E-Business
Preventing, Mitigating Ransomware with Cyber Situational Awareness
If you’re familiar with mafia movies then you’re familiar with extortion – the practice of obtaining something, especially money, through force or threats.
Extortion has been around for centuries – well before “The Godfather” or “Goodfellas.” Even cyber extortion, which extends this criminal activity into the digital world, isn’t new.
What is new, however, is the wide variety of methods that are used by the bad guys to get their money.
Three main tactics are behind cyber extortion: the threat of distributed denial of service (DDoS), the threat of data compromise and ransomware.
DDoS attacks are one of the most popular means to facilitate extortion. These types of attacks typically target business-critical websites in order to increase the likelihood of payment, usually via Bitcoin (BTC), and can have crippling effects on organizations.
In certain cases, such as when targeting hosting providers, the threat actor may add more pressure to pay by using the negative publicity associated with service downtime as a threat.
A second method of extortion involves the potential release of compromised data. This method is dependent on the fact that the target’s data has already been compromised.
The threat of its release to the public domain is used as blackmail in order to extort money from the affected entity.
A third type of extortion, and the one most often in the news as of late, is ransomware – malicious software (malware) that restricts access to the computer system it has infected.
The malware demands that a ransom be paid before restoring access to affected resources.
Ransomware can prevent access to many features of a victim’s machine, including files, applications and the operating system itself.
Because ransomware is an ever-evolving threat that can be more challenging to address than other cyber extortion tactics, let’s take a closer look at how it works and how to prevent and mitigate it.
At a high-level, the ransomware process is fairly standard. Files are encrypted and the attackers, who hold the decryption key, will only allow the target to decrypt the files after the required BTC ransom is paid. Specific details of the attack, however, will depend on the variant.
Until recently ransomware has been delivered most commonly via drive-by-downloads from exploit kits, or through spam emails that either contain malicious attachments or encourage recipients to visit websites hosting malicious content.
But we see that starting to change with threat actors using more targeted methods to achieve their objective, such as spear-phishing emails purporting to be from a job applicant or including the name, job title and job-relevant information of the recipient.
The disclosure that some organizations are paying the fee to unencrypt data likely provides further motivation for these types of attacks. In fact, when the actor estimates there’s a high likelihood of payment of the ransom fee they invest in more reconnaissance which can further increase the likelihood of infection.
As ransomware becomes big business, research on the dark web reveals a number of services being advertised to make it easy for beginners with low technical understanding to execute ransomware attacks with success.
Everything they need is available on a USB stick for $1,200 or they can take advantage of a hosted service in return for 5 percent commission on the ransom payments received.
So how can you combat cyber extortion? Cyber situational awareness can give you greater insights into the tools and processes used by actors that employ DDoS-based extortion and compromised data release extortion.
Advanced knowledge of the typical demands of a threat actor and their capabilities can help you make difficult decisions if presented with such a scenario and help you prevent future attacks.
Mitigating ransomware threats is more complex. It requires a combination of technical and process controls and company-wide engagement – from employees, to executives, to IT security teams. Cyber situational awareness can help you understand the infection vectors of the malware and apply the appropriate security controls to mitigate the risk of infection.
This includes insights you can use to raise staff awareness of how ransomware attacks occur and help you devise technical and procedural controls to prevent infection and to develop ransomware response procedures in the case of infection.
Of course ensuring that backups are maintained and are separate from the network can increase resilience to such attacks. In addition, several decryption tools have been released but, in the cat and mouse game between ransomware and such tools, their effectiveness tends to be short-lived; ransomware developers are continuously developing encryption methods to evade them.
As defenders, staying up-to-date with the latest trends and innovation can be hard, but it is essential in order to effectively prevent and mitigate the effects of extortion on your business.
With cyber situational awareness you can learn about the actors involved in extortion and their tactics, tools and motivations. With this knowledge you can more effectively align your defenses and make better decisions in the face of an attack.
Alastair Paterson, CEO and Co-Founder of Digital Shadows
Nigerian Data Protection Commission (NDPC) and National Insurance Commission (NAICOM) have signed a Memorandum of Understanding (MoU) to protect data pilfering in the insurance industry.
The agreement was finalised on Friday and aims to address critical concerns around data privacy and ensure that the insurance sector complies with global best practices in data management.
