Cyber Security

The role of Kenyan Legal Professionals in Cybersecurity 0 2746

Avatar
  • Over 26.7 million Kenyans are currently online and engaging in digital transactions daily.
  • According to UN Research, at least one out of ten mobile money transactions in the World occur in Kenya.
  • These statistics make Kenya a prime target for cybercriminals who, according to the National Cybersecurity Strategy, published by the Ministry of ICT, have continued to evolve in terms of the complexity and severity of their attacks.
  • Unfortunately, Kenya shows a staggering lack of awareness and investment in cybersecurity solutions wit around 96% of all organisations investing less than $5000 in cybersecurity.
Kenya cybercriminal activity

According to the words of the Honorable Warren E. Burger, lawyers and judges remain necessary to society, so long as it is a place where men and women are gathered, as they must fulfil the noble role of healing conflict and providing reason as a lubricant to the rigours of the socio-economic engine which ought to drive the development of any civilisation.

Moreover, it is the role of the legal minds of society to act as sentinels, standing guard against man’s threat unto himself, his own inclination towards self-enrichment at the detriment of the common good in its entirety.

As such, society gives the highest of legal minds the power to influence, pass or ratify policies, to ensure their safety and continuity against the overwhelming urges of vices, human wickedness and in certain cases, natural catastrophes.

The legal minds of Kenya can thus be termed as, not only stewards of conflict resolution,but also as sentinels, who wield the power of policy-making to safeguard the development and evolution of the socio-economic organs of the nation-state whose well-being remains pivotal to Her survival.

Kenya is facing an exponential increase in cybercriminal activity

The digital wave has hit Kenya, and its effect upon our economy has been immensely positive. With the development of innovative products such as Safaricom’s M-Pesa money transfer service, as well as iCow, a farming digital product that has optimized dairy farmers’ productivity, the consumer market has developed an appetite for sound, data-centric solutions in order to enhance the various socio-economic activities present within Kenya.

The effect of digitisation in our economy has been significant. Since the advent of M-PESA, more than 73.1% of Kenyans are now formally banked.

In addition, according to the Quarterly Statistics Report for the Financial Year of 2016 (April-June 2016), mobile data/ internet subscriptions stood at 26.7 million during the quarter marking an increase of 8.3 per cent from 24.7 million subscriptions posted in the preceding quarter. The number has grown remarkably by 35.0 per cent from the same period of the previous year.

This essentially means that over 26.7 million Kenyans are currently online and engaging in digital transactions daily.

Kenya also boasts the largest mobile money transaction service in the World. According to UN Research, at least one out of ten mobile money transactions in the World occur in Kenya.

These statistics make Kenya a prime target for cybercriminals who, according to the National Cybersecurity Strategy, published by the Ministry of ICT, have continued to evolve in terms of the complexity and severity of their attacks.

The evolution of cyber threats between 2006 and 2012 are an iconic example. These threats include; Advanced Persistent Threats, Botnet Threats, Converged Threats, Cyberterrorism and Next Generation DoS (inclusive of DDoS).

The socio-economic impact of cybercrime in Kenya has been immense. According to a Serianu Cybersecurity Report, Kenya’s losses as at 2016, stood at a whopping $185m, a sharp increase from the estimated $100m lost in the previous year.

Notably, when cybercriminals face justice, only about 2% of prosecutions are successful. This can be attributed to the lack of proper regulation regarding data protection and cybersecurity, and the lack of appropriate measures to collect sufficient evidence to enable criminal prosecution.

The Legal Profession and the unique risks posed to them by cybercriminals

 

Kenya cybercriminal activity

Numerous professions in Kenya are facing digitisation as well. The legal industry has not been an exception. With the incorporation of modern filing systems, the use of e-mails and digital devices such as mobile handsets and laptops within law firms and legal offices, sensitive client data is being transacted and stored at a digital level across various platforms in various forms. Cybercriminals are aware of this and can exploit the gaps present in various ways.

A staggering lack of awareness and investment in cybersecurity solutions

Notably, around 96% of all organisations in Kenya invest less than $5000 in cybersecurity. A significant percentage of these sampled organisations consist of law firms, financial institutions, NGOs and governmental bodies where legal and compliance advisors safeguard the agenda of their respective institutions.

