The role of Kenyan Legal Professionals in Cybersecurity 0 459

  • Over 26.7 million Kenyans are currently online and engaging in digital transactions daily.
  • According to UN Research, at least one out of ten mobile money transactions in the World occur in Kenya.
  • These statistics make Kenya a prime target for cybercriminals who, according to the National Cybersecurity Strategy, published by the Ministry of ICT, have continued to evolve in terms of the complexity and severity of their attacks.
  • Unfortunately, Kenya shows a staggering lack of awareness and investment in cybersecurity solutions wit around 96% of all organisations investing less than $5000 in cybersecurity.
Kenya cybercriminal activity

According to the words of the Honorable Warren E. Burger, lawyers and judges remain necessary to society, so long as it is a place where men and women are gathered, as they must fulfil the noble role of healing conflict and providing reason as a lubricant to the rigours of the socio-economic engine which ought to drive the development of any civilisation.

Moreover, it is the role of the legal minds of society to act as sentinels, standing guard against man’s threat unto himself, his own inclination towards self-enrichment at the detriment of the common good in its entirety.

As such, society gives the highest of legal minds the power to influence, pass or ratify policies, to ensure their safety and continuity against the overwhelming urges of vices, human wickedness and in certain cases, natural catastrophes.

The legal minds of Kenya can thus be termed as, not only stewards of conflict resolution,but also as sentinels, who wield the power of policy-making to safeguard the development and evolution of the socio-economic organs of the nation-state whose well-being remains pivotal to Her survival.

Kenya is facing an exponential increase in cybercriminal activity

The digital wave has hit Kenya, and its effect upon our economy has been immensely positive. With the development of innovative products such as Safaricom’s M-Pesa money transfer service, as well as iCow, a farming digital product that has optimized dairy farmers’ productivity, the consumer market has developed an appetite for sound, data-centric solutions in order to enhance the various socio-economic activities present within Kenya.

The effect of digitisation in our economy has been significant. Since the advent of M-PESA, more than 73.1% of Kenyans are now formally banked.

In addition, according to the Quarterly Statistics Report for the Financial Year of 2016 (April-June 2016), mobile data/ internet subscriptions stood at 26.7 million during the quarter marking an increase of 8.3 per cent from 24.7 million subscriptions posted in the preceding quarter. The number has grown remarkably by 35.0 per cent from the same period of the previous year.

This essentially means that over 26.7 million Kenyans are currently online and engaging in digital transactions daily.

Kenya also boasts the largest mobile money transaction service in the World. According to UN Research, at least one out of ten mobile money transactions in the World occur in Kenya.

These statistics make Kenya a prime target for cybercriminals who, according to the National Cybersecurity Strategy, published by the Ministry of ICT, have continued to evolve in terms of the complexity and severity of their attacks.

The evolution of cyber threats between 2006 and 2012 are an iconic example. These threats include; Advanced Persistent Threats, Botnet Threats, Converged Threats, Cyberterrorism and Next Generation DoS (inclusive of DDoS).

The socio-economic impact of cybercrime in Kenya has been immense. According to a Serianu Cybersecurity Report, Kenya’s losses as at 2016, stood at a whopping $185m, a sharp increase from the estimated $100m lost in the previous year.

Notably, when cybercriminals face justice, only about 2% of prosecutions are successful. This can be attributed to the lack of proper regulation regarding data protection and cybersecurity, and the lack of appropriate measures to collect sufficient evidence to enable criminal prosecution.

The Legal Profession and the unique risks posed to them by cybercriminals

 

Kenya cybercriminal activity

Numerous professions in Kenya are facing digitisation as well. The legal industry has not been an exception. With the incorporation of modern filing systems, the use of e-mails and digital devices such as mobile handsets and laptops within law firms and legal offices, sensitive client data is being transacted and stored at a digital level across various platforms in various forms. Cybercriminals are aware of this and can exploit the gaps present in various ways.

