Experts Ring Fear as Cyber Thieves Exploit Security Lapses

Experts in IT security have warned of a possible cyber racket insurgence in Nigeria, unless controls needed to protect sensitive data and critical infrastructure from abuse by insiders are firmly installed, Nigeria CommunicationsWeek can report. The independent Oracle users’ group survey, which first revealed that attackers exploited legitimate database access through SQL injection and stolen credentials, said laxity in the industry remains since the 2011 report. The Independent Oracle Users Group had more than 300 database and information security professionals recently surveyed on their data security practices with disturbing results. 60 per cent of respondents say data breach was most likely. Hamilton Iyoha, pre-sales consultant, Oracle Corporation, Nigeria, said over one billion records have been breached from database serves over the past six years. Iyoha said at a one-day ‘Data Security and Optimisation Summit’ hosted by Computer Warehouse Group (CWG), that the figure doubles every two years. He noted that ICT revolution in Nigeria would spur latent hullabaloo and cyber crime owing to porous nature of companies’ database in the country. Iyoha said hackers usually deploy SQL injection technique to attack databases through a website usually carried out by including portions of SQL statements in a web form entry field in an attempt to get the website to pass a newly formed rogue SQL command to the database. SQL injection is a code injection technique that exploits a-security vulnerability in a website’s software. The vulnerability happens when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. Thus, unprotected site oftentimes dump the database contents to the attacker. Iyoha said: “With the fast growth in data generation, demand for data security will also increase in manifold. Actually, 48 per cent of data breaches are caused by insiders, 89 per cent records stolen using SQL injections. Hackers use stolen credentials; all this call for stringent security applications. “As it is now, existing IT security is not addressing database security, because only 20 per cent of companies that participated in the survey have a kind of forecast estimate,” he noted. Iyoha said CWG/Oracle partnership has provided the society with a preventive and detective control security solution that demands authentication, access control and auditing capable of blocking threats. “About 75 percent of organizations genuinely doing business encrypt their database traffic. Another 22 per cent encrypt only their database backup files; however, Oracle Advanced Security (OAS) was produced in such a way that it protects data from unauthorized users, particularly on enterprise solution base,” said Iyoha. Peter Boglo, the senior technology pre-sales consultant, Oracle, despite huge spends on IT security by Nigeria financial institutions, and operators in the oil and gas sector, tangible results are hard to come by because of inappropriate spend. “Nigerian companies, banks, IT firms, those in oil and gas spend more money on information security management and they have not gotten maximum result. So, the Oracle database 11g is an epoch-making event that spans the full range of customers need. Information security is a prerequisite for growth, confidence building and protection of stakeholders in the digital economy,” said Boglo. He notes that the “National Identity Management Scheme requires user provisioning, role management, entitlement management, and risk based access control virtual directive. Therefore, our database must be protected to avoid the impending cyber attacks.” Christy Elendu, manager, Oracle Channels Analyst representing the country manager, said that the company spent about $4.3 billion in 2011 on research and development aimed at producing best software to tackle global security threats. “Oracle has been there since 1971 which we started with proprietary system to open and standard systems and CWG has been a worthy partner. And we are committed to hardware engineering, new opportunities for partners, better solution for customers.