E-Business
Gartner Reveals Five Styles of Advanced Threat Defense

The threat of advanced targeted attacks, also known as advanced persistent threats, or APTs, has spawned a wave of innovation in the security market.
According to a document share by Lawrence Orans, Jeremy D’Hoinne, analysts at Gartner, a company that provides security managers with a framework to select and deploy the most-effective threat defense technologies, part of the key findings show that traditional defense-in-depth components are still necessary, but are no longer sufficient in protecting against advanced targeted attacks and advanced malware.
According to Lawrence Orans, Jeremy D’Hoinne, “Today’s threats require an updated layered defense model that utilizes “lean forward” technologies at three levels: network, payload (executables, files and Web objects) and endpoint; combining two or all three layers offers highly effective protection against today’s threat environment and many vendors fit squarely in one style, but also have some characteristics of adjacent styles. The trend will be for vendors to “bleed through” multiple styles as solutions mature”.
Analysis of the Key Findings
Traditional defense tools are failing to protect enterprises from advanced targeted attacks and the broader problem of advanced malware.
In 2013, enterprises will spend more than $13 billion on firewalls, intrusion prevention systems (IPSs), endpoint protection platforms and secure Web gateways (see Note 1).
Yet, advanced targeted attacks (ATAs) and advanced malware continue to plague enterprises. ATAs are considered advanced because of their ability to bypass traditional security mechanisms.
Five Styles of Advanced Threat Defense: Strengths & Weaknesses
Style 1 — Network Traffic Analysis
This style includes a broad range of techniques for Network Traffic Analysis. For example, anomalous DNS traffic patterns are a strong indication of botnet activity.
NetFlow records (and other flow record types) provide the ability to establish baselines of normal traffic patterns and to highlight anomalous patterns that represent a compromised environment.
Some tools combine protocol analysis and content analysis. The sample vendors we list all use internally developed signatureless techniques that have been effective in detecting advanced threats.
The strengths include, real-time detection; includes signatureless and signature-based techniques and endpoint agents are not required.
But the challenges include, it requires careful tuning and knowledgeable staff to avoid false positives; limited ability to block attacks (applies to out-of-band tools) and does not monitor traffic from off-network mobile endpoints.
Style 2 — Network Forensics
Network Forensics tools provide full-packet capture and storage of network traffic, and provide analytics and reporting tools for supporting incident response, investigative and advanced threat analysis need
The ability of these tools to extract and retain metadata differentiates these security-focused solutions from the packet capture tools aimed at the network operations buyer.
The strengths: Can deliver a high ROI (due to reducing incident response time and personnel); can reconstruct and replay flows and events over days or weeks, due to high-capacity storage options (for example, 200TB) and detailed reports can be used to help meet regulatory requirements, such as e-discovery or Payment Card Industry, for in-depth analysis and continuous monitoring of network traffic.
However, the challenges are the tools are complex, and skilled personnel are required to operate them; costs rise with the amount of data and the retention time; reports that analyze large amounts of data are time-intensive and may need to be run off-hours and does not capture traffic from off-network mobile endpoints.
Style 3 — Payload Analysis
Using a sandbox environment, the Payload Analysis technique is used to detect malware and targeted attacks on a near-real-time basis.
Payload Analysis solutions provide detailed reports about malware behavior, but they do not enable a postcompromise ability to track endpoint behavior over a period of days, weeks or months. Enterprises that seek that capability will need to use the incident response features of the solutions in Style 5 (Endpoint Forensics). The sandbox environment can reside on-premises or in the cloud.
Cloud-based Payload Analysis is a valid approach, but it is also a low barrier to entry for vendors.
Off-the-shelf hypervisors and virtualization technology, vendors can easily create sandbox environments and label them as Payload Analysis solutions.
Feedback from Gartner clients indicates that there is a wide range in the ability of these cloud-based Payload Analysis solutions to accurately detect malware.
As per the strengths, it is very effective in detecting malware that successfully bypasses signature-based solution; detailed reports highlight registry changes, API calls, process behavior and other information about the behavior of the malware (these reports are helpful for postcompromise analysis, but are not a substitute for the in-depth tools outlined in Style 2 and Style 5).
Also, there is an optional blocking capability for outbound callback to command and control centers for those on-premises-based (noncloud) solutions that can be placed in the line of traffic.
The challenges abound because behavioral analysis can take several seconds or minutes to complete, previously undetected malware is allowed to pass through, potentially compromising one or more endpoints; some evasion techniques can defeat the behavioral analysis technique.
For example, sleep timers, in which the malware code executes on a delayed basis (hours or days), may result in the malware going undetected during the time it is resident in the sandbox. Some vendors have techniques for detecting and thwarting sleep timer evasions.
It does not provide validation that the malware executed on endpoints. Just because the malware behaved a certain way in a simulated environment does not guarantee that it will behave that way on real endpoints.
Some malware does not install and execute as expected on every endpoint.
Many solutions only support a limited range of payloads. Some support executables (.exe files) only.
Most solutions only support Microsoft Windows, although some cloud-based approaches support Android. At the time of this writing, none support Apple Mac OS X.
Privacy and data protection concerns may prevent some enterprises from implementing cloud-based sandboxes.
Style 4 — Endpoint Behavior Analysis
There is more than one approach to Endpoint Behavior Analysis to defend against targeted attacks.
Several vendors focus on the concept of application containment to protect endpoints by isolating applications and files in virtual containers.
Other innovations in this style include system configuration, memory and process monitoring to block attacks, and techniques to assist with real-time incident response.
An entirely different strategy for ATA defense is to restrict application execution to only known good applications, also known as “whitelisting” (see “How to Successfully Deploy Application Control”).
The application containment approach allows malware to execute, but it does so in a contained environment where it cannot access content and information outside of its container. For example, the containers intercept kernel system calls and block malicious activity such as thread injection attacks.
By isolating Web browsing sessions, this approach protects users from malicious websites, including drive-by download sites and “watering holes.”
These solutions require an agent on every endpoint. (For more information, see “Technology Overview for Virtualization and Containment Solutions for Advanced Targeted Attacks.”).
The strengths are: blocks zero-day attacks and previously unseen malware (applies to application containment solutions); protects systems whether they are on or off the corporate network; provides basic forensic capabilities through analysis of blocked malware.
While the challenges are: deploying and managing endpoint agents can be operationally intensive and creates challenges in bring your own device (BYOD) environments; endpoint agents have varying restrictions for supporting operating systems, file types, applications and browsers and containment solutions utilize additional CPU and memory resources.
The more containers in use, the greater the impact, according to Gartner.
Style 5 — Endpoint Forensics
Endpoint Forensics serves as a tool for incident response teams. Endpoint agents collect data from the hosts they monitor.
These solutions are helpful for pinpointing which computers have been compromised by malware, and highlighting specific behavior of the malware.
Some solutions use various indicators of compromise (IOCs) to detect malicious behavior on the endpoint.
Examples of IOCs include suspicious Microsoft Windows registry key creation, DNS requests or installed binaries.
The strengths are, it helps automate the time-consuming task of incident response; monitors activity on hosts when they are on or off corporate networks; some agents provide limited containment features (for example, preventing previously detected malware from running again or on other endpoints in the company) and limited remediation capabilities.
The challenges include, a lack of ability to block zero-day attacks in real time; deploying and managing endpoint agents can be operationally intensive; at the time of this writing, support for non-Windows endpoints is limited and events are not always prioritized and typically require knowledgeable staff to investigate.
E-Business
NITDA Okays NiRA’s Annual, Business Report

