The use of spyware and key-logging devices to steal more than R30 million within three weeks recently, shows the need for increased awareness in this area, says the Security Group of Africa.
The topic was under discussion at the monthly Information Security Group of Africa meeting in Midrand.
Craig Rosewarne, chairman of the group, presented information relating to the theft. More than 300 key-loggers were found installed at Internet caf'es. Often, he explained, the Internet caf'e staff are bribed to install the devices.
Ian Melamed, principal consultant at Shaya Infosec, an IT compliance and security company, explained key-logger hardware is easy to find, as it is physical, but many people don`t know what they are looking for.
These are small devices that are fitted between the PS/2 port and the keyboard plug, he explained.
"According to Section 14 of the constitution, key-loggers are illegal on the corporate level, but many people disregard this," he said. According to law, a R2 million fine is applicable if the use of a key-logger can be proven.
Melamed said it was important to have firewalls and up-to-date anti-virus protection in order to defend against software key-loggers. It was also important to do registry checks and vulnerability scans. Hardware key-loggers could be identified through voltage measurements, or combated through the use of dual-factor authentication and other physical security means.
"We need to communicate and create awareness surrounding this form of data theft. If you suspect you may have a key-logger on your machine, you need to contact support immediately," he concluded.
"In the UK, hardware key-loggers are not such a huge probability," noted a visitor from the UK who attended the meeting. "It`s the software key-loggers that present 95% of the problem."
Share