Around 96% of all organisations in Kenya invest less than $5000 in cybersecurity Click to Tweet

This highlights how low a priority cybersecurity is for institutions who are the custodians of sensitive data which can be compromised for profit by cybercriminals.

Man-in-the Middle Attacks

Legal practitioners often handle particularly sensitive internal or external, i.e. client information to carry out their mandate. An ideal example would be where numerous clients correspond with their hired advocates via e-mail, transacting confidential documents and data over the Internet with the faith that those communication channels are encrypted or secure. This makes law firms particularly prime for man-in-the-middle attacks.

A man-in-the-middle occurs where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other.

An example would be where files were intercepted over the network, and redirected to hostile parties, who then changed the details of those files and dropped them back into the firm’s filing system.

The entire scam could go on for months, until all the data is collected and collated by the criminals, and subsequently utilised in a terrible heist of client funds.

Various rights of the client had been substantially breached, such as their constitutional right to privacy and, if the law firm had no cybersecurity measures in place, a valid claim under the tort of negligence, as the advocate in question had failed to fulfil an essential duty of care in protecting the client’s information.

The loss of a client’s data integrity

The loss of a client’s data integrity remains one of the largest risks for any legal enterprise. This is due to its resultant effect which is a substantial erosion of trust and an adverse breach of the client confidentiality relationship which is part and parcel of the legal profession.

Data leaks can lead to truly disastrous results for any legal practice once their clients’ data is made public by hackers, regardless of their motivation. A prime example could be the occurrence of the Panama Papers leak in 2015.

The Panama Papers are 11.5 million leaked documents that detail financial and attorney–client information for more than 214,488 offshore entities. The documents, which belonged to the Panamanian law firm and corporate service provider Mossack Fonseca, were leaked in 2015 by an anonymous source, some dating back to the 1970s.

The leaked documents contain personal financial information about wealthy individuals and public officials that had previously been kept private.

While offshore business entities are legal, reporters found that some of the Mossack Fonseca shell corporations were used for illegal purposes, including fraud, tax evasion, and evading international sanctions.

The damage to the reputation of the legal enterprise was immeasurable and to date, their clients’ data remains available for scrutiny for members of the Press and the public.

Ransomware

Cybercriminals are also targeting legal enterprises because of the urgency of the data required. Law firms require constant updates of their: research material regarding continuing court cases, recordings of proceedings, updated legal documents and documentary evidence.

Moreover, legal enterprises must be able to quickly retrieve, edit, update and restore their work files within those particular systems. This makes them prime targets for malicious attacks which lock users out of their various digital filing and retrieval systems.

A prime example of this would be the deployment of ransomware within a law firm’s IT environment. Ransomware, as the name suggests, demands the payment of ransom in Bitcoin, upon encryption of computer files within a system.

Other variations of ransomware, known as lock-screen ransomware lock out users from accessing the computer system and demand payment in Bitcoin to unlock and gain access.

Conclusion

A joint awareness campaign

In collaboration with numerous law firms in Kenya, ESET East Africa is engaging with certain legal practitioners based in Kenya’s digital market to raise awareness regarding the numerous risks present for their enterprises as well as the nation with the advent and growth of cybercrime within Kenya.

This will be done through joint events, programs and training sessions to sensitize legal enterprises about their issues.

Policy recommendations

As a driver of thought leadership across the globe, the ESET brand is honoured to collaborate with the lawyers and cybersecurity specialists in suggesting cybersecurity policies designed to safeguard the Kenyan populace from the evolved threat of cybercrime within Kenya.

Previous ArticleNext Article

Secure Videoconferencing: The Basics 0 1028

Avatar
Woman working at home on laptop

With COVID-19 concerns canceling face-to-face meetings, be aware of the security risks of videoconferencing and how to easily overcome them

As a way of controlling the spread of the COVID-19 pandemic, several countries have been forced to impose a lockdown on its citizens bringing normal operations to a near stand-still. Consequently, a considerable percentage of the working population has turned to remote working, a chunk of it for the first time.

This has spiked up the demand for video conferencing services, chat systems, and online collaboration tools to serve the increasing number of students, employees, and teachers, among other experts working from home.

