By Austin Okere
“Twitter hack: 130 accounts targeted in the attack” was the screaming headline on the BBC’s website on July 17, 2020.
Two days earlier, the social media site had admitted a major cyber-attack of celebrity accounts. The security breach saw accounts including those of Barack Obama, Elon Musk, Kanye West and Bill Gates tweet a Bitcoin scam to millions of followers. Several Bitcoin-related accounts began tweeting what appeared to be a simple Bitcoin scam, promising to “give back” to the community by doubling any Bitcoin sent to their address. Then, the apparent scam spread to mainstream celebrity accounts such as Kim Kardashian West and former vice-president Joe Biden and those of corporations Apple and Uber.
Twitter is not the only high-profile company that has been hit. Just about every other company you can think about has suffered a similar fate. The roll call of victims includes Rupert Murdock’s News Corp, Sony PlayStation Network, Government of turkey, Britain’s Serious Organized Crime Agency, and the CIA amongst others.
The story of hacking will not be complete without Anonymous; a sophisticated group of politically motivated hackers who have emerged since 2011. Anonymous are demonstrating how vulnerable companies that are charged with protecting our data are. Anonymous hacked 485 Chinese government websites, some more than once, to protest the treatment of their citizens. Among their major successful hacks are Visa, MasterCard, Amazon, PayPal, PostFinance, Bank of America, and Sony Computer Entertainment. We are at the beginning of the mighty struggle for the internet with the aged old dilemma that pits the demands of security with the desires for freedom.
Cybercrime has now become so prevalent globally that there is hardly any organization that is yet to be hacked, and Nigeria is no exception. In fact, it is said that there two types of organizations, those that know they have been hacked and those that don’t. If in doubt, ask your customers, and they will have a bucketful of useful feedback for you.
The increasing trends in cybersecurity breaches are due to the following factors; the rise of Artificial Intelligence (AI), adoption of Internet of Things (IoT) – with over 25b devices forecasted to be connected by 2025, globalisation of cybercrime, the cybersecurity skills gap that continues to grow, Increased skill levels of attackers, increased use of the Public Cloud, increasing reliance on technology and digitisation – (now fuelled by the pandemic and working from home) and attackers risk/reward imbalance amongst others.
Polls at a recent cybersecurity webinar that I facilitated was very revealing:
• 54% of respondents said they had been hacked
• 31% said their company had been hacked
• 67% considered PEOPLE the weakest link in cybersecurity – way over Process, and Technology.
And yet we spend significantly more money on products and technology, with little emphasis on mass education.
Hiring the most accomplished CISA, however, will not do very much good if there is not a deliberate policy of self-awareness of all staff, especially during this period where there is an explosion in people working from home and connecting to enterprise servers through personal systems that could more easily be compromised. Neither is buying the most expensive antivirus the magic wand. It is like having the best pizza toppings without the base bread. Or like having the best machine learning algorithm without the Big Data that the system will use for pattern detections.
Cyber-attacks can have a significant business impact including; loss of funds, theft of intellectual property, serious disruption to business, damage to reputation, loss of customer trust, huge regulatory fines, litigation costs and possible bankruptcy.
Risk mitigation against cybersecurity is most effective in its Dynamic Collaborative Form. Dynamic because it requires a shared Body of Knowledge that is consistently updated and available to all parties. Risk mitigation cannot be a competitive strategy for any organization; this notion could be quite illusory because the nature of cybercrime can be likened to an elephant. People at the side may think it is a wall, people at the trunk may think it is a snake. People at the tail may think in it is a monkey, and people at the leg may think it is a tree trunk.
As in the case of the elephant, it is only when you have curated the complete and accurate picture through which the breach can manifest that you can effectively deal with it or contain it. This is why there is a need for constant collaboration and open and transparent reporting, similar to the way that the COVID Pandemic is being collectively monitored and reported globally. This is what helped to curb the chain email fraud also known as “419” and many malicious computer viruses unleashed to take over users’ systems.
Governments and private establishments can improve the protection of critical infrastructure from cyber-attacks by following the following basic principles:
• First rule is not to assume anything is secure.
• Second is not to assume you will not be targeted.
• Third is to realize that modern systems have so many moving parts that you can’t really use a strategy of owning all of it, partnerships are essential.
• Nations have to build extreme levels of expertise across a wide threat surface. It’s no use protecting the databases while the CCTVs in the President’s office and residence have been compromised.
