1. Managing Information Security In a Disruptive IT Landscape
A Presentation to
ISACA Kenya Chapter Annual Conference, Mombasa By
G. MURAGURI, CISM, CGEIT
Ag. DC – ICT, KRA
25th May 2017

2. Content Introduction KRA Services The Changing IT Landscape
How We Approach Security
Adopting to a Disruptive IT Landscape

3. 1. Introductionp
The vision of KRA ICT is to achieve fully integrated electronic customer service, self service
KRA recognizes ICT as a “strategic business enabler and game changer in support of the Authority’s corporate mandate”
KRA like other organizations embracing modernization is faced with challenges and opportunities presented by the changing IT landscape

4. 2. KRA Services
Filing of Tax Returns
M-service – Enquiries & Payments
Customs Online Payment
Customs Clearance
Real Time Cargo Monitoring
PIN Applications & Enquiries
TCC Applications & Enquiries
WCO E-Learning
Excisable Goods Management System
Other ICT developments under implementation impacting on KRA’s operations include:
Data Warehousing and BI
Mobile phone services
“Cash-lite” societies – No carrying physical cash
Reengineering of business processes
On-going Government automation/3rd party Data sharing
ICT a ‘Game Changer’ in revenue administration

5. 3. The Changing IT Landscape
Data is everywhere.
Shared infrastructure/Storage
Internet Everywhere
Virtualization/Cloud Computing
Need to support legacy while trying to be agile.
Mobility & Smart Devices. BYOD/CYOD
Technology Savvy Users & Curious generation – insider threats
Shift from Device(PC) to user centric.

6. 4. How Do We Approach Security?
IT Governance and best practice standards adoption – ITIL, COBIT 5
Information Security Management System Framework – based on ISO27001
People
Dedicated & Committed Personnel.
Staff awareness & training
Competent resources (qualifications & skills)
PROCESS
Governance frameworks
Best Practice & framework
IT Audits
Technology
You can’t deploy technology without competent people, support processes
IT Risk Management
Business Continuity - Redundancy & Disaster Recovery/Alternate sites.
IT Change Management/CAC
Capacity Planning , testing
Security Solutions in tandem with changing & sophisticated technology landscape

7. 5. Adopting to a Disruptive IT Landscape
Institutionalized IT governance – reflected in IT org structure and practices
Information security policies & practices
Enterprise risk management - encompasses IT risk management
Information System Security function
Capabilities for monitoring , detecting and combating cyber threats – both technical and personnel
Actively monitor global trends in technology and cyber threats and address the opportunities and challenges on a risk basis

8. 5. Adopting to a Disruptive IT Landscape…contd
Awareness on the need of everyone’s “due diligence” in ensuring information security – including partners , staff and customers
Collect insight on threat indicators & Monitor emerging threats
Work with other government agencies and security experts in dealing with cyber threats
Share information on IT security regularly

11. Please remember to file your 2016 tax returns before 30th June 2017
iTax ni rahisi!