A staggering lack of awareness and investment in cybersecurity solutions

Notably, around 96% of all organisations in Kenya invest less than $5000 in cybersecurity. A significant percentage of these sampled organisations consist of law firms, financial institutions, NGOs and governmental bodies where legal and compliance advisors safeguard the agenda of their respective institutions.

Around 96% of all organisations in Kenya invest less than $5000 in cybersecurity Click to Tweet

This highlights how low a priority cybersecurity is for institutions who are the custodians of sensitive data which can be compromised for profit by cybercriminals.

Man-in-the Middle Attacks

Legal practitioners often handle particularly sensitive internal or external, i.e. client information to carry out their mandate. An ideal example would be where numerous clients correspond with their hired advocates via e-mail, transacting confidential documents and data over the Internet with the faith that those communication channels are encrypted or secure. This makes law firms particularly prime for man-in-the-middle attacks.

A man-in-the-middle occurs where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other.

An example would be where files were intercepted over the network, and redirected to hostile parties, who then changed the details of those files and dropped them back into the firm’s filing system.

The entire scam could go on for months, until all the data is collected and collated by the criminals, and subsequently utilised in a terrible heist of client funds.

Various rights of the client had been substantially breached, such as their constitutional right to privacy and, if the law firm had no cybersecurity measures in place, a valid claim under the tort of negligence, as the advocate in question had failed to fulfil an essential duty of care in protecting the client’s information.

The loss of a client’s data integrity

The loss of a client’s data integrity remains one of the largest risks for any legal enterprise. This is due to its resultant effect which is a substantial erosion of trust and an adverse breach of the client confidentiality relationship which is part and parcel of the legal profession.

Data leaks can lead to truly disastrous results for any legal practice once their clients’ data is made public by hackers, regardless of their motivation. A prime example could be the occurrence of the Panama Papers leak in 2015.

The Panama Papers are 11.5 million leaked documents that detail financial and attorney–client information for more than 214,488 offshore entities. The documents, which belonged to the Panamanian law firm and corporate service provider Mossack Fonseca, were leaked in 2015 by an anonymous source, some dating back to the 1970s.

The leaked documents contain personal financial information about wealthy individuals and public officials that had previously been kept private.

While offshore business entities are legal, reporters found that some of the Mossack Fonseca shell corporations were used for illegal purposes, including fraud, tax evasion, and evading international sanctions.

The damage to the reputation of the legal enterprise was immeasurable and to date, their clients’ data remains available for scrutiny for members of the Press and the public.

Ransomware

Cybercriminals are also targeting legal enterprises because of the urgency of the data required. Law firms require constant updates of their: research material regarding continuing court cases, recordings of proceedings, updated legal documents and documentary evidence.

Moreover, legal enterprises must be able to quickly retrieve, edit, update and restore their work files within those particular systems. This makes them prime targets for malicious attacks which lock users out of their various digital filing and retrieval systems.

A prime example of this would be the deployment of ransomware within a law firm’s IT environment. Ransomware, as the name suggests, demands the payment of ransom in Bitcoin, upon encryption of computer files within a system.

Other variations of ransomware, known as lock-screen ransomware lock out users from accessing the computer system and demand payment in Bitcoin to unlock and gain access.

Conclusion

A joint awareness campaign

In collaboration with numerous law firms in Kenya, ESET East Africa is engaging with certain legal practitioners based in Kenya’s digital market to raise awareness regarding the numerous risks present for their enterprises as well as the nation with the advent and growth of cybercrime within Kenya.

This will be done through joint events, programs and training sessions to sensitize legal enterprises about their issues.

Policy recommendations

As a driver of thought leadership across the globe, the ESET brand is honoured to collaborate with the lawyers and cybersecurity specialists in suggesting cybersecurity policies designed to safeguard the Kenyan populace from the evolved threat of cybercrime within Kenya.

