering these skills helps you keep valuable data safe and maintain trust in any digital environment you work in.
Cybersecurity skills are essential for professionals in applied biology who increasingly rely on digital tools and data management systems to conduct research, manage patient information, and support laboratory operations. Protecting sensitive biological data and ensuring privacy compliance are critical in Kenyan healthcare facilities, research institutions, and agricultural biotechnology firms. This chapter equips applied biology practitioners with the knowledge to safeguard their digital environments against threats and comply with relevant ICT laws in Kenya.
A biology laboratory holds data that took months or years to produce: unpublished experimental results, specimen and sequence databases, records of the places where rare species were found and, in some studies, personal details of the people who took part. Losing these data, altering them or letting the wrong person read them can end a project or harm people. This topic explains what data protection and privacy mean, the threats that come over the internet and from inside a laboratory, the controls that guard against them and the Kenyan laws that apply.
Data protection is the set of measures that keep data safe from loss, damage, unauthorised access and misuse. Privacy is the right of a person to decide how information about them is collected, used and shared. The two are linked: privacy sets what should be done with personal data, and data protection supplies the means of doing it. Personal data are any data that identify a living person, such as a name, a telephone number, an identity number, a photograph or a record of a research participant's responses.
A laboratory collects personal data when it keeps staff and attachment records, runs a survey of farmers or takes photographs in which people can be identified. The people concerned should be told why the data are collected, the data should be used only for that purpose and they should be kept no longer than needed. The protection of any kind of data, personal or not, rests on three goals, confidentiality, integrity and availability, which are described next.
Confidentiality means that data can be seen only by the people who are authorised to see them. It is protected by passwords and user accounts, by giving each user access only to the folders needed for the job, by encrypting files and drives, and by not discussing or posting sensitive data in open places. Example: the results of an unfinished experiment are kept in a folder that only the project team can open, and a technician who leaves the team loses access on the day of leaving. A breach of confidentiality happens when a laptop is stolen without an encrypted drive, when a file is sent to the wrong recipient or when data are shared in an open group.
Integrity means that data are accurate, complete and have not been changed except by authorised people in an authorised way. Data can lose integrity through accidental mistakes, such as typing over a cell in a spreadsheet of counts, through faulty storage that corrupts a file, and through deliberate tampering. Keep the original raw data in a read-only copy and work on a second copy. Record who changed what and when through version history or a logbook, and use checksums to confirm that a large file arrived unchanged. Altered data, even if altered innocently, can lead to wrong conclusions and to damaged scientific credibility.
Availability means that data and the systems that hold them can be used when authorised people need them. It is reduced by hardware failure, power cuts, software faults, deleted files and attacks such as ransomware and denial of service. It is protected by regular backups that are tested, by a surge protector or a UPS, by a spare copy of important files in another place and by a plan for restoring service. Example: if the computer that runs a seed bank's accession database fails on the day of a shipment, the staff must be able to recover the records from a backup within hours, and not weeks.
Any computer connected to the internet can be attacked from anywhere in the world. Attackers want data, money, control of the computer or simply to cause damage, and research laboratories are attractive targets because they hold valuable unpublished data and often have computers that are not updated. Threats exploit weaknesses in software, in networks and in people. The sections that follow describe the main kinds.
Malware, short for malicious software, is a program designed to harm a computer or steal data. The main types are these.
Malware enters through email attachments, downloads from untrustworthy sites, pirated software and infected flash drives. A drive passed between a field laptop, a laboratory computer and a computer at home can be a route. Signs of infection include a computer that suddenly slows down, programs that open by themselves, unknown files and pop-up messages. Ransomware is a type of malware with its own section below.
Social engineering attacks trick people, instead of computers, into giving away information or access. They work because people want to be helpful and tend to trust a confident request. Forms include pretexting, in which the attacker invents a story, for example a caller who claims to be from the supplier of an instrument and asks for the remote access code, and baiting, in which an infected flash drive is left where someone will find it and plug it in. In tailgating, an unauthorised person follows an employee through a locked door, and impersonation uses a false identity, such as that of a senior researcher who needs a password at once. Defence is to confirm the identity of the person through a separate, known channel before giving anything, and never to share a password with anyone.