National Information Technology Development Agency (NITDA) has said it has granted approval to the 2025 Annual Report and 2026 Business Plan of the Nigeria Internet Registration Association (NiRA).

The Agency, through an official statement it released on Sunday, also revealed that the “nation’s active .ng domains have hit a total of 241,000.”
Hajiya Hadiza Umar, director of Corporate Communications, NITDA, who signed the statement disclosed that the approval came during a strategic meeting at NITDA headquarters, Abuja, where Adesola Akinsanya, president, NiRA led members of the association’s board to present its 2026 vision to NITDA.
According to NITDA, the endorsement will ensure the acceleration of the adoption of Nigeria’s country code top-level domain, .ng.
It was also disclosed that through the endorsement, both organisations have pledged to strengthen collaboration towards increasing the adoption of .ng domains across Nigeria and supporting the Federal Government’s digital economy agenda.
The statement also noted that Kashifu Inuwa Abdullahi, director general, NITDA has directed NiRA to work closely with NITDA’s e-Governance and Digital Economy Department to ensure effective implementation, project monitoring and regular progress reporting.
You have my full approval for these initiatives. Let us change our strategy, sync up more closely, and ensure everything we have agreed upon during this presentation is fully implemented by next year,” Inuwa stated.
Speaking on the association’s achievements in 2025, Akinsanya disclosed that NiRA recorded 98,285 new domain registrations, 71,470 renewals and 1,970 restorations, bringing the total number of active .ng domains to 241,000.
He said that beyond the growth in registrations, NiRA strengthened the security of Nigeria’s internet ecosystem through the implementation of Domain Name System Security Extensions (DNSSEC), while also improving registrar support and stakeholder engagement.
According to him, the association’s 2026 strategy is focused on positioning .ng and .gov.ng domains as the preferred digital identity platforms for government institutions, businesses and citizens.
Akinsanya praised NITDA for its continued support and called for joint awareness campaigns and digital capacity-building initiatives to encourage wider adoption among state governments, local councils and public institutions.
He further revealed that NiRA is upgrading its internal systems through increased automation and constitutional reforms aligned with global best practices to ensure long-term sustainability.
NiRA is looking into deeper stakeholder engagement and moving into areas where we see massive possibilities. We are specifically targeting startups and aligning with tech events across the country. With stronger collaboration, we can drive widespread adoption across every tier of government,” he said.
E-Business
FG Seeks Inclusive, Human-centred Artificial Intelligence Policies

