Managing Information Security In a Disruptive IT Landscape A Presentation to ISACA Kenya Chapter Annual Conference, Mombasa By G. MURAGURI, CISM, CGEIT Ag. DC – ICT, KRA 25th May 2017

Content Introduction KRA Services The Changing IT Landscape How We Approach Security Adopting to a Disruptive IT Landscape

1. Introductionp The vision of KRA ICT is to achieve fully integrated electronic customer service, self service KRA recognizes ICT as a “strategic business enabler and game changer in support of the Authority’s corporate mandate” KRA like other organizations embracing modernization is faced with challenges and opportunities presented by the changing IT landscape

2. KRA Services Filing of Tax Returns M-service – Enquiries & Payments Customs Online Payment Customs Clearance Real Time Cargo Monitoring PIN Applications & Enquiries TCC Applications & Enquiries WCO E-Learning Excisable Goods Management System Other ICT developments under implementation impacting on KRA’s operations include: Data Warehousing and BI Mobile phone services “Cash-lite” societies – No carrying physical cash Reengineering of business processes On-going Government automation/3rd party Data sharing ICT a ‘Game Changer’ in revenue administration

3. The Changing IT Landscape Data is everywhere. Shared infrastructure/Storage Internet Everywhere Virtualization/Cloud Computing Need to support legacy while trying to be agile. Mobility & Smart Devices. BYOD/CYOD Technology Savvy Users & Curious generation – insider threats Shift from Device(PC) to user centric.

4. How Do We Approach Security? IT Governance and best practice standards adoption – ITIL, COBIT 5 Information Security Management System Framework – based on ISO27001 People Dedicated & Committed Personnel. Staff awareness & training Competent resources (qualifications & skills) PROCESS Governance frameworks Best Practice & framework IT Audits Technology You can’t deploy technology without competent people, support processes IT Risk Management Business Continuity - Redundancy & Disaster Recovery/Alternate sites. IT Change Management/CAC Capacity Planning , testing Security Solutions in tandem with changing & sophisticated technology landscape

5. Adopting to a Disruptive IT Landscape Institutionalized IT governance – reflected in IT org structure and practices Information security policies & practices Enterprise risk management - encompasses IT risk management Information System Security function Capabilities for monitoring , detecting and combating cyber threats – both technical and personnel Actively monitor global trends in technology and cyber threats and address the opportunities and challenges on a risk basis

5. Adopting to a Disruptive IT Landscape…contd Awareness on the need of everyone’s “due diligence” in ensuring information security – including partners , staff and customers Collect insight on threat indicators & Monitor emerging threats Work with other government agencies and security experts in dealing with cyber threats Share information on IT security regularly

Please remember to file your 2016 tax returns before 30th June 2017 iTax ni rahisi!