Connect with us

E-Business

Taking Enterprise Security to the Board

Published

on

Anton Jacobsz, managing director at Networks Unlimited

It’s that time of year, again, with many companies busying themselves in the art of budgeting and forecasting for 2018.

 

In some companies, this means the Chief Information Security Officer (CISO) having to communicate the importance of including enterprise security in this planning, using a language that the members of the board will understand.

 

“For some, this will mean being given a short amount of time to make sure a group of non-technical people understand the company’s business risks and believe that your plan to mitigate them is comprehensive, necessary and worthy of investment,” said Anton Jacobsz, managing director at Networks Unlimited.

 

“The keyword here is ‘business’ – we have got to translate our on-the-ground security concerns into business terms, risks and outcomes. We’re all very good at listing statistics but the ability to translate this into business outcomes, which is the language your board understands, is what will win the day.

 

“Your board’s time, attention span and ability to consume ‘geek speak’ is limited, but there are steps you can take to ensure the time you spend with them matters,” Jacobsz explained.

 

Time for a few home truths

Is your exco one of the many that thinks their organisation is not going to be of interest to cyber criminals? If yes, then it may be time to explain clearly that every single organisation, regardless of size or business focus, is likely to  experience a cyber security breach at one point or another. The reason for this is data.

 

If your business processes payments of any kind, for example salaries or online payments, or if you transmit or store records, or if you’re developing a cure for a dread disease like cancer, then you have information that a hacker can sell.

 

Ryan Kearney, Executive Vice President of Product Development and Chief Technology Officer of F5 Networks, advised that telling a compelling story about a security breach, preferably in your industry or locale, will help board members understand the risks here.

 

“Give examples from your own company. Identify critical information assets – intellectual property, sensitive customer data – and paint a picture of what would happen and what it would cost if they were compromised,” he said.

 

Use statistics to convince, not just frighten

There are ways to move the statistics conversation from one that leaves exco with a feeling of dread to one where they truly understanding the real potential impact to the enterprise.

 

F5’s Kearney says the following types of statistics could be used to educate and surprise board members:

 

  • 73 percent of companies suffered at least one security breach in the past year.

 

  • About a third of employees targeted for phishing will open fraudulent e-mails.

 

  • More than one in 10 take the bait – and it only takes one.

 

  • Less than two minutes can elapse from the hacker hitting send to your systems being compromised.

 

  • Hackers are inside your organisation, on average, for at least four months before they’re discovered.

 

  • Web apps are the number one entry point for breaches.

 

“As the C-suite leader in charge of cyber defence, it is up to the CISO to explain the impact of this to the board,” says Jacobsz. “This is the point where you should be talking in terms of tangible and intangible losses, which are sure to resonate with them.”

 

Tangible costs as a result of security breaches include fines as a result of breaks in customer SLAs, revenue losses due to downtime, compliance/audit fines, potential legal fees and incident response costs, which incorporate unplanned costs for hiring third party breach experts.

 

Less immediately obvious damage could include issues like the impact a breach could have on your company’s brand; existing and potential customer perception/loss; the loss of your competitive advantage and even the potential for the board’s personal reputation being affected.

 

Introduce security awareness to the company culture

If you talk of such things around the braai, you might have heard somebody complaining about how their company doesn’t allow Dropbox or Wetransfers – how archaic, right? Wrong, said Jacobsz.

 

“These policies are enforced because someone, somewhere along the lines, opened a mail, clicked on a Dropbox link and downloaded a file from an unknown, untrusted source resulting in a cyber security breach. But this can be avoided. A secure business is one where everyone is educated about threats and does their part to reduce risk.”

 

F5’s Kearney agreed, saying it starts with rigorous and repeated training and continues with individual buy in.

 

Furthermore, as a key participant in creating the company culture at the outset, the board members themselves must also be challenged to champion efforts that have no received budget approval, he said.

 

“You have done your homework and secured funds for some of your efforts but if you have risk areas that need addressing but have no budget allocation, board members need to know this and either accept the risk or champion a solution. There’s no better way to get something accomplished than by saying the board requested it get done.”

