MON, JUNE 19 2017-Organisations like Dangote should conduct threat assessments to understand the threat actors who could be targeting as well as the tools and techniques that could be used say Jayan Perera and Patrick Matu, both of Control Risks. Both shared their view with CHARLES IKE-OKOH on types of cyber-risks that are associated with a breach that is directed to an organisation and more.
Integrating Security into Core Business Strategy: How can security influence customer satisfaction & shareholder value?
We can easily conclude that good cyber security has a positive effect on customer satisfaction and shareholder value. This is because bad cyber security has the opposite effect; customers are angry if data about them is stolen and misused by thieves (they get even more angry if the company does not manage the crisis in an effective and honest way), and cases of share price collapse as a result of a breach are numerous.
Cyber-attacks: Can you speak more on Current Trends and mitigation measures that can locally apply here in Nigeria?
As mentioned in our 2016 report the threat to Nigerian business is set to increase over the coming year. The most imminent threats comes from digitalisation of existing fraudulent activity. There is a level of naivety within the general public that exposes them, and organisations they purchase goods and services from. The growing digital banking channels will also lead to increased cyber risk.
Insider Threat involves Building a secure workforce. How do you achieve that in workplace where employee motivation is low at most times in a place like Nigeria?
There are many measures which can be taken. Each one in isolation may not have much impact, but collectively these measures can mitigate insider threat. For example, ensuring the employees have access only to the data which they need for their job can reduce the impact of a breach. Monitoring employees’ activity on the network and being able to investigate a breach quickly and respond decisively are key components. These measures require more than technical input; they require companies to adapt their management, HR and other business processes to minimise the likelihood and impact of a malicious insider.
What types of risks are associated with a breach that is directed to an organisation as big as Dangote? Would it have such or any meaningful national significance?
Organisations like Dangote should conduct threat assessments to understand the threat actors who could be targeting as well as the tools and techniques that could be used. Such large organisations may be targeted by nation states as well and this should be a consideration when developing the organisation’s cyber resilience program.
In your view, what role or roles should the federal government play in cybersecurity, in securing private and government systems?
It would be wrong for Governments to “take full responsibility” for cyber security of private sector companies. This would encourage companies to ignore their own responsibilities. In addition, law enforcement against cyber threat actors is difficult, as cyber threat actors work across borders. There is a limit to what a government can do in this regard.
However, the government can play a vital role by raising awareness of the threat, and by using legislation to incentivise good cyber security (and punish negligence in cyber security) and to teach companies about the most effective solutions (which always combine technical and non-technical measures). The government also has a role to play in ensuring that organisations are aware of the trends within the country and how to mitigate the same.
Do you think the country needs to put in place more workable and functional cyber-security laws. The current Cyber Crime Bill which was first debated in 2014 has been criticised as brief for its scope?
Cyber security legislation needs to be practical and relevant. It should be stakeholder driven with input from all parties who would be affected. It has also has to be broad enough to accommodate the ever-changing cyber landscape.