Why Kenyans should take cyber security seriously 0 1117

  • Cybersecurity can contribute immensely to the creation of quality employment opportunities for Kenyan citizens.
  • Kenya is yet to embrace any effective data protection regulations and the consequences are pretty evident in the Kenyan digital economy.
  • With the increased terrorist activities within Kenya, the Internet presents national enemies such as the Al-Shabaab and other extremist groups with a unique and ubiquitous opportunities.
Kenyan cyber security

There is no simple way to say this. Cybercriminals are pilfering Kenyans blind. The latter statement has been evidenced by the statistics present in the recent Cybersecurity Report published by Serianu, which asserts that Kenya lost about $175million last year. Moreover, the Report managed to establish that cybercrime perpetrators are deliberately targeting the Kenyan digital economy with the intention of wreaking havoc and making away with millions.

In terms of cyber resilience, the Kenyan digital economy can be likened to a slow, plump gazelle stumbling through the “cyber-savannah” in the full view of agile, informed and hungry cyber-predators who have begun to sink their teeth into their sumptuous prize.

Another daunting revelation is that organisations which have suffered substantial data breaches (which include reputable banks, insurance companies and SMEs) have decided to remain mum, much to the detriment of their clientele whose actual data is exploited for monetary gain by cybercriminals.

Regardless of the increased cybercrime incidents within the region, the state of Kenya’s digital economy is indeed on the rise.

Thanks to the concerted efforts of the private and public sector in creating an enabling environment, statistics published by the Communication Authority of Kenya in the first quarter of the 2016-2017 financial year highlight that the internet penetration rate in Kenya is at a robust 85%, with over 37 million internet subscribers who exchange data over various internet-based platforms.

These glowing statistics indicate the notable confidence in the quality of service provided by various digital companies. The latter can be attributed to the numerous marketing campaigns designed to reinforce consumer trust in digital services, but can Kenyans really trust good PR routines when it comes to the safety of their data?

The internet penetration rate in Kenya is at a robust 85%, with over 37 million internet subscribers Click to Tweet

What is in it for Kenyans if they begin to take their cyber security more seriously?

1. Jobs, Jobs and more Jobs:

Unemployment is a major challenge that affects youth across Kenya. Approximately 800,000 young Kenyans enter the labour market every year and youth unemployment is estimated to be as high as 35%, compared to the overall national unemployment rate of 10%.

Furthermore, 80% of unemployed Kenyans are below 35 years old. Notably, However, 70 per cent of the employed lot are under paid hence unable to take care of day-to-day needs. Thus, it can be demonstrated that unemployment will remain a thorn in the flesh until quality jobs can be created to further the development of the Kenyan populace.

Cybersecurity can contribute immensely to the creation of quality employment opportunities for Kenyan citizens.

Per the Kenya Cybersecurity Report, published by Serianu in 2016, the current number of internet subscribers stands at 37,716,579 users who are in turn served by only about 1400 certified cybersecurity professionals (these professionals are categorised as individuals who have attained CISA, CISM, GIAC, SANS, CISSP, CEH, ISO 27001 and PCI DSS QA certification).

Teddy Kungu, Country Manager of ESET East Africa has been famously quoted for stating that each cyber security professional in Kenya serves a population of at least 280000 citizens.

Per a 2003 study carried out by Deloitte Touche Tohmatsu (DTT), it was recommended that ideally one information security professional should serve every 1000 general users.

Not only does it makes sense to fill the demand for cybersecurity specialists, it also makes a lot of cents.

Jobs in the field of cyber security are outpacing job creation in the IT industry and can pay up to $6,500 USD more annually, or almost 10% more, than the average salary of average IT workers.

While many job positions in cybersecurity will require additional certifications, such as the CISSP, it’s far from impossible to migrate into a security position from other IT focuses. For newcomers to the IT field, there is also room to start out on a cyber security career path beginning with an entry level role as a security analyst.

2. Tougher Protection Regulations will Protect Citizens

Kenya is yet to embrace any effective data protection regulations and the consequences are pretty evident in the Kenyan digital economy.

Institutions handling sensitive data, such as banks, insurance firms and hospitals have no legislative obligation to disclose any data breach incidents to their unsuspecting clients.