A distributed denial of service attack floods a server, a website or a network with so much traffic from many devices that it cannot answer real users. The devices are usually computers and other equipment that have been infected and joined into a network controlled by the attacker, called a botnet. The target is made unavailable, even though no data may be stolen. A research group that runs an online data portal for its field stations can find the portal unreachable for its partners during an attack. Defence is mostly at the level of the hosting provider and the network, through traffic filtering and extra capacity, and an organisation needs a plan for what to do and who to call when its service goes down.
In a man-in-the-middle attack the attacker secretly places themselves between two parties who think they are communicating directly, so that they can read or alter what passes between them. It is common on open public wireless networks, where an attacker can set up a fake access point with a convincing name or capture unprotected traffic. A researcher who logs in to a data repository over an open public wireless network could have the password captured. Protection includes using HTTPS sites only, heeding browser warnings about certificates, avoiding sensitive work on public networks or using a VPN, and turning off automatic connection to open networks.
A password attack is an attempt to find or steal a password so as to enter an account. In a brute force attack a program tries every possible combination, and in a dictionary attack it tries common words and passwords. Credential stuffing tries passwords stolen from one service on many other services, which works when people reuse passwords. Other methods are keyloggers that record typing and shoulder surfing, in which someone watches the keyboard. Defence is a long, unique password or passphrase for each account, a password manager to remember them, two-step verification and a limit on the number of failed attempts.
The Internet of Things (IoT) is the set of everyday devices that connect to the internet, such as cameras, environmental data loggers, smart plugs, sensors and wireless printers. Many are sold with a default password, and their software is seldom updated, so attackers find them easily, take control and use them to enter the network or to join a botnet. A remote weather logger at a field station that still uses its factory password can be reached by anyone who finds it. Defence is to change default passwords, update device software, switch off features that are not used and keep such devices on a separate network from computers holding research data.
Phishing is the sending of messages that look like they come from a trusted source, in order to make the reader give away passwords or other information or open a harmful attachment. They arrive by email, text message, messaging apps and phone calls, and they often link to a copy of a genuine login page. Spear phishing is aimed at a particular person, for example an email that appears to come from a journal editor or a project funder and asks the researcher to log in to see a review. Warning signs are an urgent tone, a sender address that is slightly different from the real one, spelling errors, an unexpected attachment and a link whose real address differs from the text shown. Do not click or reply. Verify through another channel, and report the message to the person responsible for the systems.
Ransomware is malware that locks the files of a computer or network by encryption and demands payment for the key to unlock them. It usually arrives through a phishing message or an unprotected remote connection, and it can spread from one computer across the whole network. A laboratory affected by ransomware loses access to its data and instrument software, and payment gives no guarantee that the files will be returned. The best protection is a recent backup that is kept offline, so that the attack cannot reach it, together with updated software, careful handling of email and limiting each user's access to the files they need. If ransomware is found, disconnect the computer from the network at once and report it.
A computer threat is anything that can cause harm to computers, programs or data, whether it comes over the internet or not. Threats of other kinds include a staff member who misuses access, loss or theft of a laptop or flash drive, damage from fire, flooding or a power surge, hardware failure, the use of unlicensed software that may carry malware and the careless deletion or alteration of data. Insider threats deserve attention because the person already has legitimate access.
A computer crime is an offence in which a computer or network is the tool or the target. Examples include these.
The consequences for a laboratory are loss of research, damaged reputation, loss of the trust of collaborators and participants, and legal liability. These offences are dealt with under the laws described below.
A control is a measure that prevents, detects or reduces the effect of a threat. No single control is enough, so several are used together in layers, which is called defence in depth: if one fails, another still protects the data. Controls are grouped as physical, technical and operational.
Physical controls protect equipment and premises. They include lockable rooms for computers and servers, access by key, card or code to areas that hold instrument computers, cable locks for laptops and a register of who enters. Visitors are escorted and signed in. Equipment is placed away from water and heat, protected by a UPS and surge protector, and covered by fire precautions. CCTV and security staff deter and record entry. When a computer or drive is retired, its data are erased with a proper tool, or the drive is physically destroyed, before it leaves the laboratory.
