RELATIONSHIP BETWEEN INDUSTRY BEST PRACTICES AND INFORMATION SECURITY BREACH INCIDENTS OF SACCOS IN KENYA

Abstract

Information is an important organizational asset that that is mainly vulnerable to attacks from
user error, hackers and crackers, viruses and cyber criminals. This has resulted in loss of trillions
of dollars around the world and over 4 billion shillings in East Africa. The study investigated
whether information security policies assist in preventing unauthorized individuals from
accessing SACCOS’ sensitive information. The study looked at the relationship between
dependent and independent variables. The study investigated the relationship between industry
best practices and information security breach incidents The study used correlational survey as
its research design. The study utilized a questionnaire as a survey instrument to collect responses
from 85 SACCOS IT personnel with regard to their perceptions of how information security
policies affect computer security breach incidents. Coefficient of variation was used to determine
the sample size of 85 SACCOS registered with SASRA. Further, Simple random sampling was
used to select 85 SACCOS. From the 85 SACCOS, one IT personnel was selected using simple
random sampling from each SACCOS to obtain 85 IT personnel from a total of 270 IT personnel
from 135 SACCOS registered with SASRA. A pilot test was carried out to test the validity of
the survey instrument. Cronbach’s alpha coefficient was used to assess the internal reliability of
the research instrument. Quantitative data was analyzed by using Statistical Package for Social
Sciences (SPSS) version 22. Research hypotheses were tested using both 2 tailed t-tests and
analysis of variance (ANOVA) tests. Pearson correlation was conducted to test the relationship
between independent variables and dependent variable. Regression analysis was used to show
the contribution of each independent variable to the dependent variable. Null hypothesis was
tested at 95% level of confidence. If the p-value obtained is less than 0.05, then the null
hypothesis was rejected, but if the p-value obtained was more than 0.05, then the null hypothesis

was accepted. The results of the study revealed that there is a weak relationship between
information security policies and security breach incidences in the SACCOS sector