• Nations have to build cyber armies and cyber police to tackle external aggression, protect national assets and protect her citizens.
The most dangerous intruders are not the ones with guns but the ones with laptops. The terrorist killing people with bullets is “small fish” compared to the one that can make planes fall from sky or trains crash, or provoke a riot or influence an election without leaving any trace.
Cyber-attack is the new normal. Organizations and Technology Providers can mitigate these attacks by Perpetual state of vigilance. Every internet-connected or smart device is a potential back door. From the internet-connected TV to your webcam or printer. Even if nothing is stolen from you, your resources can be hijacked to attack others. Don’t assume you have enough expertise to be in a constant state of vigilance all by yourself. Cyber products and cyber companies are also at risk. If you are a transaction-oriented company then you have to be using Artificial Intelligence to watch out for fraudulent transactions. If you are a data company then you need to think of encrypting data at rest and in transit. Two-factor authentications are a must for all sensitive access. Walling off all critical systems from the net as a last means of firewall is simply not a practical solution.
Are organizations and private establishments in Nigeria doing enough to collaborate on threats? I believe that we could do more.
There should be a national Security Operations Center (SOC) and threat Database where all incidents are reported. This centre should also disseminate threats and analyze incidents to help others prevent similar infiltrations. Many firms, especially banks, think it will impact their brand if they disclose vulnerabilities and attacks. The under-reporting or cover-up of breaches portends a vicious cycle of repeated unanticipated hacks because you are inadvertently empowering the hackers to cause more damage to you by not reporting and exposing them and their future hacking plans.
Working in silos is not an option, because even when you believe you have secured your fortress; how do you guard against third parties connecting to your system through Application Programming Interfaces (APIs)? Take for instance the case of the N11b breach involving a major Nigerian Bank and a Fintech company, E-Transact. According to a report by TechNext.com, this came to light following a petition that the company developed a solution which helped Smart micro Systems to defraud the bank. Have we thoroughly investigated and comprehensively documented the nature of the beach and the vulnerabilities exploited? The demography and archetype of the perpetrators? Any possible internal collaboration or any systems bugs? Answers to these question to the right quarters are invaluable in foiling future attacks. While this may not be the only major successful breach, the system is so opaque that you will struggle to find a database of cases to learn from and anticipate future attacks.
The major reasons why organizations generally do not report breaches are fear of litigation or regulatory action and loss of reputation. In tackling cybercrime, we all have to be on the same team!
According to iafrican.com, Nigeria is set to establish a Cyber Security Research Centre (CSRC) to combat cybercrime. This is in a bid to build capacity and co-ordinate incident management and contribute to knowledge generation in cybersecurity. According to reports, Nigeria is already working with Cyber Security Malaysia and the Canadian Cyber Incident Response Centre (CCIRC) on establishing the CSRC.
While these are useful initiatives, there is a need for organizations to come together to collaborate on researching past breaches and documenting them and comprehensively reporting current breaches to learn from them in order to prevent future attacks. Private organizations such as the Risk Management Association of Nigeria (RIMAN) and the Bank Directors Association of Nigeria (BDAN) could be hardened and work closely with Government Agencies such as the National Information Technology Development Agency (NITDA) on existing and new initiatives towards combating Cybercrime.
Cybercrime and cybersecurity are real, but they are not rocket science and they are certainly no scarier than COVOD or EBOLA. If we could contain Ebola, Aids and 419 through collaboration, then surely, we can also contain cybercrime through Collaboration too; but we must be willing to take the painful steps that are necessary to safeguard ourselves and our organizations. Only then can we build the requisite trust in the system to continue to enjoy the fruits of digital transformation.
Austin Okere is the Founder of CWG Plc, the largest ICT Company on the Nigerian Stock Exchange & Entrepreneur in Residence at CBS, New York. Austin also serves on the Advisory Board of the Global Business School Network, and on the World Economic Forum Global Agenda Council on Innovation and Intrapreneurship. Austin now runs the Ausso Leadership Academy focused on Business and Entrepreneurial Mentorship.
284 thoughts on “CYBERSECURITY AND RISK MITIGATION”
Pretty! This was a really wonderful post. Thank you for providing this information.
Heya just wanted to give you a quick heads up and let you
know a few of the pictures aren’t loading properly. I’m not sure why but I think its a linking issue.
I’ve tried it in two different browsers and both show the same results.
What’s up to every one, it’s in fact a pleasant for me to go to see this
web page, it consists of valuable Information.
