Cybersecurity Threats and Mitigation Strategies in E-Procurement Systems: A Case Study of A Local Government (Public Sector)

Technological advancement has undoubtedly impacted humanity in different ways influencing the way things are done. This has informed the transition of the traditional manual procurement processes to the internet-enabled e-procurement systems which is fast gaining popularity and acceptance across the globe because of the enormous benefits therein. However, cybercriminals, taking advantage of the technology, have become more sophisticated in their antics thereby necessitating the need for the study into the cybersecurity and mitigation methods to make e-procurement systems secured for safe use. This has become pertinent as there have been cyber incident(s) in the public sector service industry that had raised concerns regarding the continued use of e-procurement systems. Especially so because there is not much research in this subject area to give more practical insights in Nigeria and Sub-Saharan African countries. The research was carried out using the questionnaire designed using the cloud-based JISC Online Surveys to elicit objective data from experienced professionals while two key and strategic professionals were interviewed to harvest accurate and adequate information regarding the implementation of e-procurement systems and the related data security issues. The combination of quantitative data from the questionnaires and the qualitative data from the interview made it possible to gather all relevant data that might be overlooked if only one method was used. It has been confirmed through this study that pre-engagement security checks on personnel is imperative to reduce the possibility of insider attacks and that organizational policies are needed regarding incident response, the use of peripherals and personal devices within the organization, the regular backup policy and consistent update of Disaster Recovery Plans. Also important is regular personnel capacity building to keep them up to date, especially in security awareness to build a security culture across organizations. Furthermore, it has been confirmed that appropriately configured firewalls (hardware and / or software) would shield an application (website), organizational systems and networks from the DDoS attacks; the introduction of role-based access control in an application will prevent the possibility of unauthorized access to system resources through escalation of user privileges; finally when properly configured, an application can prevent SQLi attack through input validation which can be enhanced to prevent brute force attack; and when strong identification authentication is used, it would be difficult for cybercriminals to successfully use stolen login details to gain unauthorized access to systems or applications. All re-affirming that security must be built into every application (e-procurement) from the design phase to achieve the security goals of confidentiality, integrity, and availability.