2.1 Information security risks

Libraries and information centres in Kenya face a spectrum of security risks that threaten the integrity, availability, and confidentiality of their collections and data. Understanding how to identify these risks, knowing the types of threats present, and recognising potential disasters is fundamental for effective preservation and security management.

2.1.1 Methods of risks identification

Identifying risks to information materials requires a comprehensive approach combining multiple methods that provide insights into potential vulnerabilities and threats. Kenyan libraries, whether in university settings or public county libraries, must employ these methods to detect weaknesses before exploitation occurs. No single method gives the full picture, so the findings of one are normally checked against the others.

Vulnerability assessments

This method involves systematically examining information systems and physical storage areas to identify weaknesses that could be exploited. The assessor lists the assets (catalogue servers, rare book rooms, archive shelves), checks each one against known weaknesses, and ranks the findings by how serious they are. Example: a county library might assess its digital catalogue system for outdated software or weak password protocols that could allow unauthorised access, and also inspect the archive room for unprotected windows and leaking roofs.

Penetration testing

Simulated cyber-attacks are conducted to test the security of information systems. The testers act as an attacker would, but under written permission and agreed limits, and they report every gap they manage to exploit. Example: in a university library, IT staff may attempt to breach the online repository to uncover security gaps that real attackers could exploit, such as an exposed login page for the e-theses collection.

Risk audits and reviews

Regular audits evaluate current security measures and policies to ensure they meet required standards. The auditor compares what is written in policy with what staff actually do, and records any difference as a finding with a recommended correction. Example: a national archive may schedule quarterly reviews to verify compliance with data protection laws and preservation standards, checking items such as the access register for the restricted records room.

Threat intelligence gathering

Collecting data on emerging threats from external sources such as cybersecurity bulletins or law enforcement alerts helps libraries stay informed. The information is sorted into threats that are relevant to the institution and those that are not, so that attention goes where it is needed. Example: a large public library may subscribe to threat feeds to anticipate ransomware attacks targeting cultural institutions, and then warn staff about the type of suspicious email in circulation.

Employee surveys and interviews

Engaging staff through surveys or interviews uncovers internal risks, such as inadvertent data leaks or procedural lapses. Staff work with the materials daily and often know about shortcuts, shared passwords or unlocked storage that never appear in a formal audit. Example: a university library might survey its employees to assess awareness of information security protocols and identify training needs.

2.1.2 Types of risks

Information materials in libraries face diverse risks that can disrupt access or compromise data integrity. Kenyan information professionals must understand these risks to design effective safeguards. Each risk below can affect printed, audiovisual and digital materials, although the way it does so differs.

Cyber attacks

External actors may launch malware, phishing, or ransomware attacks targeting digital catalogues or e-resources. Malware damages or steals data, phishing tricks staff into giving away passwords, and ransomware locks files until a payment is demanded. Example: a university library's online access system may be targeted to disrupt student access during examinations.

Insider threats

Employees or contractors with authorised access may intentionally or accidentally compromise information. Intentional cases include copying or selling restricted material, while accidental cases include sending a confidential file to the wrong recipient or leaving a workstation logged in. Example: in a special library holding confidential corporate research reports, an insider might misuse access to copy restricted reports.

Data loss or theft

Physical or digital materials can be lost due to theft, misplacement, or deletion. Loss is often quiet: a shelved item is not found at stocktaking, or a folder is overwritten and nobody notices for weeks. Example: a county government library could face theft of rare manuscripts, or a university library's digitised thesis files might be lost through accidental deletion.

System failures

Hardware malfunctions, software bugs, or power outages can result in data unavailability or corruption. Such failures usually come without warning and affect everyone who depends on the system at the same moment. Example: a university library whose catalogue and e-journal server fails during a power outage leaves students and lecturers unable to reach the resources they need during a busy study period.

Compliance violations

Failure to adhere to laws such as Kenya's Data Protection Act can lead to legal penalties and reputational damage. Libraries hold personal data such as borrower records and registration details, and they must collect, store and share it lawfully. Example: a public library must ensure that patron registration data is handled according to privacy requirements and is not shared without a lawful basis.