By 11th March 2020, Kentik―a San Francisco network operator— had achieved a 200% increase in video traffic within the provided working hours in Asia and North America. Even before the start of the official lockdown in California.

In the same vein, the UK Prime Minister chaired a cabinet meeting via zoom, which communicated the government’s appeal for social distancing through the use of video conferencing. His actions, however, brought about several questions regarding the security of the communication.

But with a quick rejoinder, the UK’s National Cyber Security Centre pointed out that such communications shouldn’t cause any worries if they are below particular classifications. Accordingly, companies have developed confidence in the technology; therefore, are utilizing it to communicate with their remote workers.

Nevertheless, as an employee (or typical user), you need to understand the technology’s built-in security options, as well as control features before using it. Here we provide you with some primary considerations. Let’s dig in!

Your immediate surroundings

For you to realize a smooth and quality video conferencing experience, it is essential to cordon off your working space to prevent in kind of interruptions that might occur while in session; for instance, from your kids, better half, or even pets.

Besides, ensure that your working area is devoid of any sensitive or confidential information/material that can be captured by the camera.

Limit access

As you may be aware, a lot of video conferencing platforms allow the creation of multiple user groups to enable the providence of internet domain according to specific criteria; for instance, the use of company email address to join a video call.

Or offer access to a limited number of people whose email addresses have been invited or scheduled for a call.

As such, when creating a meeting, you can enable the set a meeting password option that creates a randomly generated code for your invitees to input before joining a conversation. Similarly, you can authenticate those using phones by the use of a numerical password. However, avoid embedding the password in the meeting link.

As an organizer, you can hold your participants in a “waiting room,” as you approve them one by one, which gives you full control over whom to allow or deny access. In case you have a large conference, you can delegate such duties to your trusted attendees.

File transfers and communication over the net

As a rule of thumb, always ensure that your end-to-end communication is encrypted. Do not assume that this option is the default for video calls since a few services may require you to request encryption.

If the third-party endpoint client software is permitted, ensure it abides by the requirements of the end-to-end encryption.

What’s more, consider limiting the types of documents you can send across the net; for instance, avoid transferring executable files.

Manage the attendees, as well as the engagement process

Often, your attendees will be distracted by notifications, pop-ups, and emails, among other things, when attending your conference calls. Therefore, as a host, you can request notification from your service provider if your conferencing client isn’t the primary or active window (depending on your platform). For instance, if you are a tutor, you can use this feature to get the attention of all your students.

You can also monitor those who joined the call by downloading the attendee list at the end of the call. Or request attendees to register before being connected.

Limit screen sharing capabilities

As the host, the sole responsibility of controlling screen sharing remains only yours, unless you delegate it to someone else that you trust. This eliminates any chances of an individual sharing content by mistake.

Importantly, only share the required application rather than the whole desktop when screen sharing. This is informed by the fact; even the name of a file or Icon can divulge sensitive company information.

Final thoughts

To ensure the security of your company communications, take time to consider all the available options security settings on your video conferencing system (or one you intend to use) settings. Importantly, take a look at the privacy policy of the service you intend to use to prevent the selling, sharing, collection, or re-use of your data.

In case you require more advice and endpoint client software for your video conferencing needs, then ESET has been here for you for over 30 years. We want to assure you that we will be here to protect your online activities during these uncertain times, too.

Protect yourself from threats to your security online with an extended trial of our award-winning software.

Try our extended 90-day trial for free.

Coronavirus con artists continue to thrive 0 967

Avatar
Man working on laptop

The scam machine shows no signs of slowing down, as fraudsters continue to dispense bogus health advice, peddle fake testing kits and issue malware-laced purchase orders

As the Coronavirus pandemic continues to escalate, more companies are now shifting to remote work as a way of containing the spread of the disease. Similarly, lockdowns and travel bans, among other stringent measures, have become the order of the day across several nations. And to worsen the situation, there is a massive shortage of the required medical kits.

Such a crisis provides fraudsters undue advantage over a vulnerable lot that is financially destabilized, as well as emotionally drained as a result of the pandemic. 

