E-Business
Preventing, Mitigating Ransomware with Cyber Situational Awareness
If you’re familiar with mafia movies then you’re familiar with extortion – the practice of obtaining something, especially money, through force or threats.
Extortion has been around for centuries – well before “The Godfather” or “Goodfellas.” Even cyber extortion, which extends this criminal activity into the digital world, isn’t new.
What is new, however, is the wide variety of methods that are used by the bad guys to get their money.
Three main tactics are behind cyber extortion: the threat of distributed denial of service (DDoS), the threat of data compromise and ransomware.
DDoS attacks are one of the most popular means to facilitate extortion. These types of attacks typically target business-critical websites in order to increase the likelihood of payment, usually via Bitcoin (BTC), and can have crippling effects on organizations.
In certain cases, such as when targeting hosting providers, the threat actor may add more pressure to pay by using the negative publicity associated with service downtime as a threat.
A second method of extortion involves the potential release of compromised data. This method is dependent on the fact that the target’s data has already been compromised.
The threat of its release to the public domain is used as blackmail in order to extort money from the affected entity.
A third type of extortion, and the one most often in the news as of late, is ransomware – malicious software (malware) that restricts access to the computer system it has infected.
The malware demands that a ransom be paid before restoring access to affected resources.
Ransomware can prevent access to many features of a victim’s machine, including files, applications and the operating system itself.
Because ransomware is an ever-evolving threat that can be more challenging to address than other cyber extortion tactics, let’s take a closer look at how it works and how to prevent and mitigate it.
At a high-level, the ransomware process is fairly standard. Files are encrypted and the attackers, who hold the decryption key, will only allow the target to decrypt the files after the required BTC ransom is paid. Specific details of the attack, however, will depend on the variant.
Until recently ransomware has been delivered most commonly via drive-by-downloads from exploit kits, or through spam emails that either contain malicious attachments or encourage recipients to visit websites hosting malicious content.
But we see that starting to change with threat actors using more targeted methods to achieve their objective, such as spear-phishing emails purporting to be from a job applicant or including the name, job title and job-relevant information of the recipient.
The disclosure that some organizations are paying the fee to unencrypt data likely provides further motivation for these types of attacks. In fact, when the actor estimates there’s a high likelihood of payment of the ransom fee they invest in more reconnaissance which can further increase the likelihood of infection.
As ransomware becomes big business, research on the dark web reveals a number of services being advertised to make it easy for beginners with low technical understanding to execute ransomware attacks with success.
Everything they need is available on a USB stick for $1,200 or they can take advantage of a hosted service in return for 5 percent commission on the ransom payments received.
So how can you combat cyber extortion? Cyber situational awareness can give you greater insights into the tools and processes used by actors that employ DDoS-based extortion and compromised data release extortion.
Advanced knowledge of the typical demands of a threat actor and their capabilities can help you make difficult decisions if presented with such a scenario and help you prevent future attacks.
Mitigating ransomware threats is more complex. It requires a combination of technical and process controls and company-wide engagement – from employees, to executives, to IT security teams. Cyber situational awareness can help you understand the infection vectors of the malware and apply the appropriate security controls to mitigate the risk of infection.
This includes insights you can use to raise staff awareness of how ransomware attacks occur and help you devise technical and procedural controls to prevent infection and to develop ransomware response procedures in the case of infection.
Of course ensuring that backups are maintained and are separate from the network can increase resilience to such attacks. In addition, several decryption tools have been released but, in the cat and mouse game between ransomware and such tools, their effectiveness tends to be short-lived; ransomware developers are continuously developing encryption methods to evade them.
As defenders, staying up-to-date with the latest trends and innovation can be hard, but it is essential in order to effectively prevent and mitigate the effects of extortion on your business.
With cyber situational awareness you can learn about the actors involved in extortion and their tactics, tools and motivations. With this knowledge you can more effectively align your defenses and make better decisions in the face of an attack.
Alastair Paterson, CEO and Co-Founder of Digital Shadows
Noble Ajuonu, head, Sydani Technologies Ltd., has urged the Federal Government to harmonise National Identification Number (NIN) and Bank Verification Number (BVN) to tackle crimes and insecurity in the country.
Ajuonu made the call at a media roundtable, organised by Sydani Group in Abuja.
The News Agency of Nigeria (NAN) reports that the roundtable focuses on driving sustainability through a comprehensive analysis of Nigeria’s key development areas.
Ajuonu said that Nigeria could overcome its security challenges and pave the way for a safer, more secure future for all Nigerians by embracing technology and implementing practical solutions,
“We need to harmonise data, prioritise seamless integration of databases like NIN, BVN, and security agency records, establish clear protocols for data sharing and access, with robust safeguards against misuse,’’ expert said.
According to him, the unified data pool will empower intelligence gathering and targeted operations.
He also called for investments in smart surveillance, intelligent video analytics software, training of personnel in data analysis, interpretation of data in real-time to combat crimes.
“There is need to implement a legal framework for call interception in criminal investigations, with strict oversight to prevent abuse, encourage community cohesion, training of tech savvy security personnel with tech-enabled tools.’’
Ajuonu also urged the government to address infrastructure deficit in technology, saying that technology was all encompassing to address insecurity.
