Even if all the technical security solutions appropriate for an organisation’s network are implemented, for example, firewalls, antivirus programs and encryption, if the human factor is neglected then these technical security solutions will serve no purpose. The greatest challenge to network security is probably not the technological solutions that organisations invest in, but the human factor (non-technical solutions), which most organisations neglect. The human factor is often ignored even though humans are the most important resources of organisations and perform all the physical tasks, configure and manage equipment, enter data, manage people and operate the systems and networks. The same people that manage and operate networks and systems have vulnerabilities. They are not perfect and there will always be an element of mistake-making or error. In other words, humans make mistakes that could result in security vulnerabilities, and the exploitation of these vulnerabilities could in turn result in network security breaches. Human vulnerabilities are driven by many factors including insufficient security education, training and awareness, a lack of security policies and procedures in the organisation, a limited attention span and negligence. Network security may thus be compromised by this human vulnerability. In the context of this dissertation, both physical and technological controls should be implemented to ensure the security of the SANReN network. However, if the human factors are not adequately addressed, the network would become vulnerable to risks posed by the human factor which could threaten the security of the network. Accordingly, the primary research objective of this study is to formulate guidelines that address the information security related human factors in the rolling out and continued management of the SANReN network. An analysis of existing policies and procedures governing the SANReN network was conducted and it was determined that there are currently no guidelines addressing the human factor in the SANReN beneficiary institutions. Therefore, the aim of this study is to provide the guidelines for addressing the human factor threats in the SANReN beneficiary institutions.

This dissertation addresses the problem of a lack of a formal incident response capability in the South African National Research and Education Network (SA NREN). While investigating alternatives it was found that no clear method exists to solve this problem. Therefore, a second problem is identified: the lack of a definitive method for establishing a Computer Security Incident Response Team (CSIRT) or Computer Emergency Response Team (CERT) in general. Solving the second problem is important as we then have a means of knowing how to start when building a CSIRT. This will set the basis for addressing the initial problem, resulting in a prepared, improved and coordinated response to IT security incidents affecting the SANREN. To commence, the requirements for establishing a CSIRT are identified via a comprehensive literature review. These requirements are categorized into five areas, namely, the basic business requirements followed by the four Ps of the IT Infrastructure Library (ITIL). That is, People, Processes, Product and Partners, adapted to suit the CSIRT context. Through the use of argumentation, the relationships between the areas are uncovered and explored. Thereafter, a Design Science Research-based process is utilised to develop a generic model for establishing a CSIRT. The model is based on the interactions uncovered between the business requirements and the adapted four Ps. These are summarised through two views -- strategic and tactical -- together forming an holistic model for establishing a CSIRT. The model highlights the decisions required for the business requirements, services, team model and staff, policies and processes, tools and technologies, and partners of a CSIRT respectively. Finally, to address the primary objective, the generic model is applied to the SANREN environment. Thus, the second artefact is an instantiation, a specific model, which can be implemented to create a CSIRT for the SA NREN. To produce the specific model, insight into the nature of the SANREN environment was required. The status quo was revealed through the use of a survey and argumentative analysis of the results. The specific decisions in each area required to establish an SA NREN CSIRT are explored throughout the development of the model. The result is a comprehensive framework for implementing a CSIRT in the SA NREN, detailing the decisions required in each of the areas. This model additionally acts as a demonstration of the utility of the generic model. The implications of this research are twofold. Firstly, the generic model is useful as a basis for anyone wanting to establish a CSIRT. It helps to ensure that all factors are considered and that no important decisions are neglected, thereby enabling an holistic view. Secondly, the specific model for the SA NREN CSIRT serves as a foundation for implementing the CSIRT going forward. It accelerates the process by addressing the important considerations and highlighting the concerns that must be addressed while establishing the CSIRT.

In recent years, immense effort has been channelled towards the Information and Technological development of rural areas. To support this development, telecommunication networks have been deployed. The availability of these telecommunication networks is expected to improve the way people share ideas and communicate locally and globally, reducing limiting factors like distance through the use of the Internet. The major problem for these networks is that very few of them have managed to stay in operation over long periods of time. One of the major causes of this failure is the lack of proper monitoring and management as, in some cases, administrators are located far away from the network site. Other factors that contribute to the frequent failure of these networks are lack of proper infrastructure, lack of a constant power supply and other environmental issues. A telecommunication network was deployed for the people of Dwesa by the Siyakhula Living Lab project. During this research project, frequent visits were made to the site and network users were informally interviewed in order to gain insight into the network challenges. Based on the challenges, different network monitoring systems and other solutions were deployed on the network. This thesis analyses the problems encountered and presents possible and affordable solutions that were implemented on the network. This was done to improve the network‟s reliability, availability and manageability whilst exploring possible and practical ways in which the connectivity of the deployed telecommunication network can be maintained. As part of these solutions, a GPRS redundant link, Nagios and Cacti monitoring systems as well as Simple backup systems were deployed. v Acronyms AC Access Concentrators AMANDA Automatic Marylyn Network Disk Archiver CDMA Code Divison Multiple Access CGI Common Gateway Interface.

In recent years, immense effort has been channelled towards the Information and Technological development of rural areas. To support this development, telecommunication networks have been deployed. The availability of these telecommunication networks is expected to improve the way people share ideas and communicate locally and globally, reducing limiting factors like distance through the use of the Internet. The major problem for these networks is that very few of them have managed to stay in operation over long periods of time. One of the major causes of this failure is the lack of proper monitoring and management as, in some cases, administrators are located far away from the network site. Other factors that contribute to the frequent failure of these networks are lack of proper infrastructure, lack of a constant power supply and other environmental issues. A telecommunication network was deployed for the people of Dwesa by the Siyakhula Living Lab project. During this research project, frequent visits were made to the site and network users were informally interviewed in order to gain insight into the network challenges. Based on the challenges, different network monitoring systems and other solutions were deployed on the network. This thesis analyses the problems encountered and presents possible and affordable solutions that were implemented on the network. This was done to improve the network‟s reliability, availability and manageability whilst exploring possible and practical ways in which the connectivity of the deployed telecommunication network can be maintained. As part of these solutions, a GPRS redundant link, Nagios and Cacti monitoring systems as well as Simple backup systems were deployed. v Acronyms AC Access Concentrators AMANDA Automatic Marylyn Network Disk Archiver CDMA Code Divison Multiple Access CGI Common Gateway Interface.