Enhancing Cyber Resilience through Adaptive Security Policies

Rapid advancements in technology have led to increased cyber incidents and data breaches. This has made cyber resilience a crucial aspect of a comprehensive cybersecurity framework. Kenya has also seen a surge in cyberattacks targeting critical infrastructure and important government services. This underscores the need for a cybersecurity resilience framework based on adaptive security principles. The Directorate of Immigration and Citizen Services is crucial in providing efficient services and setting cybersecurity standards for all government agencies. This study investigates how adaptive security policies bolster cyber resilience within the Directorate of Immigration Services in Kenya while scrutinising the impact of organisational culture on both technical and non-technical aspects of cybersecurity resilience. The research design used a mixed-methods approach, including a systematic literature review and interviews with 73 cybersecurity professionals, system administrators, network engineers, and non-technical staff from the Directorate. Data collection methods included questionnaires, interviews, and forensic examination of past cyber incidents. Quantitative data was analysed using SPSS, while qualitative data underwent thematic analysis. The study reveals that the Directorate of Immigration Services uses advanced technologies and methods to address cyber threats. However, challenges remain in identifying, addressing, and recovering from these incidents. Organisational culture is vital in promoting cybersecurity awareness and practices among employees. To enhance cyber resilience in the Directorate of Immigration Services and throughout Kenya, a comprehensive strategy is needed. This strategy should include promoting awareness, providing targeted training, reviewing policies, and implementing cutting-edge technologies. The research also suggests developing a national cyber resilience framework, adopting an adaptive security approach, fostering a security-first culture, prioritising cyber resilience training, implementing a comprehensive risk management framework, and establishing standardised incident reporting and response mechanisms to ensure cybersecurity resilience in Kenya.