Some of the objectives of a MoU include training and capacity building to enhance awareness and skills in data protection, setting up specialized clinics to address data protection concerns and provide guidance; conducting compliance activities by regularly, monitoring and enforcing compliance with data protection regulations and educating insurance companies on the importance of data protection and the benefits of adhering to best practices.
Mr Olusegun Ayo Omosehin, commissioner for Insurance/ chief executive officer, NAICOM, said, “The collaboration marks a significant milestone in safeguarding the personal data of insurance policyholders and promoting trust in the insurance sector”.
To ensure the effective implementation of the Memorandum of Understanding (MoU), an Implementation Committee will be established.
This committee will comprise representatives from the 2 agencies, as well as other key industry associations, including the Nigerian Insurers Association (NIA) and the Nigerian Council of Registered Insurance Brokers (NCRIB).
The committee’s primary responsibility will be to monitor progress, provide guidance, and facilitate collaboration among stakeholders to guarantee the successful execution of the MoU.
Officials from both NAICOM and NDPC have expressed confidence in the partnership’s potential to strengthen data privacy frameworks within the insurance sector.
They noted that the initiative would boost public confidence, enhance compliance, and position the sector for greater innovation and credibility.
This collaboration is expected to pave the way for a more secure and trustworthy insurance landscape in Nigeria, ensuring the protection of personal data while fostering the industry’s growth.
Nigeria Data Protection Commission (NDPC) will start prosecuting data privacy offenders from the beginning of 2025, according to Babatunde Bamigboye, head of the Legal Enforcement and Regulation Department of the commission.
This move is part of its efforts to enforce regulations and promote responsible data handling in Nigeria.
Bamigboye, disclosed this during a one-day cybersecurity awareness campaign with the theme “Utilising AI-Powered Services for Proactive Cybersecurity” in Abuja.
The event was organised by SOPHOS UK in collaboration with SPOKES Network and Net-Trix Solutions to foster networking with industry experts on how AI is shaping the future of cybersecurity.
Bamigboye explained that, due to the significant implications of data privacy breaches in Nigeria, the commission has embarked on awareness programmes to educate individuals on their data protection rights and inform data processors and controllers of their obligations.
To this end, he announced that beginning next year, the commission would prosecute any data controllers or processors found in breach of the law.
“At this moment, we have investigated quite a number of cases, and in terms of prosecution—as you know, as a lawyer, this means going to court—but we haven’t taken any matters to court yet.
“This is the formative stage; we understand the implications for the country as a whole. And usually, when you talk about prosecution, it also involves some criminal activities. So, at this moment, our focus has been on creating awareness.
“But from next year, we will step up enforcement in this area. What we have done so far is to take remedial actions against certain data controllers and processors who defaulted under the Act,” he noted.
He assured investors that Nigeria’s cyberspace is secure for digital transactions.
“Nigerian cyberspace is safe; otherwise, we wouldn’t be experiencing the smooth flow of digital transactions in Nigeria. It is safe but not without threats, and we are doing our best as a country to combat these threats.”
Christopher Odutola, a sales engineer at SOPHOS UK, noted in his presentation that 100% cybersecurity cannot be guaranteed, hence the need for proactive measures.
“A lot of people will come to you and say, ‘We can give you 99.9% or 100% cybersecurity.’ It’s not true.
“Nobody can provide 100% security anywhere in the world. What they can do, as I mentioned earlier, is reduce the risk for you. However, determining the extent of risk reduction is difficult.
“It’s impossible to eliminate 100% of risks anywhere in the world. What we provide is what we call a cybersecurity breach protection warranty. This warranty covers incidents such as data breaches or ransomware attacks. For instance, if you lose your files while we manage your SOC as a service, we will reimburse up to one million dollars in response costs.”
Odutola further stressed the importance of organisations reducing cyber threat risks to secure cyberspace.
“There are risks to businesses, risks from downtime, attackers, scammers, and the rest, trying to infiltrate networks.
“The risk is always high. As cybersecurity professionals, we are doing as much as possible to reduce these risks.
“The various security controls we implement—antivirus software, firewalls, email security, cloud security, network security, and others—are aimed at reducing risks. We must focus on minimising risks. For instance, we currently see risks originating from third-party suppliers and vendors.”
According to him, “We have a process called risk assessment, which helps to evaluate vendors to ensure they do not introduce risks into our environment. This is why these security controls are crucial.
“We have them in place. It’s equally important to involve senior management in the discussion, as this is often where the gap lies. Unfortunately, cybersecurity is often perceived as a cost centre.”