“According to the National Identity Management Commission (NIMC), as of December 2023, only 104.2 million Nigerians had been enrolled for the National Identity Number (NIN).’’
Ajuonu added that over 122.2 million citizens left uncaptured for NIN were people in rural areas where enrolment centres, digital services were limited.
“Most crimes are being perpetuated from rural communities and this lack of comprehensive identification creates a gap where elements not captured in the national database can constitute public nuisance, crimes.
“There is the inadequacy in the integration of NIN, BVN and Voters Identification Number (VIN).
“Advanced call interception and analysis tools, used successfully in other countries, could provide invaluable insights into criminal networks and operations but infrastructure is lacking,’’ he said.
Also, Mr Godfrey Petgrave, the Agricultural Expert, Sydani Group, called for empowerment of smallholder farmers with access to finance and training to enhance productivity.
According to Petgrave, Nigeria requires policy reform and institutional strengthening to improve agricultural practices and embrace digital agriculture solutions to address food insecurity.
Mr Akolade Jimoh, another expert of the group on health, advocated for expanded community-based health insurance programmes for rural and underserved areas.
Jimoh added that the country needed to encourage Public Private Partnership to revolutionise products design and quality improvement on health services.
Konga, Nigeria’s leading composite e-commerce group, is thrilled to announce the launch of amazing deals at its Infinix Brand Week. Infinix, a leading global smartphone brand known for its innovative products and cutting-edge technology promises exclusive discounts and special offers on select smartphones, marking an exciting milestone in the realm of online shopping.
Shoppers can expect nothing short of extraordinary deals on a wide range of Infinix products, all available exclusively on the Konga online platform. With discounts of up to 30% off, this partnership between Konga and Infinix aims to redefine the shopping experience for tech enthusiasts across Nigeria.
Konga Brand Week has become synonymous with excitement and unbeatable deals, and this year’s edition is no exception. In addition to exclusive discounts on Infinix smartphones, shoppers can explore a diverse array of products across various categories, including electronics, fashion, home essentials, and more.
“At Konga, we are dedicated to providing our customers with the best shopping experience possible,” said Rita Ohaedoghasi, VP Marketing at Konga. “The Infinix Week during Konga Brand Week allows us to continue delivering on that promise by offering incredible discounts and special offers on some of the most sought-after smartphones in the market.”
To stay updated on the latest developments and exclusive deals during Konga Brand Week, shoppers are encouraged to connect with Konga across all platforms, including social media and the Konga website. Don’t miss out on this opportunity to score big savings and elevate your tech game with Infinix and Konga.
Gartner predicts that by 2028, 75 percent of enterprise software engineers will use Artificial Intelligence (AI) code assistants, up from less than 10 percent, currently.
According to a Gartner poll of 598 global respondents conducted in the third quarter of 2023, 63 percent of organisations are now testing, deploying, or have previously implemented AI code assistants.
AI code assistants provide for more capabilities than only code development and completion, notes the research firm.
According to Gartner, the use of AI code assistants can lead to higher work satisfaction and retention, resulting in lower turnover costs.
Philip Walsh, senior principal analyst at Gartner, comments: “Software engineering leaders must determine ROI and build a business case as they scale their rollouts of AI code assistants.
“However, traditional ROI frameworks steer engineering leaders toward metrics centred on cost reduction. This narrow perspective fails to capture the full value of AI code assistants.”
Gartner notes that software engineering leaders must “reframe the ROI conversation from cost reduction to value generations”.
Walsh adds: “Calculating time savings on code generation is a good place to begin building a more robust value story. To convey the full enterprise value story for AI code assistants, software engineering leaders should connect value enablers to impacts, and then analyse the overall return to the organisation.”
Access Bank Unveils DiamondXtra Season 16, Dangles N200m, 3 SUVs
Imperative of Upholding Nigeria’s Telecoms Lifeline
Lafarge Africa Launches Girls-in-Tech Programme to Empower Women Innovators
Kaspersky Warns of Data Stealers Hunting for User Credentials
Hydrogen, CCHub Partner to Encourage Fintech Startup Success
See Full List of Fake Loan Apps Blacklisted By CBN
FIRS Files Tax Evasion Charges against Binance
AXA Mansard Empowers Female SMEs with Financial, Digital Skills
IFC Invests in New 4DX Ventures Fund to Support Tech Startups in Africa
Moniepoint Study Reveals How Strong Cultural Bonds, High Levels of Trust Drives Nigerian Family Businesses
News2 days agoBankers, Officials Colluding to Re-loot Recovered Abacha’s Fund- EFCC
News2 days agoFITC to Redefine HR with AI, Digitisation for Organisational Sustainability
Telecom2 days agoLayer3 Achieves Recertification for ISO/IEC 27001:2022, ISO/IEC 27017:2015, PCI-DSS and Nigeria Data Protection Compliance
E-Financial2 days agoMasterCard, Onafriq Partner to Bring New Payments Suite to Africa
Telecom2 days agoWhy E-commerce is Thriving in South Africa
News2 days agoNASENI Collaborates with NIPSS on Enhancing Digital Economy, Job Creation
News1 day agoQNET Raises Alarm over Fraudulent Use of Foundation’s Name in Nigeria
E-Financial2 days agoWema Bank Launches Anti-Fraud Campaign to Protect Customers