Previous ArticleNext Article

Coming to terms with cyber security nightmare 0 196

Teddy Njoroge

Last year internet security companies made forecasts about possible cyber-threats to really worry about this year. This we followed with measures that companies and individuals needed to take to ensure a cyber-safe 2018. Paramount among these was the need for proactive use of protective software tools as well as sensitisation and training of users about these threats.

True to predictions, 2018 started with a scenario hardly anyone could have foreseen. Two serious design vulnerabilities in Computer Central Processing Units (CPUs) were exposed that could enable cyber-criminals to steal sensitive or private information such as passwords, documents and photos among other data from unsecured devices.

The “Meltdown and Spectre” CPU vulnerabilities point to a much larger underlying issue. Software bugs and hardware bugs are more common than not, but these once identified can be fixed fairly easily with either a software patch or firmware update for hardware issues.

However, as it turns out this is not possible with these two vulnerabilities as they are caused by a design flaw in the hardware architecture, only fixable by replacing the actual hardware. And that is where the problems begin.

CPUs of affected manufacturers such as AMD, ARM, Intel, among others appear in a lot of Internet of Things (IoT) devices and which are scattered all over the globe.

According to ARM, they are already “securing” a trillion (1,000,000,000,000) devices. Granted, not all ARM CPUs are affected, but if even 0.1 per cent of them are, it still means a billion (1,000,000,000) affected devices.

Due to the huge costs involved, it is not feasible to replace all these faulty CPUs. In reality people will keep their existing devices until end of their life cycles, for years even.

Deployed for countless and diverse applications in the households or offices, once operational many owners have most likely forgotten that they have them and which inherently leaves a giant gap for cybercriminals to exploit.

Any Wi-Fi-controlled device such as refrigerator, digital picture frames, Smart TVs, DVRs and PVRs etc., potentially provides opportunity for sensitive data to be lost. For example, a compromised Wi-Fi password for any of these can make it possible for anyone to hack your home or office network thus giving automatic access to any other connected platform such as emails, social media pages and even shared cloud or archive platforms.

Even though to get access to your IoT device, a would be attacker needs to have compromised the internet network already, or even the applications running on the device, we know that cyber-criminals just like a pack of wolves will not relent after smelling blood.

As a warning, when you are buying a new IoT device, ensure to check which CPU it is running on, and if that CPU is affected by these vulnerabilities.

 

Meltdown and Spectre 0 300

 Microsoft released Security Advisory 18002 on Wednesday, January 3, 2018 to mitigate a major vulnerability to Windows in modern CPU architectures. ESET released Antivirus and Antispyware module 1533.3 the same day to all customers to ensure that use of our products would not affect compatibility with Microsoft’s patch.

The first few days of 2018 have been filled with anxious discussions concerning a widespread and wide-ranging vulnerability in the architecture of processors based on Intel’s Core architecture used in PCs for many years, as well as processors from AMD, and even affecting ARM processors commonly used in tablets and smartphones.

The good news is that ESET can help protect against the types of malware that could take advantage of these vulnerabilities.

And, ESET was one of the very first security vendors to allow the Microsoft patch against the flaw to be enabled.

While ESET protects against potential malware infection, you should also take these steps to secure your computers and data:

  • Make sure your browser is up to date. For Chrome or Firefox users:
    • Mozilla has released information describing their response, including how Firefox 57 will address these security flaws.
    • Google has stated, “Chrome 64, due to be released January 23, will contain mitigations to protect against exploitation.” In the meantime, you can enable “Site Isolation” found in current stable versions of Chrome to provide better protection.
  • Make sure you update your ESET software, then update your Windows OS to protect against this exploit. To update ESET:
  • Customers should review ESET’s Knowledgebase article for important updates.
  • See this great collection of tips, articles and recommendations from the Google Project Zero team.
  • If you have a cloud-based server or have a website hosted by hosting provider, check to see what mitigations they have implemented already to prevent Meltdown.