Harrison Oloye, chief executive officer (CEO) of Net-Trix Solutions, said the event aimed to raise awareness about cyber threats and equip users to manage potential attacks.
“What we did, as Net-Trix Solutions Limited in conjunction with Spokes Network, is to create awareness and educate the public and private sectors on how to use Artificial Intelligence (AI) to combat cyber threats.”
Speaking further on achievements in creating awareness, he said: “As part of our Corporate Social Responsibility (CSR), we educate and train as many people as possible on the dangers of cyber threats and cyber-related crimes.”
Ms. Sifon Ufot, head of Business at SPOKES Network, emphasised the need to take proactive measures against cyber threats.
“We need to stay cyber-safe because hackers working behind the scenes are not joking—they work 24/7. For us, staying proactive is essential. With the help of AI, we can stay proactive; it provides information beforehand and even prevents some attacks from reaching us.”
Check Point, a cyber security company has reported that Nigeria, South Africa, Kenya, and Morocco are seeing targeted cyber-attacks on government, education, and financial institutions.
In its just released 2024 African Perspectives on Cyber security report, Check Point, said that the cyber security sector is growing by 20-25% annually, fuelled by investments in infrastructure and Artificial Intelligence-driven solutions.
The report said that South Africa has seen 3,312 attacks on government institutions every week and a 90% increase in ransomware, with cybercrime costing the country nearly 1% of GDP.
Kenya, in East Africa, sees 4,719 attacks on the government sector each week, indicating an urgent need for enhanced defenses.
According to the report, Nigeria sees 4,718 attacks every week, which is one of the highest in Africa.
In a recent incident, the report states that a banking trojan assault affected 100,000 customer accounts, resulting in a $3 million loss.
Morocco is one of Africa’s most targeted countries, with 8,733 attacks on government entities reported each week, the report said.
According to Check Point, the Moroccan government recently faced a state-sponsored cyberattack that compromised classified communications, raising significant national security concerns.
“Organisations in Africa are attacked roughly 3300 times per week, if we look at the global average it is about 1 800, it is almost double the attacks,” said Hendrik de Bruin, head of security consulting at Check Point SADC during the presentation.
Check Point noted that the continent’s GDP is predicted to exceed $4 trillion by 2027, and digital infrastructure has emerged as a key driver of economic growth. However, rapid digitisation has resulted in increased vulnerability.
De Bruin explained: “We are slowly, but surely digitalising our industries, we are digitising our governments, private sectors are digitising themselves, so we have got an expanding digital attack footprint.
“We also have cloud adoption, which is not new, but picking up pace in Africa. That is another way that these attackers are using to gain access to organisations, and we also see a large uptake on cloud specific attacks as well.”
EFCC Says Nigerian Banks are Notorious Conduits of Financial Crimes
NIMC Introduces Paid National ID Card Amid Low Revenue
Data Commission, NAICOM Partner to Safeguard Data in Insurance Industry
NASENI Retreat Focuses on Aligning Development Institutes’ Goals
TEDxPAU 2024: Exploring New Possibilities and Shaping Tomorrow
First Bank Proposes New Name after Upgrading Banking Platforms
Edo State Launches Data Centre in Benin
GSMA, Automotive Edge Computing Consortium Partner to Drive Forward Interoperable Connected Vehicle Services
Echefu Launches LUFT TV, another Pay TV after Failed TSTV Project
Nigeria Makes List of Top 10 Countries with Highest Cases of Internet Scams
News3 days agoALX Organises First-ever Business Showcase for its Community Entrepreneurs
Telecom3 days agoAirtel Africa-UNICEF Partnership Connects 1,200 Schools, 1M Africa Children to Digital Education
Telecom3 days agoKari Toriola: How Telecom Can Propel Nigeria to a $1 Trillion Economy
Telecom3 days agoTreepz Embarks on Global Expansion Journey with Trade Accelerator Program
E-Business2 days agoNDPC to Begin Prosecution of Data Privacy Offenders from 2025
Broadcasting3 days agoFlymate Travel Unveils Visadoc App to Enhance Travel Convenience
Telecom3 days agoGalaxy Backbone, Bauchi State Government Sign Landmark MOU to Enhance Digital Infrastructure and ICT Capacity
E-Business2 days agoNigeria, Others Confront Flood of Cyber-Attacks