E-Business
IoT Security Expands Over Half of Global Enterprise IT Security Programs by 2020
The power of objects in the Internet of Things (IoT) to change the state of environments — in addition to generating information — will cause chief information security officers (CISOs) to redefine the scope of their security efforts beyond present responsibilities, according to Gartner, Inc.
Gartner predicts that IoT security requirements will reshape and expand over half of all global enterprise IT security programs by 2020 due to changes in supported platform and service scale, diversity and function.
“The IoT is redrawing the lines of IT responsibilities for the enterprise,” said Earl Perkins, research vice president at Gartner. “IoT objects possess the ability to change the state of the environment around them, or even their own state; for example, by raising the temperature of a room automatically once a sensor has determined it is too cold or by adjusting the flow of fluids to a patient in a hospital bed based on information about the patient’s medical records. Securing the IoT expands the responsibility of the traditional IT security practice with every new identifying, sensing and communicating device that is added for each new business use case.”
Traditional “information” technology is now being supplemented by purpose-built, industry-specific technologies that are tailored by where and how that technology is used and what function it delivers. Information remains a key deliverable and is the fuel for IoT devices.
The device’s ability to identify itself (such as RFID tags that identify cargo), sense the environment (such as temperature and pressure sensors) or communicate (such as devices in ocean buoys that transmit environmental changes to the areas around them) requires information to be generated, communicated and/or used.
Although traditional IT infrastructure is capable of many of these tasks, functions that are delivered as purpose-built platforms using embedded technology, sensors and machine-to-machine (M2M) communications for specific business use cases signal a change in the traditional concept of IT and the concept of securing IT.
“This is an inflection point for security. CISOs will need to deconstruct current principles of IT security in the enterprise by re-evaluating practices and processes in light of the IoT impact,” said Mr. Perkins. “Real-time, event-driven applications and nonstandard protocols will require changes to application testing, vulnerability, identity and access management (IAM) — the list goes on.
Handling network scale, data transfer methods and memory usage differences will also require changes. Governance, management and operations of security functions will need to change to accommodate expanded responsibilities, similar to the ways that bring your own device (BYOD), mobile and cloud computing delivery have required changes — but on a much larger scale and in greater breadth.”
Although the business use cases being identified daily are indeed innovative and new, the technologies and services that deliver them are seldom new as well — they are also seldom uniform in architecture and design. Each use case risk profile has specific requirements that may result in the use of old platform and service architecture with a new technology “overlay” to improve performance and control.
“This represents an interesting challenge for CISOs when delivering secure services for the IoT,” said Mr. Perkins. “In some cases, it may be a ‘past is future’ exercise in evaluating mainframe, client/server, Web, cloud and mobile security options as part of an overall IoT business use case.
Even out-of-maintenance systems such as Windows XP may still play a critical role for some industry infrastructure as part of an IoT security system. Security planners should not throw away their old security technology manuals just yet.”
CISOs should not automatically assume that existing security technologies and services must be replaced; instead, they should evaluate the potential of integrating new security solutions with old. Many traditional security product and service providers are already expanding their existing portfolios to incorporate basic support for embedded systems and M2M communications, including support for communications protocols, application security and IAM requirements that are specific to the IoT.
“At this time, there is no ‘guide to securing IoT’ available that provides CISOs with a framework for incorporating IoT principles across all industries and use cases,” said Mr. Perkins. “Another unique characteristic of the IoT is the sheer number of possible combinations of device technologies and services that can be applied to those use cases. What constitutes an IoT object is still up for argument, so securing the IoT is a ‘moving target.’ However, it is possible for CISOs to establish an interim planning strategy, one that takes advantage of the ‘bottom-up’ approach available today for securing the IoT.”
CISOs should resist the temptation to overthink security planning while patterns and solutions are still emerging. They should start small and develop initial security projects based on specific IoT interactions within specific business use cases. CISOs can build on these use case experiences to develop common security deployment scenarios, core architectural foundations and competency centers for the future.
“The requirements for securing the IoT will be complex, forcing CISOs to use a blend of approaches from mobile and cloud architectures, combined with industrial control, automation and physical security,” said Mr. Perkins.
“Fortunately, many of the security requirements for the IoT will look familiar to the CISO. The technologies and services that have been used for decades to secure different eras of computing are still applicable in most cases.
By Oluwole Alao
In total alignment with the presidential priority area of Reforming the Economy for Sustained Inclusive Growth and Accelerating Diversification through Industrialisation and Digitisation, the Director General of the National Information Technology Development Agency (NITDA), Kashifu Inuwa CCIE, has announced the nationwide expansion of the Hub Managers training programme in harnessing technological innovation to improve the lives of Nigerians, create jobs and foster economic diversification.