The latter has contributed significantly to the web of secrecy spun around the value and occurrence of cyber crime incidents within Kenya. Kenya needs to note that clandestine behaviour only favours cyber criminals who thrive in markets that suffer silently.

Notably, most cyber crime occurrences chiefly affect the constitutional rights of consumer protection and privacy, significantly injuring the citizens.

With the enforcement of the General Data Protection Regulations in Europe, which compel institutions to disclose data breaches which affect EU citizens and non-EU citizens alike within European data centres, cyber criminals may be forced to seek greener pastures to ply their trade.

Kenya is a prime target, with immense income potential but not much regulatory and technical might. Cyber crime will continue to escalate in our region if citizens remain indifferent and the Government continues to rest on its laurels when it comes to updating their policies regarding cyber security in Kenya.

3. Cyber-bulling among the Youth needs better safeguards

The dark nexus between education, young minds and inadequate safeguards against cyber aggression has led to truly tragic cases of cyber-bulling within the developed and developing world.

An apt definition of cyber-bulling was coined by the Centre for Justice and Crime Prevention in South Africa which stated that cyber bullying, cyber violence, cyber aggression, internet bullying, electronic bullying, internet harassment or online harassment are terms used to refer to violence and aggression perpetrated through ICTs.

These cruel acts may include the sending of harassing emails or instant messages, posting obscene, insulting and slanderous messages on online bulletin boards or social networking sites, or developing web pages to promote and disseminate defamatory content.

The impact of cyber-bulling is particularly significant among girls.

Per a Report regarding cyber-violence against women and girls, published by The United Nations Broadband Commission for Digital Development Working Group on Broadband and Gender, about 73% of women and girls are abused online.

Kenyans need to act against these occurrences as it is in their best interest to protect the dignity of their women and children whilst enjoying digital services.

4. Children Need to be protected from Radicalisation and the Internet

With the increased terrorist activities within Kenya, the Internet presents national enemies such as the Al-Shabaab and other extremist groups with a unique and ubiquitous opportunity to access the susceptible young minds of our children to plant their vindictive perceptions of society.

Dr. Quintan Wiktorowicz, an internationally acclaimed expert on national security engagement and counter-terrorism produced a radicalization process model which highlights the initial need for a cognitive opening.

For the process of radicalization to achieve success, there must be an avenue to connect with a person who is receptive to the possibility of new ideas and world views. He highlights that insofar as the nexus between digital connectivity and radicalism is concerned, impressionability is vulnerability.

Impressionability is vulnerability. Dr. Quintan Wiktorowicz Click to Tweet

It is thus vital that whenever digital devices are availed to children safeguards should effectively be put in place. This should be widely adopted by Kenyan families through parents and legal guardians whose societal duty is to preserve the morality of their children.

Ignorance Injures Kenya’s socio-economic development

In one of Mzee Jomo Kenyatta’s landmark speeches, he famously stated that there existed three enemies to the Statehood of Kenya; the first was poverty, the second : disease and lastly: the plight of ignorance.

The ignorance of the impact of cybercrime within Kenya has already cost the nation millions of dollars and it threatens to exploit the data footprint of past, present and future generations. Kenyans must recognize the incentives of standing up for their data security and accept their role as guardians of their own information.

In order to enjoy safer technology, we must understand that security begins with you and me.

Previous ArticleNext Article

Safer Internet Day 2019 0 205

Working together with your children for a better online experience

Beginning in 2004, Safer Internet Day has grown to become one of the landmark events in the online safety calendar. And this year’s theme, ‘Together for a better internet’, encapsulates a lot of the discussion we are seeing around online safety and cybersecurity. The topic is too complex a minefield for any of us to bear sole responsibility and, like all good things in life, we need to work together to bring about the best possible future.

What does it mean to work together where online safety is concerned? It could be an IT security company working closely with a consultation of parents to develop products, or parents and teachers working to ensure the online education of our young people. But what about children themselves? We put a lot of onus on finding the right solutions and products to protect our kids online, but one day those kids will grow up and live without online parental control. We should think about the best way to prepare them; ‘together for a better internet’ should mean working with our children to educate, inform and protect them, so they can stand the best possible change of making the right decisions for themselves.

