Critical Information Infrastructure Protection Framework Development: Preliminary Findings from the Malaysian Public Sector
Saiful Bahari Mohd Sabtu, Kamaruddin Malik Mohamad · 2020
This paper reports preliminary findings on the Malaysian Public Sector Critical Information Infrastructure Protection (MPS CIIP) Framework development. Malaysia Public Sector (MPS) requires sectoral references in the form of directive and guidelines to facilitate its organization's management and operations. MPS organizations also require a framework to maintain CII operational security and resilience as stated in the National Cyber Security Policy (NCSP). As sectoral references pertaining to CIIP is currently lacking, this research aims to fill in the void and provide feasible CIIP Framework based on the Secure and Resilience attribute mentioned in the NCSP. This paper outlined ongoing work to develop a secure and resilient CIIP using the Grounded Theory method. As part of an observational descriptive study, we conducted a pilot interview among CII personnel in the MPS to acquire preliminary input and to test our interview questions. The outcome of this phase yielded a better understanding of the MPS CIIP landscape and provided future direction in terms of revised interview questions and better respondent selection criteria. The pilot interview process garnered up to date opinion on current public sector CIIP issues and challenges. Respondents provided valuable up to date insights such as top-to-bottom directive operating model, governance, finance and resource constraints, information sharing, dependency on focal point agency, CIIP monitoring and preparedness level. MPS CIIP Framework will be developed in line with NCSP vision to create secure, resilient, and self-reliant CIIs. The framework would assist related MPS agencies to deliver its initiatives such as preparedness and capacity building programs to increase its security and resilience.