Rommy Okonkwo is the country manager of Check Point Software Technologies, the largest network cyber security vendor globally, providing industry-leading solutions and protecting customers from cyberattacks with an unmatched catch rate of malware and other types of threats. He spoke to chike onwuegbuchi on issues around cybersecurity in Nigeria.

Nigeria’s Cyber Space and Digitization Drives

I want to believe that the government of today and previous governments have made a lot of efforts to put some level of protections in place as a country, because this is what the West has done and will keep advancing.

Obviously, the ‘war’ has gone beyond the physical- it is now cyber war. And I really don’t know any government that is not aware of this, today and does not have plan in place as to how to protect its key infrastructure. When you talk of Nigerian Government, you refer to our defence- areas like the Nigerian Ports Authority (NPA); that is the key revenue streams for the country including the PHCN and a lot of other key government revenue generators.

I am not sure we are where we ought to be as a people or a country, but I know there are plans in place, because the awareness for security keeps growing. I have read an article in the dailies quoting the Vice President, stressing on the need for government institutions and agencies to brace up for cyber security challenges and make sure their environment is protected.

This is the only way that Ministries, Departments and Agencies (MDAs) can function effectively and efficiently. You would agree with me, when downtime occurs, the cost of bringing back the service is usually huge which impacts the revenue (bottom-line). This is where no body wants to be today.

For security, first, you need to have security policies in place for individuals, organisations, agencies, or the government. From the government angle, they need to decide what the security policies should be across board- institutions and parastatals which will be the posture for the whole country. These should be readily available before you start thinking of how to implement them.

Inability of Government to Digitise Critical Infrastructure

Today, the world is a global village, that is basically why you can sit in Nigeria and place an order in the United States and in a couple of days you receive the parcel. This is unlike before. Same concept applies to why you can sit here today and require approaching a telephone service to place a call to your relation abroad. If you ask yourself couple of years back when the world was itching towards ‘connected world’, we thought it was a joke. That has actually come to be today.

Everybody talks about Internet of Things (IoT); this is where everybody is going today- everything is virtually going to be done over the internet. When you talk about the online ‘craze’ is the internet.

Again, we should know that what the government is doing to itself by not getting the key infrastructure connected, are they doing the right/wrong thing. One answer to that is focus. If it is the focus of the government to be focused in her decision-making; to be efficient and productive in her dealings across everything, the government should make sure that her infrastructure are connected, real-time.

First, we are referring to productivity and efficiency. For you to achieve these you have to be proactive. So, I don’t think credence should be given to the government for her inability to bring the critical infrastructure online, real-time. This is what the West has done many years ago and then; if we are still at that point, it means something is wrong somewhere. It implies the technology advisers to the government are not doing what they should do/ or that the government is not passionate about it.

The only thing is that we shall be affected in everything we do. International trade, you cannot do that efficiently, if you are not connected. Therefore, productivity and efficiency are been affected.

Check Point efforts in cybersecurity

What we have done over the years is to create awareness in different industries. Some of the things we are talking about today with regards to the West, have been in existence for years. You will also realise that some others like Nigeria have started to wake up to the realities on ground. The awareness, five years ago, was not as high. But what we did was to prepare the minds of the people, because we have seen the global trends.

Concerning figures, when you come out and say you lost XYZ amount of money, there is likelihood the customers become afraid; that is why when some of them are compromised, they don’t come out publicly to say this is the amount we lost.

All I know today is that banks, institutions and corporations in this country get compromised repeatedly. What they do is to be reactive; some of them don’t act until they are affected. That shouldn’t be the mindset of someone who wants to be effective and productive in his dealings.

What we preach today is to be proactive: be there before any other. Put your house in order before the cyber-criminals get to your place. However, we have seen a change of attitude among some of the players; generally, it is no longer as couple of years back.

Impact of Check Point IT Security Solution on Banking and other industries

The solutions basically ensure that the malware that could let people or cyber-criminals to perpetuate evil within the cyber space are reduced; in fact, completely eliminated. On a scale of ten, I should say eight success rates. Of course, if I tell you today I am going to provide 100% security for institutions then I am lying. They have used our technology, tested it and are convinced. Today, most of the customers act as reference to others. It wasn’t the case five years ago. They have had the look and feel of technology and were convinced.

Key Challenges of Selling IT Security to Government and Enterprises

One thing I have seen repeatedly is lack of awareness. Again, when you talk about awareness in Africa, security awareness and consciousness is not where we want it to be. Another challenge, over the years, is cost. It is a major issue, because security is not something like a server or a hardware that when you mention it to you management, they are seeing the physical server or critical infrastructure that will cost XYZ amount.

