Businesses who have not yet fallen victim to a cyber attack need to accept that it's only a matter of time before they do. The big question is, how can businesses prevent, detect, respond and recover from attacks.
"What is key, is prevention, because as the old maxim goes, prevention is better than cure," says Yusuph Kileo, a cybersecurity and digital forensics expert from Tanzania, and MD and board member, Africa ICT Alliance (AfICTA), who will be presenting on 'Incident management, cyber forensics, and investigation' during the ITWeb Security Summit, to be held from 15 to 19 May, at Vodaworld in Midrand.
Sadly, he says many believe that the job of preventing cyber attacks falls to a certain group of individuals only. It doesn't. Everyone has a role to play when it comes to preventing cyber attacks, and successful prevention has to begin with the individual.
According to Kileo, a nation may have the best security strategy and tools in place, and an organisation may have firewalls, network monitoring software, authentication processes, policies and many other mechanism to prevent cyber attacks. However, a chain is only as strong as its weakest link, so if an individual is engaging in risky cyber behaviour, or not following security protocols, all the tools and measures in the world will be rendered ineffective.
He cites examples of issues that individuals need to be aware of. "Passwords, browsing the internet, connecting to free WiFi and social engineering, are some of the elements each user needs to pay attention to, and be vigilant of."
"Have you ever paused and asked yourself, how strong is your password? How often do you change it? Do you share it with others? Can it be accessed easily through phone calls or any other means? An organisation can try to ensure strong passwords are used and put measures in place to enforce the changing of passwords at a given time, but an individual can share password or allow it to be accessed easily, and doing so can lead to cyber attacks."
He says an individual can connect through free WiFi which is very vulnerable to man-in-the-middle attacks. "Sometimes an individual may browse through malicious sites (with malware hidden in them) or maybe find him or herself being manipulated by a cyber criminal into giving out information, or performing an action."
"We have seen many companies with great defence mechanisms in place fall victim to cyber attacks. Humans are the weakest link in any security chain, and many breaches are caused by the human element."
What should be done?
Kileo believes that an effective awareness programme is the key. "A successful defence depends on having good policies and educates users about them. We should constantly remind everyone about their role in preventing attacks. There is also training available, aimed at raising awareness around these issues."
He also suggests training users around phishing, click-jacking, passwords, mobile device security, insider threats and suchlike, as this may help users to better understand the role they play in an organisation's security posture.
All this awareness training needs to be done on a regular basis, because people forget too easily. "It is our duty to remind users through formal and informal awareness programmes that preventing cyber attack starts with them.
Share