by Lufuno Khorommbi

Understanding cybersecurity

Cybersecurity is the practice of protecting systems, networks, and data from cyber-attacks. It is important to note that the word practice means that cybersecurity should be embedded in the organisational day to day functions. Thus, it is not an event.

Having being compelled to remote working, I believe we can all agree that cybersecurity is at the centre of effective functioning of every organisation. However, both practice and research have proven time and again that cybersecurity is still an afterthought for many organisations.

Why is cybersecurity awareness important?

Research estimates that about 90% of successful cyber-attacks are enabled by human error or behaviour. Why, because cybercriminals have found a weakness within the cybersecurity governance space: human beings. Cybercriminals are exploiting this vulnerability through different means. I will start with the most common one:

Spamming. Most of us experience this on a daily basis; unwanted emails and or messages sent over the internet to multiple users for “noble” purposes like advertising, or malicious purposes like spreading malware, phishing etc.

Malware is any software intentionally designed to cause damage to hardware, and or user network.

Phishing - defined as a method of stealing personal data whereby an authentic-looking e-mail is made to appear as if it is coming from a real company or institution. The idea is to trick the recipient into sending secret information such as account information or login data to the scammer.

Most of us have received emails from the tax authorities, Banks, Lottery authorities, and big retailers for gifting us something because it is supposedly their birthday. We must be weary of such emails and never click on any link unless the origin can be confirmed.

Impersonation attack uses social engineering and personalisation to trick an employee into unwittingly transferring money into a fraudulent account or sharing sensitive information with cyber criminals.

Ransomware – is a malware that encrypts (locks) the victim’s files and then demands ransom to decrypt (unlock) the files. It is commonly orchestrated through spam and phishing emails. City of Johannesburg was ransomed attacked late October 2019 (and it took them days to get back on track).

Social engineering also known as human hacking, is the art of tricking employees and consumers into disclosing their credentials and then using them to gain access to networks or accounts. From a personal level, this is the reason why we must mind who we connect with on social media, and why we should share less of personal information in the social media space.

On a business front, we would all remember the story of Experian, the credit bureau. Millions of personal records of South Africans that was lawfully in Experian’s custody was handed over because a cybercriminals incorporated themselves within Experian environment and no one noticed!

Password attack – one should create a password that would make it difficult for a third party to guess. Amongst the methods that cyber criminals use to have access to your password are phishing attack and social engineering.

One should remember to logout of systems whenever the system is not in use, and never allow a system to offer to remember login credentials for any reason; both at work and for personal online activities.

It is important for systems users not to store your password on your phone or other online systems and do not allow. More importantly, users should not stick the password on their desks and or give it to a colleague. There are two dangers with sharing your password with anyone including your colleagues, no matter how much you trust them.

insider attack – your colleague can use your credentials to access and attack systems and or commit fraud and or theft. It would be difficult for you to prove yourself innocent. it was discovered early this year that an employee from Department of Labour.
if your colleague is social engineered and or fell into the phishing trap, your information is likely to be shared with cybercriminals.

In essence, sharing of passwords compromises the system and weakens cybersecurity efforts within an organisation and increase vulnerabilities.

Insider attack is an attack that is perpetrated on a network or computer system by a person with authorised systems access. This attack can be malicious or out of ignorance of the user or human error. Department of Labour was maliciously attacked by one of its employees last year, 2019; and Experian suffered the attack because of human error by their staff.

Denial of service – where cyber criminals attack or hack the core system or network not to work.

Contributing factors to cybersecurity vectors / channels includes:

non-existent of security policies and or cybersecurity governance.
outdated and or ignored policies.
poor awareness of security practices like password policy, filing policy, authentication controls etc.
lack of cyber aware workforce and cybersecurity culture – sharing of passwords; and personal information of what we post on social media are examples.
lack of compliance to internal governance and or existing legal prescripts like the ECT Act, PoPI Act, and the GDPR.
poor access control practices; which may include lack of vetting, accreditation and authentication of systems users.
lack of security compliance audits and vulnerability assessments.

It is important to note that cybersecurity is everybody’s problem, from the top to the bottom of an organization. It is not an IT issue; it is a business issue.

Conclusion

Having the best technology without appropriate cybersecurity in place, might not yield intended results. Effective cybersecurity governance requires cybersecurity framework and policies that are supported by relevant structured and education programme to promote a cybersecurity culture and a cyber aware workforce.

Similarly, “Knowing is not understanding. There is a great difference between knowing and understanding: you can know a lot about something and not really understand it.” Charles Kettering

Adv. Lufuno T Khorommbi (Ms) is a specialist Cyber Law Consultant and the Managing Director of Orizur Consulting Enterprise. Her expertise lies in cyber law, cyber security, IT Procurement, Contract Management, Research and Policy Management. She is a Mentee of the Cherie Blair Foundation Global Women’s Mentoring Programme; a Member of South Africa Institute of Intellectual Property Law; a MICT SETA 4IR Advisory Committee Member; LLM specialization in IT Law; Certified in CIO Practice; she holds a Certificate in Cyber Security and a Certificate in Legislative Drafting.
www.orizur.co.za