The DG made this known at the iHatch Cohort 4 -Onsite Training for Hub Managers, which was organised by the agency in partnership with the Japan International Cooperation Agency (JICA) and Office for Nigerian Digital Innovation (ONDI) at the Hotel De Horizon, Wuse 2, Abuja.
The on-site training programme, which had 37 hub managers from the 36 states of the federation, including the FCT, will empower hubs to build robust incubation systems to support startups locally, develop strong regional ecosystems through partnerships and engagement, enhance their operational and mentorship capacity and provide access to international exchange programmes towards the adoption of best global practices.
While emphasising the current administration’s commitment to reforming the economy for sustained and inclusive growth, Inuwa highlighted that the key to achieving this goal lies in leveraging digital technology at the grassroots level to solve local problems across various sectors, including agriculture and small-scale trade.
“We don’t want technological innovation to be concentrated only in Lagos and Abuja. We want to take it to the grassroots and use it to solve real-life problems. That is why we designed the iHatch initiative,” he noted.
Inuwa disclosed that the pilot phase of the iHatch, which was conducted in Abuja, successfully trained 50 startups, which led to the creation of 179 direct jobs and over 1,500 indirect jobs, Inuwa stated that the expansion of the initiative to accommodate all the 37 states will create 740 direct jobs and 7,400 indirect jobs before the end of the year.
He said, “this initiative will domesticate innovation in states and enable start-ups solve real-life problems in areas of agriculture, healthcare, transportation and other sectors, that are peculiar to their different states”.
While stressing that innovation thrives in clusters where critical stakeholders can exchange ideas and incubate solutions, the NITDA DG underscored the importance of collaboration, networking and ecosystem development in driving innovation.
“To sustain this initiative, we must build a strong community where startups, entrepreneurs, and stakeholders can continuously share ideas and collaborate. We don’t want startups to just pass through the programme; we want them to remain within the iHatch ecosystem because we want this initiative to expand to all the 774 local governments of the country.” Inuwa explained.
He noted that in addition to job creation and ecosystem building, the initiative aligns with the Nigeria Startup Act, which aims to provide legal backing and incentives for startups.
Inuwa therefore urged the participants in the iHatch programme to act as champions in their respective states, spreading awareness about the Act and encouraging other startups to register and benefit from its provisions.
“In line with the president’s mandate, our ultimate goal is to see every Nigerian digitally literate, using technology to access government and private sector services. We also want our market women to leverage technology to expand their businesses,” he added.
He stated that the iHatch model ensures investment in local capacity where national potentials can be unleashed, he said “we at NITDA are proud to walk this journey with you. Let’s keep building, let’s keep innovating, and let’s continue to shape the future of Nigeria, one innovation at a time.”
“MyLagos App,” which was launched with fanfare by the Lagos State Government in collaboration with MTN Nigeria has remained unavailable for download on app stores, raising questions about its immediate accessibility.
Hours after its official introduction on March 13, a search on Google PlayStore for the app returned the message, “No results for MyLagos App.”
Similarly, attempts to locate it on the Apple Store yielded no results, prompting concerns over the rollout’s status.
The digital platform was introduced as a comprehensive solution to enhance city navigation and improve the overall experience for Lagos residents.
It was touted to provide essential features, including real-time traffic updates, personalized navigation, emergency services, utility payments, business listings, and tourism information.
This reporter’s attempt to download the app proved unsuccessful. Furthermore, tests by Lagos-based individuals mirrored these findings, suggesting the app may not yet be publicly accessible.
The absence of the app has sparked speculation: could it be a work in progress, or was its availability restricted post-launch for undisclosed reasons?
Dr. Obafemi Hamzat, Lagos State Deputy Governor, described the app as a revolutionary tool aimed at improving governance and service delivery.
“Technology has evolved from being a luxury to a necessity. In our fast-paced world, effectively utilising technology can significantly enhance governance, improve service delivery, and simplify the lives of every resident in this vibrant state.
“With the launch of the MyLagos App, Lagos State is poised to remain at the forefront of digital transformation, not just in Nigeria but across Africa,” he said.
Abdulhakeem Giwa, manager of Digital Channel Management, MTN Nigeria, echoed this sentiment, highlighting the app’s potential to transform urban living and enhance navigation for residents.
While the app’s unavailability casts doubt on its immediate implementation, stakeholders remain optimistic about its promised benefits once fully operational. Whether technical challenges or strategic decisions have delayed its rollout remains unclear.