The Federal Government has called for the development of inclusive and human-centred artificial intelligence policies that protect workers’ rights and prevent job losses while harnessing the technology’s potential to drive economic growth and productivity.

The Minister of Labour and Employment, Dr. Muhammad Dingyadi, made the call during the 114th Session of the International Labour Conference in Geneva, Switzerland, while responding to the report of the Chairperson of the Governing Body and the Director-General of the International Labour Organisation, titled “A Moment of Choice: Harnessing Artificial Intelligence for Decent Work,” on Thursday.
Dingyadi said the rapid advancement of AI is transforming labour markets, workplace practices and employment relationships globally, creating both opportunities and challenges for governments, employers and workers.
He noted that while AI can stimulate innovation, improve productivity and expand economic opportunities, it also poses significant risks, including job displacement, widening inequalities and the erosion of the human role in some sectors of the economy.
“The world is moving forward at a rapid pace, underpinned by advances in AI, and we as an organisation must match that pace. While welcoming the positive transformations AI offers, we are also pondering the uncertainties it connotes.
“These shifts, despite their benefits, also cast a dark cloud of uncertainty. Where AI creates new jobs, there may be job losses. Where digital and AI infrastructures are created, there may be a loss of the traditional role and value of the human factor in the work process. We therefore need a balanced approach that ensures that, while harnessing the benefits of AI, the attendant risks do not rob our societies of the gains of decent work,” he said.
The minister commended the ILO leadership for its commitment to advancing the organisation’s mandate despite mounting global economic and social challenges.
Highlighting Nigeria’s efforts to position itself within the rapidly evolving digital economy, Dingyadi said the Federal Government had established the Ministry of Communications, Innovation and Digital Economy to spearhead policies aimed at accelerating technological development and strengthening the country’s competitiveness.
According to him, Nigeria has already begun integrating digital technologies and AI into governance systems through the automation of civil service processes and public service delivery.
“I’m also pleased to inform you that Nigeria is steadily harnessing the gains of this initiative in our Public Service. There is the service-wide automation of civil service processes and communication with AI playing a significant role. Additionally, platform work is gaining ground,” he said.
The minister also welcomed ongoing discussions within the ILO on regulating work in the platform economy, stressing the need for labour standards that protect workers engaged in emerging forms of employment created by digital technologies.
Beyond AI, Dingyadi reiterated Nigeria’s longstanding call for reforms within the ILO, urging member states to accelerate the ratification of the 1986 Amendment to the organisation’s Constitution and review the criteria used to determine countries of Chief Industrial Importance.
He argued that such reforms would promote greater inclusivity, fairness and regional representation within the ILO’s governance structures.
The minister further urged countries to align the ILO Centenary Declaration and the Global Coalition for Social Justice with national development priorities to ensure that technological innovation contributes to social progress and decent work.
Nigeria’s intervention comes amid growing global debate over the impact of artificial intelligence on jobs and the future of work.
According to international labour and development agencies, AI is expected to automate some routine tasks while simultaneously creating new employment opportunities in technology, data science, digital services and other emerging sectors.
However, concerns persist that workers in administrative, clerical and repetitive occupations could face significant disruptions if governments fail to implement policies that support skills development, social protection and workforce transition.
The issue has become a central focus of discussions at the ongoing International Labour Conference, where governments, employers and workers’ representatives are examining how AI can be deployed in ways that promote productivity and economic growth without undermining labour rights, job security and social justice.
For Nigeria, the conversation is particularly significant as the country pursues an ambitious digital transformation agenda aimed at expanding broadband access, growing the digital economy and creating millions of technology-driven jobs for its youthful population.
Experts have repeatedly stressed that achieving these goals will require investments in digital skills, education and worker protections to ensure that the benefits of AI are broadly shared across society.
E-Business
Kaspersky Reveals Credential Abuse Techniques Rank as Attackers’ Most Effective Tactic