 

Discuss incident response and cyber insurance

 

As mentioned earlier, the likelihood of organisations remaining untouched by security breaches is minimal. Being prepared is the best line of defence, and employing the services of a good incident response firm is the first step.

 

The second is considering options in cyber insurance, which is the fastest growing insurance in the world and is projected to grow by 300 percent from $2.5 billion today in annual premiums by 2020. Here, show your work and do the maths for your board – calculate how much your business can absorb and insure the rest.

 

“Use your board-facing time wisely,” said Jacobsz.

 

“Make sure you prioritise and focus on the top cyber risks bringing solutions to the table. Above all, demonstrate your burning issues in small, easy to digest chunks. Do this and you and your boards will soon be singing in harmony and protecting the company at the same time.”

 

 

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

Continue Reading
Advertisement
Comments

E-Business

FG to Enforce Mandatory Use of National IDs from January 2019

Published

on

The Federal Government said it is enforcing the mandatory use of the National Identification Number (NIN) beginning from January 1, 2019, according to Aliyu Abubakar, director-general of the National Identity Management Commission (NIMC).

 

Abubakar said the mandatory usage of the identification number was sequel to Federal Executive Council (FEC’s) approval last week of the immediate commencement of the implementation of a strategic roadmap for a new Digital Identity Ecosystem.

 

FEC at its meeting chaired by President Muhammadu Buhari last week approved the new identity ecosystem strategy for the enrolment of Nigerians and legal residents into the National Identity Database (NIDB), the statement said.

NATIONAL-IDENTITY.jpg

‘’The FEC’s approval of the new Digital Identity Ecosystem will bring into full force the implementation of the provisions of the NIMC Act 23, 2007, which include the enforcement of the mandatory use of the National Identification Number (NIN) and the application of appropriate sanctions and penalties on defaulters as provided under Section 28 of the NIMC Act’’, Abubakar added.

 

Speaking on the strategic roadmap for a new Digital Identity Ecosystem for Nigeria, NIMC boss explained that the step falls in line with the Federal Government’s efforts to reposition the country as a leader in the global economy.

 

Speaking further, he said Section 27 of the NIMC Act empowers the Commission to set a date for the enforcement of the use of the NIN for transactions listed in the Act and also to expand applicable transaction in a Regulation approved by the Attorney General of the Federation.

 

Abubakar said “the Commission shall from 1st January 2019 commence full enforcement of the mandatory use of the NIN and apply all applicable sanctions and penalties as provided under Section 28 of the NIMC Act against defaulters.”

 

He also said the cut-off date for data eligible for harmonisation with the National Identity Database (NIDB) is 1st of December 2018.

 

“This means only data captured as at 30th November 2018 will be subjected to harmonisation as is currently on-going.

 

“Fresh data capture of persons shall be in compliance with the Provisions set out in the Nigeria Biometric Standards; Mandatory use of the NIN Regulations 2017 and guidelines issued by the Commission.

 

“That is to say the capturing agency must request and verify the NIN before taking secondary demographic data of the person and where the person does not have a NIN, register such person (where it is licensed to do so) or refer such person to a NIN registration centre.

 

“Only licensed public or private agencies shall capture and transmit biometric to the NIDB.

 

“Only the NIMC, Nigeria Police Force and other related security agencies shall store biometric data’’, Abubakar stated

Continue Reading

E-Business

Nigeria Gets Chowberry App to Reduces Food Waste

Published

on

Oscar Ekponimo, a Nigerian software developer

Chowberry, an App has been launched through which Nigerians can identify food that is close to its expiration date at nearby grocery stores.

 

They can purchase this food for a reduced price and distribute it to people who might otherwise not get enough to eat.

 

Chowberry is also aimed at combating hunger and food waste in Nigeria.

 

The app was invented by Oscar Ekponimo, a Nigerian software developer who partnered with the programme Project FoodAccess to connect impoverished Nigerians and non-governmental organizations with cheap food.