Security is more virtual stuff that has to do with licences. So, some people have difficulty justifying the bases or why they need to invest huge amount of money. Some people tend to claim: ‘we have run this business for five to six years without anything happening. How come you wake up one morning and telling us we have to spend this XYZ amount of dollars to just put our house in order?’

So, the chief technology officers (CTO) and chief information officers (CIOs) get stocked. It is a major problem. We have also had instances people walk up to us and say ‘we need help’. Help in what direction? Help us build justification.

Why do we need to make this investment? Truly, cost is an issue, but for people who do not know, you think you are actually saving up money in your organisation by not implementing IT security and not having the right policies in place, but you are actually not in business, that is what is called total cost of ownership.

Have you thought of what happens to you tomorrow; when you are hit by probably a Ransomware attack? The last WannaCry, the whole world shook by the incidence. Remember, Africa never experienced that, but the effect was felt here.

Every CEO rushed to the IT department: are we safe? Are we protected? We are going to see lot more of this happen, because the bad ‘guys’ keep innovating. It is only the people who are not ready that fall victims of these things.

Today, I feel that the major problem is awareness creation; getting people to buy into the cyber security as a global trend. We see IT security issues increase everyday there are different versions. The other time, it was a hotel in Asians. The best thing is for people to come to reality that it has come to stay. It is an African problem- couple of years people were afraid of owing ATM cards, because people might gain access to their PIN and unto their money.

But today, you have realised that if you don’t own an ATM card you would probably find it difficult to operate your account. By the time the environment becomes aware of these things there will be more businesses. It will impact the rate of closure of these businesses.

Aside awareness, knowledge is very key. Knowledge is still very low. Employees within organisations lack good knowledge about cyber security. We have talked about having adequate security policies- if people are not aware that anything like USB drives cannot be used in an organisation, there is no way they can adhere to it.

A visitor from anywhere can come and tell the front desk officer, ‘do you know what I came here for an interview, this is my flash drive can you help me print out the CV? Unknowingly or innocently for the front office person he/she will insert the drive and that could be a source of bridge for the organisation.

So, the knowledge is very important. So, ignorant could be a source of challenge to industries with regards to IT security. People know but they pretend as if they are not aware.

Making Licensing and Renewal Easier for Businesses

For people who know what value is in what they are going for, because what says it all is the value; for instance, the day you make up your mind to buy a smartphone, you know there is a Samsung Note 8, an iPhone 8, you know there is a cost implication. But it depends on what you want to do with the phone.

Some people would prefer to spend $100 and save the stress of buying in the next five years. Some other person says, I will rather prefer to buy $5, but I want to visit the market as often. It is a matter of choice.

The fact is that by the time you go to the market 10-15 times on value of $5, you will realise that the person who took the decision to buy $100 on the same stuff, has saved money more than you.

Remember that each trip you make to the market, there is probably a wear and tear, cost of transportation, risks and other factors. That is how it is for security. It is not that the cost is out of place, but the mind-set of the people that are actually consuming these things. At the end of the day, the day you are breached, the amount of money you will lose is like times three of what you should have spend, coupled with time wasted and the integrity of your organisation is affected. So, all of them put together are part of the cost.

In a nutshell, it is not expensive, but the buying behaviour of the people is what makes it expensive. What we advise is for them to approach it from value point of view.

Protecting Organisations against Attacks like Wannacry among Others

When I mentioned the top three malwares in Nigeria, one of them is Locky. Locky is actually a Ransomware Trojan that targets windows platforms. This malware sends system information to a remote server and receives an encryption key to encrypt files on the infected system.

Furthermore, the malware demands that payment be made in the form of Bitcoins. So, to survive a system reboot it adds a wrong key registry entry. This is what the bad guys do. Now, what we also tell people is, most times organisations say, we have a firewall, but it cannot protect you from Ransomeware attack.

Often time, people mix things up. Firewall is like you and your gateman. When you got to this premises the security man granted you access, but he isn’t aware that upon your drive-in you dropped any bad object here.

He has done his job by clearing you to enter. So, this is actually what happens on the online space. From Check Point point of view, we have security suite that will help organisations sort out these challenges.

We have anti-bots, applications control, our SandBlast Mobile, SMS security apparatuses to weed off SMS/email from people that look familiar but are actually attacks.

We have solutions around these things. What we advise is you buy Check Point technology to protect your systems from these attacks. That’s why I said when you are a leader just continue to be there; you cannot lead a certain industry without innovation, research and development and technological updates. We have solutions across board like the anti-ransomware which is as superb like others we release to the market.