Hello mates, how is the whole thing, and what you desire to say on the topic of this article, in my
view its actually amazing in favor of me.
I used to be suggested this blog through my cousin. I
am not certain whether or not this post is written via him as no one else realize such detailed about my problem.
You’re amazing! Thanks!
I’m gone to inform my little brother, that he should also visit this webpage on regular
basis to take updated from most up-to-date reports.
you are in reality a excellent webmaster. The website loading speed is amazing.
It seems that you’re doing any unique trick. Also, The contents are
masterwork. you’ve done a great job on this subject!
You are so interesting! I don’t think I have read through a single thing like that
before. So wonderful to find another person with genuine thoughts on this issue.
Seriously.. many thanks for starting this up. This site is something that’s
needed on the web, someone with a bit of originality!
There’s certainly a great deal to learn about this issue.
I love all of the points you have made.
I enjoy reading through a post that will make men and women think.
Also, thank you for allowing me to comment!
@Hexa Trance Ya ok I’ll follow this….Tnk u
I really like what you guys are usually up too. This type of
clever work and reporting! Keep up the good works guys I’ve added you guys to my personal
Write more, thats all I have to say. Literally,
it seems as though you relied on the video to make
your point. You clearly know what youre talking about, why throw away your intelligence on just posting videos to your site when you could be giving us something informative to read?
Hello it’s me, I am also visiting this web page regularly, this website is actually fastidious and
the viewers are truly sharing good thoughts.
This site really has all the information I wanted concerning
this subject and didn’t know who to ask.
You’re so interesting! I do not suppose I have read a single thing like that before.
So great to find someone with unique thoughts on this topic.
Seriously.. many thanks for starting this up. This site is
one thing that is needed on the internet, someone
with a bit of originality!
Thanks for the marvelous posting! I definitely enjoyed reading it,
you could be a great author.I will ensure that I bookmark your blog and will often come back someday.
I want to encourage yourself to continue your great writing, have a nice morning!
It’s appropriate time to make some plans for the future and it’s time to be happy.
I have read this post and if I could I wish to counsel
you some interesting things or tips. Perhaps you could write subsequent articles regarding this article.
I want to learn even more things approximately it!
Appreciate the recommendation. Let me try it out.
As the admin of this website is working, no hesitation very
quickly it will be well-known, due to its quality
I pay a quick visit everyday a few websites and information sites to read content, however this weblog presents feature based articles.
you’re really a excellent webmaster. The website loading velocity is amazing.
It kind of feels that you’re doing any unique trick. Also,
The contents are masterpiece. you’ve performed a fantastic
job in this topic!
Amazing! Its really awesome article, I have got much clear idea about from this piece of writing.
Hello very nice site!! Guy .. Excellent .. Amazing .. I’ll bookmark your site
and take the feeds also? I am satisfied to search out numerous helpful info
here within the publish, we need work out extra techniques on this regard, thanks for sharing.
. . . . .
I’m really impressed along with your writing skills as neatly as with the structure for
your blog. Is this a paid topic or did you modify
it your self? Anyway keep up the excellent quality writing, it’s uncommon to look a nice
blog like this one nowadays..
Undeniably believe that which you stated. Your
favorite reason seemed to be on the web the simplest thing to be aware of.
I say to you, I definitely get irked while people think about worries that they plainly do not know
about. You managed to hit the nail upon the top
and also defined out the whole thing without having side effect
, people could take a signal. Will probably
be back to get more. Thanks
Loving the info on this web site, you have done outstanding job on the blog posts.
What’s up, I read your blog daily. Your humoristic style is
witty, keep doing what you’re doing!
whoah this blog is great i love studying your posts. Stay up the great work!
You know, a lot of people are hunting round for this information, you could aid them greatly.
I think the admin of this web site is really working hard in support of his site, for the reason that here
every data is quality based data.
What’s up to all, how is everything, I think every one is getting more from this website,
and your views are good in favor of new visitors.
Cùng HANOICOMPUTER tìm hiểu xem tiền điện tử là gì và Top 10 đồng tiền điện tử điện tử đang được các nhà đầu tư
chú ý nhất hiện nay nhé.
Howdy! Do you know if they make any plugins to help with SEO?
I’m trying to get my blog to rank for some targeted keywords
but I’m not seeing very good success. If you know of
any please share. Kudos!
This paragraph will help the internet visitors for setting up
new blog or even a weblog from start to end.