1.1 Introduction
Cybersecurity is the practice of protecting systems, networks, and data from digital attacks, unauthorized access, and damage (Stallings, 2017). As organizations increasingly rely on information technology for their operations, the risk of security breaches has grown significantly. One of the most challenging security issues today is the threat posed by insiders employees or trusted individuals who misuse their access privileges to compromise an organization's information systems (Greitzer & Frincke, 2010). Insider threats are particularly difficult to detect because they originate from authorized users who have legitimate access to sensitive systems. These threats include data theft, fraud, sabotage, and unauthorized disclosure of confidential information. Traditional security measures, such as firewalls and antivirus software, are often insufficient to identify these internal risks because they focus primarily on external attacks rather than activities occurring within the organization (Eberle & Holder, 2009).
As a prelude to other parts of this study, this chapter will discuss the background upon which this study was initiated, the statement of problems that led to this study, the Aim and Objectives of the study. Others are Significance of the study, Scope of work, Limitation of the study and Definition of technical terms.
1.2 Background of Study
Cybersecurity has become a central concern for organizations worldwide due to the increasing reliance on digital systems for storing and processing sensitive information. According to Stallings (2017), cybersecurity involves the measures, practices, and technologies employed to safeguard information systems from unauthorized access, disruption, or damage. Insider threats, which originate from individuals with legitimate access to organizational resources, present one of the most difficult challenges in cybersecurity because the perpetrators already operate within trusted boundaries (Stallings, 2017).
Several studies have reported that insider threats are responsible for a significant proportion of security breaches in organizations. Greitzer and Frincke (2010) reported that insiders often engage in malicious activities such as data theft, sabotage, and unauthorized disclosure of confidential information, which are difficult to detect using traditional security measures. Eberle and Holder (2009) asserted that the subtle nature of insider threats, combined with the complexity of organizational systems, makes it challenging to identify suspicious behavior without systematic monitoring and analysis of user activities. Furthermore, logs generated by IT systems serve as critical records for detecting anomalies and potential threats. Salem, Hershkop, and Stolfo (2008) stated that automated log analysis provides the ability to process large datasets efficiently, identify unusual patterns, and support timely responses to potential security incidents.
The National Information Technology Development Agency (NITDA), as Nigeria's regulatory body for IT standards and practices, maintains vast information systems that are susceptible to insider threats. It is reported that breaches in government agencies can lead to severe consequences, including data leaks, financial losses, and damage to public trust (Greitzer & Frincke, 2010). On the other hand, the adoption of intelligent, automated cybersecurity tools can strengthen organizational defenses by analyzing logs in real time and flagging activities that deviate from normal behavioral patterns (Salem et al., 2008). This study is set against the backdrop of designing a cybersecurity log analyzer specifically aimed at detecting insider threats within NITDA.
1.3 Statement of Problem
Following the investigation, it was revealed that the traditional system implemented struggles with various challenges, several of which stand out as particularly critical:
- The current cybersecurity systems at NITDA and similar organizations face several challenges.
- Manual log monitoring method in the traditional system was time-consuming, error-prone, and inefficient in detecting insider threats.
- Existing automated tools were generic, generating excessive alerts that lead to alert fatigue and the overlooking of critical threats.
- Furthermore, incomplete or unstructured log data was limiting the ability to identify patterns of malicious activities.
- Lastly, the lack of context-aware and intelligent analysis tools was reducing the effectiveness of threat detection, exposing sensitive systems to potential breaches and data leaks.
1.4 Aim and Objectives of the Study
The aim of the study is to design and implement a cybersecurity log analyzer capable of detecting insider threats within NITDA's information systems. In achieving this aim, the following specific objectives were laid out as follows:
- To design a system that automatically collects and analyzes user and system logs for anomalous activities.
- To implement a prototype cybersecurity log analyzer tailored for insider threat detection.
- To test and validate the effectiveness of the system in identifying potential insider threats.
- To evaluate the current cybersecurity log monitoring practices at NITDA.
1.5 Significance of Study
It is believed that at the completion of the study, the research will provide a reliable system for detecting insider threats, thereby strengthening the cybersecurity posture of NITDA. Also, information technology auditors will be able to verify compliance and ensure proper monitoring of organizational systems.
Furthermore, security teams will have access to automated, accurate, and timely insights into insider activities, improving overall threat management. In addition, management will benefit from improved decision-making due to real-time reporting of potential security breaches.
Lastly, the system will reduce the workload of security personnel, improve response times, enhance decision-making in threat management, and serve as a model for other organizations facing insider threat challenges.
1.6 Scope of Study
This study focuses on the National Information Technology Development Agency (NITDA) in Nigeria. The project involves analyzing system and user logs generated within NITDA, designing a cybersecurity log analyzer, and implementing a prototype system to detect insider threats. The study is limited to detecting activities within organizational IT systems and does not cover physical security or external cyberattacks.
1.7 Limitations of the Study
During the course of this study, many things militated against its completion, some of which are:
- Time Constraint: The time frame given to accomplish this project was very short due to school academic calendar and it was carried out under pressure which made the researcher not to implement some necessary features.
- Establishment Policies: Establishment policies posed a serious limitation as most staffs are not ready to release information needed for this research work. There were lots of information needed from the staffs of this institution to enhance the study which took them time to release or they did not release at all for security purposes, hence the scope was reduced.
- Financial Constraint: Insufficient fund tends to impede the efficiency of the researcher in sourcing for the relevant materials, literature or information and in the process of data collection (internet).
1.8 Definition of Terms
Cybersecurity: The practice of protecting systems, networks, and data from unauthorized access or attacks (Stallings, 2017).
Insider Threat: A security risk that originates from someone within the organization who misuses access privileges to compromise systems or data (Greitzer & Frincke, 2010).
Log Analyzer: A software tool that automatically collects, parses, and examines system or user activity logs to detect anomalies and potential security incidents (Eberle & Holder, 2009).
Anomaly Detection: The process of identifying unusual patterns in data that do not conform to expected behavior, often used to detect malicious activities (Salem, Hershkop, & Stolfo, 2008).
…