Technical or logical controls are carried out by software and hardware. Users are identified by something they know, something they have or something they are, and stronger protection combines two of these.
| Name | Specification | Use |
|---|---|---|
| Password | A secret of letters, numbers and symbols; a long passphrase of several words is easier to remember and harder to guess | Signing in to accounts, computers and files |
| PIN | A short secret number tied to a particular device | Unlocking a phone or a tablet, or authorising a device |
| Biometrics | A fingerprint, face or iris scan | Unlocking a device or a room, as a second factor |
| Two-factor authentication | A password plus a code from a phone or a token | Protecting email, cloud storage and data portals |
Use a different password for each account, never share it, and avoid birth dates, names and simple sequences as passwords and PINs. Biometric features cannot be changed if they are stolen, and the scanner can accept the wrong person or reject the right one, so a backup method is provided. Other technical controls are firewalls, antivirus software, software updates, encryption of laptops, drives and files, and access permissions limiting what each user can read or change.
Operational controls are the policies, procedures and habits of the people who use the systems. They include a written security policy that says what staff may and may not do, training in recognising phishing and in handling data, and clear procedures for creating and closing user accounts when staff join or leave. Each person is given only the access that the job needs, and important tasks are shared between people so that one person cannot change records unseen. Regular backups are made and tested. An incident response plan says who to tell and what to do when something goes wrong, and systems are reviewed from time to time to find weaknesses. Operational controls fail when staff are not aware of them, so repeat the training.
Kenya has laws that make certain acts against computers and data offences and that set the duties of those who hold personal data. A technician is bound by them, as an individual and as an employee. The two laws named below are the central ones, and they should be read in their current form on the website of the National Council for Law Reporting (Kenya Law), because laws are amended.
This Act defines computer and internet offences and provides for their investigation and punishment. The offences include unauthorised access to a computer system, access with intent to commit another offence, unauthorised interference with data or a system, unauthorised interception of data, computer fraud, forgery, identity theft, cyber harassment and cyber espionage. A person who commits them can be prosecuted, and the Act provides for fines or imprisonment decided by the court. It also covers the powers of investigators and the collection of electronic evidence. The Act was amended by the Computer Misuse and Cybercrimes (Amendment) Act, 2025, assented to on 15 October 2025. Court cases followed: the High Court suspended some provisions in October 2025, and in July 2026 it declared two of the amended provisions unconstitutional, so the current text and court decisions should be checked. Cyber incidents may be reported to the National Kenya Computer Incident Response Team Coordination Centre.
This Act protects personal data and the privacy of the people they identify, who are called data subjects. It places duties on data controllers, who decide why and how personal data are processed, and on data processors, who process data for a controller. The principles require that personal data are processed lawfully, fairly and openly, collected for a stated purpose, limited to what is necessary, kept accurate, kept no longer than needed and kept secure. Data subjects have rights, including to be informed, to see their data, to have wrong data corrected and to object to its processing. Sensitive personal data, which include health and genetic data, need more care. The Office of the Data Protection Commissioner oversees the Act, and controllers and processors must register with the Commissioner unless they are exempt. A controller must notify the Commissioner of a breach within seventy-two hours of becoming aware of it. A research project that collects personal data from participants must plan for consent, secure storage and limited access.
This chapter explored the essential concepts of data protection, privacy, and security, emphasizing the confidentiality, integrity, and availability of data as fundamental principles. It examined various internet security threats including malware, social engineering, distributed denial of service, man-in-the-middle, password attacks, IoT vulnerabilities, phishing, and ransomware, highlighting their impact on digital environments. The discussion extended to computer threats and crimes, outlining the risks posed to information systems. Cybersecurity control measures were analyzed in three categories: physical controls, technical or logical controls such as passwords and biometrics, and operational controls that guide secure practices. The chapter concluded with an overview of the legal framework in Kenya governing ICT protection, focusing on the Computer Misuse and Cybercrimes Act No. 5 of 2018 and the Data Protection Act No. 24 of 2019, which provide regulatory measures to safeguard digital information and penalize cyber offenses. These topics collectively equip learners with the knowledge to apply cybersecurity skills effectively in various digital contexts.
The three fundamental principles are:
Two common malware types:
Phishing attacks trick staff into revealing login credentials, which attackers use to access confidential patient files, compromising privacy and possibly leading to data breaches at a county hospital.
Biometrics involves using unique physical characteristics like fingerprints or iris scans to verify identity, crucial for preventing unauthorized access to sensitive biological databases.
The Act criminalizes unauthorized access, data interference, and cyber fraud, protecting digital systems and data against cybercrimes in Kenya.
Physical controls include:
A DDoS attack floods a public health database server with traffic, overwhelming it and preventing legitimate users from accessing critical epidemiological data during outbreaks.
