Rock Adote, head, Information Technology (Security & Research), International Electronics Services Limited (I.E.S) has said that most corporate organization in the country do not comply with proper patch management leaving them vulnerable to attacks on the information superhighway.
He also decried the reluctance of companies in Nigeria to perform routine upgrade.
“First, till now, it is sad to know that bank employees, for instance, who handle critical information assets of customers such as card information and account details, still fall for low-level cyber attacks such as digital impersonation and social engineering.
“Organizations do not invest in regular staff training as they ought to do enough. For instance, several studies have revealed that production employees often disclose their place of work on social media websites, accept unknown invitations, share customers personal information during discussions in online chat rooms, even reveal their operating systems architecture, internet address and a bevy of unethical engagements in the cyber space.
“Let me give you a common error predominant in Nigeria banks, a cyber criminal can gain tons of information and perform active reconnaissance by simply entering a bank and view the system of the cashier or the operator, by standing or sitting adjacent to the computer, even in these era where the default “autorun vulnerability” on Microsoft windows proliferates malware infection and tons of systems vulnerabilities, an articulate cyber criminal could simply insert a well-built information-stealing USB drive into a banking system and perform command-line background transfer of critical software and customers information from default system paths such as the two windows and internet temp directory because the store data as it is been processed, and even the system root.
“This highlights the problem of unorganised architecture and lack of safe computing practices as every well-informed banking staff is expected to lock the computer screen when he or she is not on seat, many people don’t do this, forgetting that every customer who enters a bank is on a mission. No third party should even know the operating system you are using not to talk about the application name.
“Some people are yet to understand that the trend in cyber threats have grown beyond computer malware. Another instance is that, if a system is compromised, it is a common practice in this part of the world for the system administrators to install an anti-virus, and scan the system. Thus, as a malware is detected you say all is well. I have been at least in six companies that the activities at their production line were moving on well, but on critical assessment I discovered that the systems have been “totally compromised” even by malicious insiders.
“People always believe that as long as they can type a document, print, browse, send or receive requests then their systems are in good shape. Meanwhile your system is part of a botnet that infects other workstations, with no user interaction of any kind, because these trojans do not inform you when or how they are operating, they send your critical data in bits. No operating system can claim to be secure or water-tight, the best defense is self, because the use of anti-malware program only complements as a layer of baseline security, there must be operational guidance”.
He added that in recent times, several companies have made upgrade compulsory every two weeks due to the vulnerabilities landscape.
“The worst is that the attacks occur so fast that there are presently no industry existing solutions to thwart novel sophisticated attacks. For instance, even though it will affect global customer satisfaction, Google Gmail would refuse software to be uploaded as an attachment in order to protect its entire information systems.
“A rising cyber attack vector is a situation when a cyber criminal sends curriculum vitae in .docx or .pdf to a company and on the process of opening the file the receiving system gets compromised, as the cyber criminal becomes able of implementing remote code execution on the compromised workstation”.
The cyber security expert pointed out that cyber criminals have the time, resources and skills to invest in research, which calls for Nigeria to establish a “Cyber Security Research Community” that has ample time; “it is just like the secure software development life cycle. If as a developer, you fail to comply with secure software development practices you will have applications that hackers will eat up”.