That’s not to say that software doesn’t play a crucial role, and ESET would encourage all parents to take care over choosing the right parental control software on the family computer. When you are doing this though, we advise you do it together with your kids. Talk them through the programmes you’re installing and select your privacy settings together, discussing why you are doing it and the kinds of threats you’re protecting the family against. As part of this conversation you can talk to your children about what they’re doing online, who they’re talking to and what kinds of things they need to be careful about in day to day online. Many kids see control settings on the internet as a block to them having fun; what they need is someone to explain their function and reasoning. By having this discussion, you’re giving your kids an element of control and responsibility over their online activities which, when paired alongside the rules and software we all need to protect ourselves, should produce better results when it comes to their internet education.

The internet is such an integral part of our lives that the earlier you start talking to kids, involving them and teaching them about their online worlds, the better the results. Creating an open dialogue will always be more effective than just putting your foot down.

Set an example; whatever you expect your kids to do, make sure you are also doing. The online world represents dangers for all of us and we can all benefit from a few more precautions. If you’re asking your kids to cover their webcam when they’re not using it, then make sure you also do it. If you’re restricting their screen time, then think about setting yourself some boundaries as well. With the damaging effects of too many screens on our health and wellbeing, it’s unlikely to have any negative repercussions.

ESET’s software, such as its ESET Parental Control, places a large emphasis on parents and children working together. It helps them to navigate online, manage what apps and websites they use, and decide – together – what’s good for them. One of the key features is age-based filters which helps to manage which apps children can and cannot access, allowing parents to consider the right restrictions for their children and to not just impose a blanket ban. Other features include setting time limits on when children can play on their devices and creating exceptions that kids can request. Parents can even send their children messages which they must acknowledge before they can continue to use their devices.

It’s elements such as these that allow children to be involved in the monitoring of their safety, and truly help parents to work together with their kids for a better internet and the best possible online world.

 

Play it safe during FIFA 2018 0 891

We do realize that you’ve been caught up in the hurly-burly of the FIFA World Cup, but surely you have a few minutes to spare and peruse our roster of tips to stay safe online not only during the soccer spectacle. While you’re at it, recognize that no single player, no matter how stellar, is enough to put you on a path to success. In fact, being even one player short can be enough to trip you up. What should the pillars of your cybersecurity game plan be, then?

#1 A stitch in time saves nine

Last year went down in history for two serious cyber-incidents – the WannaCryptoroutbreak and the Equifax hack – that served up powerful reminders of the merits of swiftly squashing security bugs. 2017 also saw the highest number of  vulnerabilities reported.

So the number one player in you security team is updates. In your home settings, making sure that automatic updates are enabled for your operating system and software is an easy step to take to keep attackers away.

 

#2 Prune your team

Get rid of that disgruntled bench-warmer who ends up sapping your team’s morale. Software that you hardly ever use can become a liability simply by increasing your attack surface. To further reduce the possible entry points for cybercriminals, you may also want to disable unused services and ports, and ditch programs that have a track record of vulnerabilities.

For your browser, consider blocking ads and removing all but the most necessary of browser add-ons and plugins. While you’re at it, shut down the accounts that you no longer need and use your high-privilege, or admin, account only for administrative tasks.

#3 Practice strong password hygiene

One of the easiest ways to protect your online identities consists in using a long, strong and unique password or better still, passphrase, for each of your online accounts. It may well come in handy if your login credentials leak, for example due to a breach at your service provider – which, in fact, is far too common a scenario. Further, just as you’d never share your teams tactics with your opponents, you should never share your password with anybody.

If you’re like most people and find the need to remember many username/password combinations overwhelming, consider using a password manager, which is intended to store your passwords in a “vault”.

#4 Look before you leap

Even if you have the most complex of passwords or passphrases, be aware of where you input them.

Online, everything is just a click away, and scammers are keenly aware of that. In their pursuit of your personal information, they use social engineering methods to sucker you into clicking a link or opening a malware-laden attachment.

5 questions to ask yourself before clicking on a link are:

  1. Do you trust the sender of the link?
  2. Do you trust the platform?
  3. Do you trust the destination?
  4. Does the link coincide with a major world event like the FIFA worldcup? (Cyber criminals tend to be opportunistic this way)
  5. Is it a shortened link?

