William Makatiani, managing director, Serianu, recently visited Nigeria and spoke to chike Onwuegbuchi on cyber security issues

Africa is playing catch-up in cyber security

We are not prepared in Africa. The problem we have in Africa is that, we like to do easy things fast. Easy thing means deploy technology, some vendors will come and tell you this thing works in the US, put it in place and we put it in-place. The problem with that is you never get to look at security.

Security is complicated because there is local aspect around securing systems, most of our fraudsters live here, most of the banks that lose money are in Nigeria, in Ghana, in Kenya among others and those that perpetrate these frauds are within those environments. There is no way somebody will come from the US and secure it, that is the hard work. We need somebody to understand how these people are doing it.

Only locals can do it, those are the difficult things, implementation of the system is easier and those are the things we are focusing on.

When it comes to preparation we are not ready because we don’t have enough skills. Secondly, we are not ready because we are not collaborating. If you are Bank A and I’m Bank B, if you get compromised you keep quiet if it is insured you go get compensated and you will not tell Bank B and Bank B will get hit, it really empowering the hackers now they know they can get away with all these attacks.

Third issue is Malware- malicious software. We are not training our people well enough. You get an employee, an assistant to the chief executive officer, the CEO tells his assist if you get an email click on it, print it for me let me see what it is. Now, they are clicking on malicious links. Immediately they click they get Ransonware and get compromised and Ransonware takes over the network as you are looking at that our curriculum in the universities are old.

There is no single individual that can come from our traditional university that will be able to get into cyber security field without additional preparation.

We have those gaps. When you think of where we are headed and we need to ask ourselves how do we address it?

Our board members does not understand technology, if you tell them about the safe, that somebody is getting into the safe they will understand, but the safe is no longer save. The database is the new safe, if a board member cannot understand that Oracle database is the new safe there is pretty much they can be able to secure, so if I tell them I want to secure Oracle database, they will say last year we bought a router this year we have bought a firewall why are we buying something new? They will say no, but the padlock we bought for the safe last year was good but has gone out of the market we need a new padlock, that padlock will cover our database which is Oracle. This is the language we need to get to our board members.

The language technical people are taking to board members and senior managers is out dated, you cannot talk technology to somebody who spend his time playing golf or somebody who spends his time looking at financial statements you need to come up with something that is comparative.

From a typical corporate perspective the question is how do we change? If you come to global cyber security problem you have three steps.

First is, understanding what is happening; second is attributing it to an individual and third is how do we stop that individual?

In understanding in Africa, we are trying our best but we are 20 per cent, this has to do with deploying of technology to understand what is going on in the network. When it comes to attribution we are poor just 2 per cent , there is no single attack that has be successful being attributed very few, because these individuals came out and say it happened like this or this is what led to this or that.

If it comes to attribution of attacks happening in different countries in Africa it is not easy to attribute it to somebody, attribution is a challenge.

Deterrent requires law enforcement and it is where we are really struggling. Law enforcement agents are not working together you find judiciary, national intelligence or Army, they don’t know how to coordinate this issue of cyber security so that they can be able to attribute most of the bigger attacks to somebody. That is the biggest cyber security problem and that is where we are facing challenge.

Issues of lack of collaboration

The reason why there isn’t much collaboration is because of fear. For instance, with the private sector such as banks there is this fear that customers will run away, we don’t want people to know they have stolen from me, it is an African problem. Africans we don’t want sharing our things in public.

We have to move beyond where we are and only regulation will force people to talk to each other. If you get compromised, it is okay. It is normal let us know so that we allow other people to learn from that experience. That is the key.

Most of these law enforcement officials don’t coordinate because some of them don’t know. We also need to be very clear in terms of who is responsible for what, if you are an investigation agency, we need to know where you start and where you stop. If you are in national intelligence services, you need to help us develop intelligence on why banks are getting attacked, who is attacking and who is benefit from these money that is where you start and ones you get it you empower the police who are going out to investigate some of these crimes so that they can be able to be addressed.

If you are in the army you need to have intelligence to know if it is a state problem, if the hackers are coming from Ghana, Ukrane, Ruwanda or Kenya, you need to look at that and say how do we coordinate this? And then empower the prosecution and the judges so that they can make a clear case of what is going on when and how. That is the type of collaboration we need.

Impact of different regulatory agencies in the fight against cyber crime

If you have a cyber-security office which in Nigeria is lacking, this will have an incumbent who is responsible for cyber security policy in the country like we are seeing in the UK, South Africa among others, where you have office of the cyber security incumbent who could coordinate all these issues.

It can become a problem if it is political, he can’t do much. That is why it is allowed to run just like Attorney general.

The biggest problem with cyber security office depends on where it sits. For countries where it is located in the judiciary it works very well, because the whole idea is to be able to oppressionalize the security laws and if it is located under the attorney general it works very well. If you move it into ICT ministry it fails, if you move it into NIS or national security Agency it fails.

Cyber security law

Cyber security changes very fast, four years ago we didn’t know about Ransomeware, we didn’t know about cryptomining, cryptomining is a biggest thing now. What we see across the world is instead of us to focus on technology, we focus on particulars of crimes which means at the end of the day it is fraud, unauthorised access, there is sabotage and those were the results of somebody coming in and compromising in an environment.

Most of our laws are copy and paste especially from Malaysia, Singerpole. We copy our laws from those countries across Africa and if you look at the laws we have in place, they focus a lot on tools and techniques and that is what is out-dated.

The tools, techniques and processes of attacking have changed. We have to change from focusing so much on tools, techniques and processes and focus on fraud say somebody did A,B,C,D whichever way they did it, it is still a fraud.

Criminals 100 years ago were interested in stealing money, information about you, interested in making sure you don’t move, it is the same thing today. Criminal are interested in stealing money from banks, making sure you don’t provide service, interested in stealing Intellectual Property (IP) or private data. In terms of motive they have not changed, intentions have not changed and therefore we have to build flexible laws that address motives, intensions and the principles of what the laws are trying to achieve to deter.

Building Cyber security Skills in Organisations to Fight Cyber-attacks

If I were an ambitious leader,  I will cancel quite a number of technology programmes in our curriculum, they are wasting time. Get in touch with the industry, get some professional from other countries, look at the areas of artificial intelligent, analytics, look at the areas of cyber security build practical programmes.

Start with forcing graduates to do one to two year programme where they learn practical, set up research foundations behind these new technologies, because if you don’t do it now, even smaller countries like Rwanda, Botswana Mauritius will be more powerful than bigger countries like even South Africa, Nigeria. In some of these areas, the problem is to start early.

Number one thing is to change the curriculum, the curriculum we have now is useless. Yes, it builds the people to the level where you can convert them, but it doesn’t build the curiosity to continue building your capability into analytics crypto. If you look at the curriculums of those in the United States, UK and Europe even Rwanda and Mauritius you now see the embedding of these new technologies and new media. First of all you have to start with that.

Number two, it is unfortunate the tools most of the professional we have in the market place are bringing are out-dated. The days of sitting somewhere looking at risk on huge template are gone, if you are going to lose money you lose money through the payment system, through a card or fund and risks starts there. And you fall back who is likely to do it? That has changed, now employees need to change, they don’t need to sit down in class, but they need to look at what they are doing, what is changing in the industry and then retrain in terms of approach.