Confidentiality means protecting data from unauthorized access, e.g., farmers’ genetic seed data kept private; Availability ensures data can be accessed when needed, such as during pest outbreak analysis.
Operational controls like staff training on recognizing suspicious emails and enforcing strict verification procedures reduce susceptibility to social engineering in university biology departments.
Key provisions include:
Discuss how implementing technical controls such as strong passwords and biometrics can enhance data security in a biotechnology research facility.
Explain the role of Kenyan cybersecurity laws in protecting sensitive biological data and how professionals can ensure compliance in their workplaces.
Question 1 key points:
Question 2 key points:
The Kenya Agricultural and Livestock Research Organization (KALRO) maintains large datasets of genetic information on crop varieties. Recently, they experienced attempts of unauthorized access targeting their research database.
Tasks:
a) Identify three cybersecurity threats KALRO is likely facing and explain their potential impact on the genetic data. (6 marks)
b) Recommend four cybersecurity control measures appropriate for protecting KALRO’s digital assets. (8 marks)
c) Discuss how the Data Protection Act No. 24 of 2019 applies to KALRO’s handling of sensitive biological data. (6 marks)
a) Likely threats include:
b) Control measures:
c) The Data Protection Act mandates KALRO to obtain consent before collecting personal biological data, ensure data accuracy, and implement security measures to prevent unauthorized access or disclosure. Compliance protects research subjects’ privacy and maintains institutional integrity.
Question 11 (Compulsory - 20 marks)
At Nairobi County Referral Hospital, an increase in cyber threats has been reported, risking patient data confidentiality and system availability.
a) Describe the cybersecurity control measures that should be implemented at the hospital to protect sensitive patient data. (10 marks)
b) Discuss the implications of the Data Protection Act No. 24 of 2019 on how the hospital manages electronic health records. (10 marks)
Question 12 (20 marks)
Explain the various types of internet security threats that could target a research laboratory's digital systems and how these threats can compromise the integrity of experimental data.
Question 13 (20 marks)
Evaluate the roles of physical, technical, and operational controls in defending a pharmaceutical company’s information systems against password attacks and social engineering.
Question 14 (20 marks)
Discuss the legal provisions under the Computer Misuse and Cybercrimes Act No. 5 of 2018 that apply to cybercrimes encountered by agricultural cooperatives using online platforms for transactions.
Question 11
a) The hospital should implement layered cybersecurity controls including physical controls such as restricted access to server rooms; technical controls like strong passwords, firewalls, encryption, and biometrics for system access; and operational controls including staff training on phishing and social engineering risks, regular software updates, and incident response protocols. Network segmentation can limit the spread of malware, while data backup ensures availability.
b) The Data Protection Act requires the hospital to collect and process patient data lawfully, ensuring data accuracy, confidentiality, and patients’ rights to access their information. The hospital must appoint a Data Protection Officer, conduct impact assessments, and notify the Data Commissioner in case of breaches. Compliance enhances patient trust and avoids legal penalties.
Question 12
Internet security threats include malware (viruses, trojans), phishing attacks targeting staff emails, ransomware encrypting lab data, DDoS attacks disrupting online resources, and IoT vulnerabilities in connected laboratory equipment. These threats can corrupt experimental data, cause loss of research records, delay project timelines, and damage institutional reputation. Implementing antivirus software, access controls, and staff awareness can mitigate these risks.
Question 13
Physical controls such as surveillance cameras and secure access to computing facilities prevent unauthorized physical access to systems. Technical controls like multi-factor authentication, complex passwords, and biometric verification reduce the risk of password attacks. Operational controls involve regular staff training on recognizing social engineering tactics, enforcing policies on password management, and monitoring user activities to detect suspicious behavior. Together, these controls form a comprehensive defense.
Question 14
The Computer Misuse and Cybercrimes Act criminalizes unauthorized access, data interference, identity theft, cyberbullying, and electronic fraud. Agricultural cooperatives using online platforms face risks such as data theft and fraud. The Act empowers law enforcement to investigate and prosecute offenders, mandates institutions to implement cybersecurity measures, and requires reporting of cyber incidents. Compliance protects cooperative members’ data and enhances trust in digital transactions.
At the start of this chapter we promised you would be able to:
Tick each one you can genuinely do.
So, are you there yet?
You're competent when you can confidently do 50% or more of what this chapter promised.
Sign in to record how you're doing.