National Social Investment Management System (NASIMS) has leaked millions of federal government records in a major system oversight which could be exploited by cyber criminals.
NASIMS is the central management platform for the administration and coordination of Social Investment Programmes under the Federal Ministry of Humanitarian Affairs, Disaster Management and Social Development
The major leak exposed everything from home addresses to work backgrounds of tens of millions of Nigerians
According to the Cybernews research team, the exposed AWS S3 bucket stored over 23 million files, including passports, birth certificates, educational certificates, and N-Power-submitted applications.
N-Power is a social welfare scheme to combat youth unemployment. N-Power applicants use the NASIMS platform to apply to take part in the program.
“The implications of exposing 23 million application-related documents of N-Power candidates could be severe for the affected individuals. Identity theft, fraud, and targeted phishing attacks are the most likely risks for the leaks’ victims,” Cybernews research team said.
According to Cybernews research team, “Worryingly, the instance remains open to the public, even after multiple attempts to reach NASIMS administrators and relevant authorities in Nigeria. We have also reached out to the ministry behind NASIMS for a comment and will update the article once we receive a reply”
What data leaked, and why is it dangerous?
Documents stored on the exposed instance include different sets of citizens’ data. However, the team surmised that the leak revealed:
Full names
Dates of birth
Places of birth
National Identification Number (NIN)
Email addresses
Phone numbers
Home addresses
Work background
Education background
Exposing sensitive and personal data poses numerous threats to the individuals involved.
Most pressingly, attackers might utilize the information for identity theft and various fraud schemes. For one, malicious actors could try opening fraudulent bank accounts or use stolen identities for illicit activities, masking their own IDs.
“Another way attackers can exploit similar data sets is by exploiting the identities to access financial services or execute unauthorized transactions, potentially causing long-term financial damage to the victims,” Cybernews research team said.
Cybercrooks could also exploit the leak to carry out targeted phishing and social engineering attacks.
For example, malicious actors could attempt to masquerade as legitimate organizations in order to deceive individuals into providing even more sensitive data – such as login credentials – or downloading malware.
“The implications of exposing 23 million application-related documents of N-Power candidates could be severe for the affected individuals. Identity theft, fraud, and targeted phishing attacks are the most likely risks for the leaks’ victims.”
The leaks’ nature empowers attackers to craft spear-phishing attacks custom-made for each individual or group of individuals. Such attacks are hard to distinguish, as they often include targets’ personal details and other data points meant to lure in unsuspecting victims.
“Criminals could use the exposed data to offer fake job opportunities or promise assistance with the N-Power application process in exchange for payments or additional personal information, exploiting the candidates’ vulnerabilities,” the team explained.
Additional attack vectors involve risks to victims’ physical safety. For example, criminals could exploit leaked data to locate and target victims for various malicious purposes, such as stalking, harassment, or even burglary.
To avoid similar leaks in the future, Cybernews research team advised:
Change the access controls to restrict public access and secure the bucket. Update permissions to ensure that only authorized users or services have the necessary access.
Monitor retrospectively access logs to assess whether the bucket has been accessed by unauthorized actors.
Enable server-side encryption to protect data at rest.
Use AWS Key Management Service (KMS) to manage encryption keys securely.
Implement SSL/TLS for data in transit to ensure secure communication.
Consider implementing security’s best practices, such as regular audits, automated security checks, and employee training.
Jumia Nigeria Kicks Off Tech Week 2025
SEC Voids Mainland Trust’s Registration, Suspends Centurion Registrars
NITDA Expands iHATCH Initiative to Drive Job Creation, Economic Diversification
Transforming Lives Through Advocacy: Princess Omoyemwen Inspires Change at MTN’s Go MAD Activation in Benin
Bridging Nigeria’s Digital Divide: ITU and UK-FCDO Fuel Rural Connectivity Revolution
Telecom3 days agoAirtel Launches AI Spam Alert in Nigeria
E-Business3 days agoMyLagos App Unavailable despite Launch with Fanfare
E-Financial3 days agoAllegations of Fraud against us Unfounded, False — First Bank
Telecom3 days agoNCC, ALTON, LASIMRA Engage to Strengthen Telecom Infrastructure in Lagos
E-Financial3 days agoNigeria’s Cash Payments to Decline 32% by 2030 on Digital Transaction Surge
News3 days agoFG Seeks Stakeholders’ Collaboration to Bridge Digital Gap
News3 days agoAMCON Vows to Recover N455bn Debt from Arik Air, Affiliates
Broadcasting3 days agoMTN Board: Between sentiment and the law