In this case, you would likely receive fake updates regarding the pandemic, as well as non-existent offers for personal protective equipment, among others. Likewise, if you’re a business, you would certainly receive faux purchase orders and payment information.

Fortunately, as a follow up to our previous article about the ways scammers are exploiting coronavirus fears, we provide you with a few examples of the new campaigns aimed at stealing your money or personal information. To enable you to keep your guard up. Shall we?

Fake news/information

As the virus continues to escalate, more people are currently searching for practical information on how they can protect themselves. As a result, scammers have conveniently positioned themselves as the true COVID-19 information “crusaders” by impersonating well-known health organizations, such as the World health organization.

Don’t act surprised if you receive an email (containing an attachment) supposedly coming from a reputable health organization offering you “vital information” on how you can protect yourself from the disease.

For instance, our research team identified one such file containing a Trojan designed to steal personal credentials.

Apart from the WHO, fraudsters are also impersonating the US Centers for Disease Control and Prevention (CDC). Accordingly, the FBI has given a warning about scummy emails mainly riddled with malware-infested attachments and links purporting to originate from the CDC.

 To reduce the number of people falling for such schemes, the WHO shares examples of its official email addresses and methods of communication on its website.

Urgent purchase orders and late payments

Owing to the increased pressure from governments to reduce the spread of the virus, Companies, as well as factories, have been forced to streamline their operations according to the current situation. As an example, companies to integrate work from home modules, while factories to either increase or reduce their production capacities depending on their products.

Such erratic changes have brought about a climate of uncertainty that offers fraudsters a thriving environment.

In this case, as a factory owner or executive, be on the lookout for “urgent purchase orders” from “company representatives.” Since this fake orders come from scammers who want to make a kill out of your desperation of making some revenue before things go south.

Sadly, if you download such “urgent orders” (usually in attachments), your PC will be installed with malicious code designed to steal your details.

Below is an excellent example of such an “urgent order”:

Similarly, you would receive a “proof of payment” for you to take care of the order. However, like the last example above, instead of receiving a bank statement, the attached document contains a Trojan injector.

High demand products

A massive increase in demand compounded with an inadequate supply for essential protective items, such face masks has created another avenue for scams.

A typical example of such a scam involves a fraudulent site that is offering “OxyBreath Pro” face masks at a reduced price. These can lure you since there is a shortage of masks, and what is available is highly-priced.

However, if you click on the provided links, you’ll be at risk of exposing your sensitive personal information to the scammers.

Bogus testing gear

The unavailability or short supply of medical kits for testing folks for the virus has also attracted fraudsters in droves.

For instance, the existent low supply of masks, respirators, and hand sanitizers, among other necessities, has prompted scammers to impersonate medical officials.  So that, they can provide non-existent or fake COVID-19 test kits, as well as illegitimate “corona cures.”

As an illustration, more than 2000, links associated with fake coronavirus products have already been identified. Similarly, law enforcement bureaus alongside other relevant bodies have been able to seize US$ 13 million worth of potentially hazardous pharmaceuticals.

To contain these despicable actions, the U.S. Food and Drug Administration (FDA) has issued warnings that it hasn’t allowed the sale or purchase of coronavirus self-testing kits; therefore, it is currently bursting such sellers.

Final thoughts

In a wrap, what we have shared is a representative of the many current fraudulent campaigns doing rounds in our media spaces due to the prevailing situation.

Thus, it is critical to maintaining high alertness to avoid falling victim to both the COVID-19 pandemic, as well as the ensuing scam epidemic escalating through the internet. To keep yourself safe from the scams, you can practice the following basics:

  1. Avoid downloading files or clicking on links from unknown sources
  2. Never fall for unrealistic offers or order goods from unverified suppliers. You may also make a point of checking out the purported vendor’s reviews
  3. Invest in an excellent endpoint solution which can shield you from phishing attacks, as well as other forms of scams
  4. If an email suggests coming from a reputable organization, double-check with the firm’s website to confirm its authenticity

If you require consultation, as well as endpoint solutions for your cybersecurity needs, then ESET has been here for you for over 30 years. We want to assure you that we will be here to protect your online activities during these uncertain times, too.

Protect yourself from threats to your security online with an extended trial of our award-winning software.

Try our extended 90-day trial for free.