#5 Add a factor

When aiming for secure accounts, you need to up your ante by using two-factor authentication, particularly for accounts that contain Personally Identifiable Information (PII) or other important data. The extra factor will require you to take an extra step to prove your identity when you attempt to log in or conduct a transaction. That way, even if your credentials leak or your password proves inadequate, there is another barrier between your account and the attacker.

#6 Use secure connections

When you connect to the internet, an attacker can sometimes place himself between your device and the connection point. To reduce the risk that such a man-in-the-middle attack will intercept your sensitive data while they are in motion, use only web connections secured by HTTPS (particularly for your most valued accounts) and use trusted networks such as your home connection or mobile data when performing the most sensitive of online operations, such as mobile banking. Needless to say, secure Wi-Fi connections should be underpinned by at least WPA2 encryption (or, ideally, WPA3as soon as it becomes available) – even at home – together with a strong and non-default administrator password and up-to-date firmware on your router.

Be very wary of public Wi-Fi hotspots. If you need to use such a connection, avoid sending personal data or use a reputable virtual private network (VPN) service, which keeps your data private via the use of an encrypted “tunnel”. Once you’re done, log out of your account and turn off Wi-Fi.

#7 Hide behind a firewall

A firewall is one of your key defensive players. Indeed, it is often thought of as the very first line of defense. It can typically be a piece of software in your computer, perhaps as part of anti-malware software, or it can be built into your router – or you can actually use both a network- and a host-based firewall. Regardless of its implementation, a firewall acts as a brawny bouncer that, based on predetermined rules, allows or denies traffic from the internet into an internal network or computer system.

#8 Back up

A backup is the kind of player who doesn’t get much time on the pitch, but when he does get the nod, he can “steal the show”. True, we might have spoken ill of bench warmers earlier, but a reliable backup is definitely not the kind of player to spoil your team’s chemistry.

Your system cannot usually be too – or completely – safe from harm. Beyond a cyber-incident, your data could be compromised by something as unpredictable as a storage medium failure. A backup is an example of a measure that is corrective in nature, but that is fully dependent on how hard you “practiced”. Or, as Benjamin Franklin put it, “by failing to prepare, you are preparing to fail”. It will cost you some time and possibly money to create (time and time again) your backups, but when it comes to averting (data) loss, this player may very well save the day for you.

#9 Select security software

Even if you use your common sense and take all kinds of “behavior-centered” precautions, you need another essential addition to your roster. At a time when you’re pitted against attackers who are ever more skilled, organized and persistent, dedicated security software is one of the easiest and most effective ways to protect your digital assets.

A reliable anti-malware solution uses many and various detection techniques and deploys multiple layers of defense that kick in at different stages of the attack process. That way, you’re provided with multiple opportunities to stymie a threat, including the latest threats, as attackers constantly come up with new malicious tools. This underscores the importance of always downloading the latest updates to your anti-malware software, which ideally are released several times a day. Top-quality security software automates this process, so you needn’t worry about installing the updates.

#10 Mobiles are computers, too!

Much of this article’s guidance also applies to smartphones and tablets. Due to their mobility, however, these devices are more prone to being misplaced or stolen. It is also of little help that users tend to view security software as belonging in the realm of laptops and desktops. But mobile devices have evolved to become powerful handheld computers and attackers have been shifting their focus to them.

There’s a number of measures you can take to reduce risks associated with mobile devices. They include relying on a secure authentication method to unlock your device’s screen, backing up the device, downloading system and app updates as soon as they’re available (preferably automatically, if possible), installing only reputable apps and only from legitimate stores, and making sure to use device encryption if it’s not turned on by default.

A dedicated mobile security solution will also go a long way towards enhancing your protection from mobile threats. This includes a scenario whereby your device goes missing, so you are then able to use the suite’s anti-theft and remote-wipe functionalities.

#11 Be aware

The final team member is, in fact, you – the keeper. Stay vigilant and cyber-aware and educate yourself on safe online habits. Don’t ever say, “it won’t/can’t happen to me”, because everyone is a potential target and victim. Recognize that one click is enough to inflict major damage on yourself and others, and that breaking good security practices for the sake of convenience may come back to bite you worse than Luis Suárez did in 2014. After all, how secure we are is largely dependent on how we use the technology.

So there you have it. You may want to enjoy the soccer now.