Its About Training, Stupid.

In South Africa, the private and public sectors need to move with the times and start training employees, the new weak point in an organisation’s information technology (IT) defences, in how to deal with cyber threats, experts say.

There has been "a seismic shift in how we work", with mobile devices allowing remote work to increasingly become the norm, says David Emm, a UK-based principal security researcher at cyber security firm Kaspersky Lab. That means the old model of building security "moats" around company networks no longer works, and many businesses have not moved on from that strategy.

Emm says the shift to working on mobile devices, phones, tablets and laptops, means hackers have more entry points into a company’s network.

Riaan Graham, Ruckus Networks sales director for sub-Saharan Africa, agrees. "With mobile devices becoming effectively a computer in your pocket and where a lot of your communication happens on a daily basis, I think the one thing all corporates are guilty of at some level is the lack of training given to employees regarding cyber security," says Graham.
Since all employees have access to a company’s network, if a cyber-criminal hacks into a staff member’s device, "their work’s already half done".

"So I think the first thing that’s needed is continued training with regard to security risks for employees, from the base all the way up to C-level employees. All of them need to understand the threats out there today," Graham tells the Financial Mail.
Employees should be trained in how to deal with possible malware, spyware or "rogue security software", for instance.

"The software might tell you to update or remove certain functions, and if the employee is not aware of the company’s policies regarding change control, they might click and say ‘yes let’s update’, and then open up the whole network to a virus or a Trojan horse," Graham says.

Some hackers are even penetrating networks by leaving corrupted memory sticks in a company’s parking lot in the hope someone will pick them up and insert them into their computers, according to Paul Williams, Fortinet’s manager for Southern Africa.

Perhaps unsurprisingly, considering the hype around bitcoin and other digital currencies, Williams says hackers are also hijacking companies’ computers to mine crypto-currencies. He says "crypto-jacking", or the unauthorised use of someone else’s computing resources to mine crypto-currencies, has become a major threat to both consumers and enterprises.
It is an attractive ploy for cyber criminals as it does not require strong technical skills and, unlike ransomware, offers a potential 100% payout ratio, Williams says.

Meanwhile, besides their employees, companies’ supply chains are also being identified as a weak link by cyber criminals, according to a recent Dimension Data report. Mark Thomas, Dimension Data’s group cybersecurity strategist, says there are many moving parts to supply chains and outsourcing companies, and these often run on disparate and outdated networks, "making them easy prey" for the cyber-criminals.

"Service providers and outsourcers are also a prime target due to their trade secrets and intellectual property," Thomas says, adding that businesses "need to wise up".

New data protection rules in SA and Europe could prompt businesses to do just that, according to Roy Wright, head of risk solutions at financial advisory group GTC.

Wright believes companies should be taking out insurance against cyber-attacks because they need to safeguard themselves against lost income from systems outages, costs associated with identifying and rectifying a breach, litigation costs, and possible extortion from ransomware attacks.

He says cyber-insurance will probably be taken more seriously following the introduction of laws to ensure the protection of personal data including the General Data Protection Regulation (GDPR) in Europe and the Protection of Personal Information (PoPI) Act in South Africa.

The PoPI act will oblige companies to report and publish any data breaches as and when they occur. Organisations will also have to publish their strategies to rectify a breach and their plans to mitigate against such risks in the future.

"Companies that fail to comply with these requirements will be issued with fines, which will significantly impact small to medium businesses," says the risk expert.

Meanwhile, as organisations move their workloads into public cloud infrastructure, they will gain the added benefit of having better security.

This is because cloud vendors have to spend substantially more money on their security than most companies would ever choose to, says Richard Levine, co-founder and MD of Executive Solutions. Cloud computing providers such as Microsoft and Amazon also fork out a lot more than most companies can for the skills to manage and support these security technologies, Levine says.

"Companies moving to the cloud therefore benefit from economies of scale via their cloud vendor on all fronts, including IT security."

BusinesLive:        Image: Nick Youngson

You Might Also Read:

In S.Africa The Cybersecurity Skills Gap Is A Chasm:

Employees Are Key To Cybersecurity:

 


 

« The Pentagon's AI Program To Find Hidden Nuclear Missiles
AI Is Re-Inventing IT »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Lumeta

Lumeta

Lumeta’s cyber situational awareness platform is the unmatched source for enterprise network infrastructure analytics and security monitoring for breach detection.

ForgeRock

ForgeRock

ForgeRock, the leader in digital identity, delivers comprehensive Identity and Access Management solutions for consumers, employees and things to simply and safely access the connected world.

Rockwell Automation

Rockwell Automation

Rockwell Automation offer industrial security solutions to protect the integrity and availability of your complex automation solutions.

ZM CIRT

ZM CIRT

ZM CIRT is the national Computer Incident Response Team for Zambia.

Ovarro

Ovarro

Ovarro is the new name for Servelec Technologies and Primayer. Ovarro's technology is used throughout the world to monitor, control and manage critical and national infrastructure.

Netteam

Netteam

Netteam designs, implements and services networking solutions for companies of all sizes.

Black Kite

Black Kite

Black Kite (formerly NormShield) provides comprehensive Security-as-a-Service solutions focused on cyber threat intelligence, vulnerability management and continuous perimeter monitoring.

Smokescreen

Smokescreen

Smokescreen's IllusionBLACK employs deception technology to detect, deflect and defeat advanced hacker attacks.

Comarch

Comarch

Comarch is a provider of IT business solutions to optimize operational and business processes. Cyber security solutions are focused on Identity Management and Security Assessment services.

OGiTiX

OGiTiX

OGiTiX Software AG is a German software manufacturer specializing in Identity and Access Management.

CloudAlly

CloudAlly

CloudAlly provides online cloud to cloud backup and recovery solutions, which backs up daily changes in your SaaS to unlimited Amazon S3 storage and makes it available for restore or export.

Wayra

Wayra

Wayra connects Telefónica and technological disruptors around the world. As their preferred strategic partner, we scale them up to accelerate their business and ours.

Digital Beachhead

Digital Beachhead

Digital Beachhead has the expertise to provide a range of Cyber Risk Management and other Professional Services with specifically tailored solutions at competitive prices.

Ekco

Ekco

Ekco is one of Europe’s leading managed cloud providers. With a network of infrastructure and security specialists across Europe, we’ve perfected our approach to supporting digital transformation.

Torch.AI

Torch.AI

Torch.AI’s Nexus™ platform changes the paradigm of data and digital workflows, forever solving core impediments caused by the ever-increasing volume and complexity of information.

Vanta

Vanta

Vanta helps companies scale security practices and automate compliance for the industry’s most sought after standards - SOC 2, ISO 27001, HIPAA, GDPR, and other security and privacy frameworks.