According to a recent global report by Kaspersky Security Services, password guessing and valid account misuse rank among the most effective tactics used by cyber criminals in 2025.

This trend reflects a strategic shift, as attackers move away from triggering endpoint protection with noisy malware, in preference of leveraging legitimate access to evade detection.
The ‘Anatomy of a Cyber World’ is an in-depth global report based on data gathered from Kaspersky Managed Detection and Response (MDR), Incident Response (IR), Compromise Assessment and SOC Consulting in 2025. It covers the most common adversary techniques, tools and detection scenarios and highlights the peculiarities of detected incidents.
According to the report, a significant portion of the most frequently monitored attack techniques revolves around credentials and identity management. This analysis, which examines the conversion rates* of various Indicators of Attack (IoA), highlights the following prevalent malicious tactics:
Password guessing – 34.8%. This technique entails attackers systematically trying different passwords until successfully gaining access to an account. It tops the conversion list due to its occurrence in both actual attacks and authorised security assessments, making it a persistent threat in today’s cybersecurity landscape. Organisations who rely on weak or reused passwords continues to enable this age-old strategy.
Local account creation – 34.7%. Once inside a system, attackers frequently create new local accounts to maintain access even if their original foothold is discovered and removed. This technique is frequently observed during security exercises and can be detected — but only with the right telemetry in place, which is often lacking.
Valid account abuse – 34.5%. Instead of deploying malware, attackers log in using stolen or compromised credentials and simply blend in with normal user activity. This makes detection significantly harder, as the access itself appears legitimate. The high conversion rate underscores why compromised credentials remain one of the most dangerous attack vectors.
Account manipulation – 32%. Attackers modify existing accounts to consolidate access such as by activating disabled accounts, altering group memberships, or escalating privileges. This reinforces the broader pattern — rather than introducing new tools, adversaries deepen their control using what is already there.
Network service discovery – 31.2%. Before moving deeper into a network, attackers typically scan for open services and systems they can reach. This reconnaissance step is a strong predictor of what follows: lateral movement and further exploitation. Detecting it early provides security teams a critical window to intervene.
The report ranks attacker techniques by how frequently observed activity ultimately resulted in confirmed malicious incidents. According to Kaspersky experts, while MITRE ATT&CK® catalogs a vast number of adversary techniques, effective detection requires prioritising behaviours with the highest probability of malicious intent while avoiding excessive false positives.
“Threat actors do not always need sophisticated malware to achieve their objectives. In many cases, legitimate administrative tools and compromised accounts remain the fastest and most effective way to move inside an organisation while avoiding detection.
The continued popularity of these techniques shows that organisations need deep visibility into attacker behaviour and the ability to correlate suspicious activity across different stages of an attack.
To address these challenges, companies can enhance their security with our solutions: Kaspersky Managed Detection and Response and Incident Response which cover the entire incident management cycle – from threat detection to continuous protection and remediation,” comments Sergey Soldatov, Head of Security Operations Center at Kaspersky.
Telecom2 days agoTikTok Tax Scam Exposed: Two Arrested Over Alleged £153 Million Fraud Scheme
E-Financial2 days agoIFC, NGX Group Unveil Nigeria Gender Programme
Telecom2 days agoNITDA Backs NiRA’s Ambitious 2026 Plan to Drive Massive .ng Domain Adoption
General News2 days agoNITDA, Benin’s Digital Agency Strengthen Ties on Digital Transformation
Telecom2 days agoFG Targets Alleged N3tn Capital Flight, Opens Airtime Credit Market to Nigerian Fintechs
Telecom2 days agoMTN Dismisses Data Theft Claims, Blames Network Challenges on Fibre Cuts, Vandalism
Telecom10 hours agoPrice of Data in Nigerian Mobile among Top Four Cheapest Globally – MTN CEO
E-Financial10 hours agoBOI Wins Dual Honours @ EMEA Finance Awards for Sustainability and Social Impact Leadership