2.1.3 Types of disasters

Disasters affecting information materials can be broadly categorised into natural, man made, and technological, each requiring tailored preparedness and response strategies. The category tells the information professional what caused the event, which in turn shapes how the library prepares for it and how it recovers.

Natural

Natural disasters come from environmental forces that people cannot prevent, so the library's task is to reduce exposure and damage.

• Floods: Heavy rains may cause flooding that damages physical collections in libraries located in flood-prone regions. Water swells paper, loosens bindings and quickly encourages mould, so a public library near a lake must protect its archives against seasonal floods, for example by keeping them off the floor.
• Fires: Bush fires and lightning strikes can spread to or ignite library buildings, destroying paper, discs, tapes and servers. Fires started by electrical faults or careless handling are man made and are covered under that heading.
• Earthquakes: Though less frequent, seismic activity can cause structural damage affecting information storage facilities in the Rift Valley region. Shaking can topple shelving and crack walls, burying materials under debris.
• Storms and strong winds: Severe weather can disrupt power and communication, hindering access to digital resources in county libraries. Wind and rain can also damage roofs and let water into storage areas.
• Pests and mould: Environmental conditions conducive to pests or mould growth can degrade paper-based materials, requiring humidity control in storage areas. Insects feed on paper and glue, and mould stains and weakens pages, particularly in warm, damp rooms with poor ventilation.

Man made

Man made disasters result from human action, whether deliberate or careless, and they are often preventable.

• Arson and vandalism: Deliberate destruction of library property can result in significant loss of information materials. An urban public library may face vandalism during civil unrest.
• Accidental fires: Faulty wiring, overloaded sockets, cooking or smoking near the stacks can start fires that destroy whole collections.
• Theft: Targeted theft of rare books or sensitive documents occurs in libraries with inadequate security measures. At disaster scale this means an organised break-in that strips a special collection, which is far larger than a single missing item.
• Negligence: Improper handling or storage by staff can lead to damage or loss, such as mishandling archival materials in an archive reading room. Examples include stacking heavy boxes on fragile volumes or leaving a reading room tap running.
• Civil unrest: Political demonstrations or riots can disrupt library operations or cause physical damage. Buildings may have to close for days, leaving the collection unattended and exposed.
• Sabotage: Insider actions aiming to disrupt library services or damage reputation through data manipulation. A disgruntled employee might alter catalogue records or disable systems so that materials cannot be found.

Technological

Technological disasters arise from the failure of the equipment and networks on which digital information services depend.

• Hardware failures: Malfunctioning servers or storage devices can lead to data loss or inaccessibility in digital repositories. When the failed device holds the only copy of a digitised collection, the loss can be permanent.
• Software corruption: Bugs or incompatibilities may corrupt files or databases vital for information retrieval. A faulty update to a library management system, for example, can leave the catalogue unreadable.
• Power outages: Sudden loss of electricity can interrupt digital systems and damage electronic storage devices. Equipment shut down abruptly may lose unsaved work and suffer disk damage.
• Network failures: Disruptions in internet connectivity affect access to cloud-based resources in libraries. Patrons cannot reach subscribed e-journals, and staff cannot reach remotely hosted records.
• Large-scale system compromise: When a ransomware or similar attack takes down shared servers, the whole library service is paralysed. Circulation, cataloguing and online access all stop together, and recovery depends on how well the library has prepared (the attack methods themselves are described under cyber attacks).

Chapter Summary

This chapter explored the various aspects of securing information materials by first examining the different methods used to identify security risks, including vulnerability assessments, risk audits, and employee surveys. It then detailed the types of risks that organizations face, such as cyber attacks, insider threats, data loss, system failures, and compliance violations. The discussion extended to the classification of disasters that could impact information security, covering natural, man-made, and technological events. The chapter further described the range of information security techniques, starting with physical measures like security guards and CCTV cameras, followed by technological controls such as firewalls, encryption, and regular backups. Administrative approaches were also emphasized, focusing on policy development and compliance audits to ensure ongoing security. Finally, the importance of securing information materials through a combination of these risk management and security techniques was highlighted to protect organizational data assets effectively.