 

Chowberry works through several steps. The first step involves local grocery stores. As the store’s food products near their expiration dates, the stores begins reducing the food prices each day. The app alerts Nigerians and food organizations about the lowered food prices.

 

Project FoodAccess specifically matches the food with families they register need it the most. These include families with young mothers and female breadwinners.

 

Chowberry helps to alleviate the problem of hunger, which affects Africa as a whole and Nigeria in particular.

 

According to the United Nations Food and Agriculture Organization, 223 million people in sub-Saharan Africa were hungry or malnourished from 2014 to 2016. Nigeria itself has been declared unable to feed its entire population by the World Food Programme.

 

Ekponimo himself has a personal experience with hunger. After his father had a stroke and could not work, his family could not afford to feed themselves. Chowberry has given Ekponimo the opportunity to help others going through similar situations.

 

The app has had a significant impact within different areas in Nigeria. The three-month trial run has fed 200 families and 150 orphans. Many Nigerians have requested that the program expand to more communities.

 

Chowberry also has assisted the 20 participating grocery stores. Food that would have been thrown out before now gets sold to families in need at a profit to the store. The helpful software has gained international recognition as well, winning the Rolex Award of Enterprise in 2016.

 

Ekponimo hopes that he can expand Chowberry to feed the hungry in other African countries. With continued innovation from people like Ekponimo, technology like Chowberry could be used to help put an end to hunger in Africa and around the globe.

 

Continue Reading

E-Business

IGF Seeks Women Participation in Internet Governance for Development

Published

on

Mrs Mary Uduma, the Chairperson, Internet Governance Forum (IGF) says active participation of women in the internet process is key to the development of any nation.

Uduma made this known on Tuesday in Abuja at the first Women Internet Governance Forum in Nigeria organised by the Centre for Information and Technology Development (CITAD).

The programme is supported by Association for Progressive Communication (APC).

She said that inclusiveness of women and acquisition of the knowledge of the Internet was key to their development.

“And these are the things the forum wants the women to be part of in the internet governance process.’’

She said that to bridge the gap, the forum drew up women focus programmes to enable them express themselves, participate fully and voice up their opinions.

“The essence of this meeting is for capacity building and for bringing information to the women and showing them the areas they have right and authority to speak out.

“And for them to participate in the development process, the internet is the platform as this is the enabler for everybody to be inclusive.

“This programme is the first step of involving women in internet governance.

“We have brought women together, spoken to them, stimulated them and educated them to know they have a platform to voice out their minds,’’ she said.

Prof. Amina Kaidal, a board member of CITAD said that the focus for the programme was to bring women together to identify problems hindering them from the internet process.

Kaidal, who is also a lecturer at University of Maiduguri said that the forum would strategise on how to improve internet accessibility for women.

Maryam Haruna Programme Officer, Gender and Internet CITAD said the over the years the organisation had been struggling for gender inclusion in Nigeria, especially in the northern part.

Haruna said that CITAD discovered that women participation in IGF was very low and this was what prompted the organization to organize the forum to bring up issues concerning gender challenges in internet and online.

“The forum aimed at bridging gender gaps in accessing information and Internet policies, especially as it affects Nigerian women.

“So that is why we brought women from government, Civil Society Organisations (CSO), Academia, private sector to discuss the challenges and proffer solutions,’’ she said.

Ms Ene Ede, the Gender and Social Inclusion Adviser, Search for Common Ground, an NGO, a participant said that access to internet was like “having the world on your palm’’. “If the women have the world on their palms, it would be a better place as internet is virtually everything and huge platform of engagement.

“If women are left out of this engagement, the world will not be good for development to take place and for everybody to participate equally, women need to be in the cyberspace.

“Another participant, Miss Hassana Ibrahim of Women Will, an initiative of Google for Women said that the programme was apt as CITAD was trying to involve more women in decision-making of how the internet should be used.

“You notice that decision-making is about male and women are excluded so, bringing more women to participate in Internet is a very good idea,’’ she said.

Continue Reading

Trending

Copyright © 2017 Communication Week Media Limited.