Telecom
Protecting Assets in a Remote-first (and potentially Hostile) World
By: Chester Wizniewski, Field CTO Applied Research at Sophos
I live in a city center and the lunch hour certainly isn’t like it once was. While some people have returned to working in an office, it seems that the majority have not. Looking back, the pandemic will have been a turning point for many things around the world, and the rhythms of office-centered worklife will be something that will never return to the old ways.
With this increased flexibility employees are not just working from home behind consumer-grade Wi-Fi routers; they are also spending part of the day at the park or coffee shop, or perhaps even having a “working holiday.” Those in charge of protecting enterprise assets have to assume these endpoints are always in hostile territory.
Even before the pandemic, organizations working toward improving their security maturity were often trying to “push left.” What is pushing left? At its most basic level it means moving things closer to the start. It originates from software development where the stages of the development process are conceptualized from left to right, left being the beginning. In applied security we also use the term “pushing left,” but rather than referring to the software development process we are referring to the attack chain, which moves from reconnaissance on the left through action (exfiltration or other attacker goal) on the right.
For many years, the most comprehensive security strategies have involved defense in depth. The idea is that not all technologies are suitable for detecting a given threat type, so it is best to deploy them in layers. These layers often directly correspond to how far “left” something is in the attack chain. If you can detect something at the network border through your firewall, email, or web filters, you have contained the threat before it has any negative impact on operations.
Ideally you want to detect and block an attacker as far left as possible, i.e., as early as possible. Pushing detections left also alerts security analysts that an intrusion may be underway, initiating more focused threat hunting to anticipate gaps in defenses your attacker may be attempting to exploit.
For employees at the office, you can centralize control of these defenses and provide optimum protection. The question is, are you able to provide the same protection for remote workers regardless of their location? Can you monitor and respond to threats being detected on those assets when they are out of the office? As many have observed, this did not work as well as we would have liked when we all went into lockdown, many of us without a plan.
While there are still many benefits to monitoring the network when you have control of it, including reduced endpoint overhead and the ability to keep threats at a distance from sensitive assets, we need to ensure we can take as much of this protection as possible with us when we are out and about.
We must ensure not only that protection is optimized, but also that we don’t lose our ability to monitor, detect, and respond to attacks targeting these remote assets. Most organizations have moved to utilizing EDR/XDR solutions (or plan to in the very near future) , which is a great start, but not all solutions are comprehensive.
In the remote-work era, insufficiently protected remote users can encounter plenty of issues – malicious URLs and downloads, and network attacks, to name only the most mundane – that in the Before Times would have been handled by machines guarding the corporate “fort.” The biggest missing components when users are “outside the fort” are HTTPS filtering and web content inspection of the sort that is typically implemented within next-generation firewalls. When you add these technologies to pre-execution protection, behavioral detection, machine learning models, client firewalls, DLP, application control, and XDR, you are starting to look at a comprehensive stack of defenses for attackers to overcome – even if the endpoints themselves are now free-range.
For initiatives like zero trust network access (ZTNA) to be effective, we must not only wrap the applications we interact with, but we must also wrap the endpoints that connect to them. Simple checks like whether the OS is up-to-date and whether it has security software installed may be a good start, but not all protection is created equal.
With most devices being connected to the internet whenever they’re in use, we can leverage the power of the cloud to help provide ubiquitous protection and monitoring. Modern security solutions must assume the endpoint device or phone is in a hostile environment at all times. The old idea of inside and outside is not only outdated, it’s downright dangerous.
Nigerian Communications Commission (NCC) is in talks with the Central Bank of Nigeria (CBN) over the Unstructured Supplementary Service Data (USSD) debt totalling N250 billion between the telecom operators and the commercial banks in the country.
USSD, known as quick or feature codes, is a global system for mobile communications (GSM) protocol used to send text messages and initiate financial transactions such as cash transfers, balance inquiries, payments for services and others.
However, the USSD platform, which is widely relied upon by millions of Nigerians for quick and efficient mobile transactions, has become a point of disagreement between the banks and telecom operators.
The crisis dates back to 2019 when telcos proposed charging N4.50 per 20 seconds of USSD usage in order to cover operational costs after years of providing the service for free.
But the banks kicked against this, saying a 450% increase in transaction costs will significantly grow the debt and strain relations between the two vital industries.
However, Dr Ikechukwu Adinde, director of Consumer Affairs Bureau, NCC, who disclosed this move, said commission was hopeful the issue would soon be settled.
According to him, “The NCC remains committed to ensuring that the interests of all stakeholders—consumers, telcos, and banks—are protected.”
He insisted that a resolution is critical to maintaining the seamless operation of mobile financial services that millions of Nigerians depend on daily.
Adinde, who also said plans are on to introduce reforms at enhancing tariff transparency in the telecommunications industry, believed the new move between the NCC and the CBN would put the debt issue finally to rest.
On transparency and responsibility policy, Adinde said the changes, set to roll out in the coming months, will require telecom operators to provide consumers with clear, easily accessible tables outlining tariff plans, billing rates, and the terms and conditions associated with their services.
Indeed, Karl Toriola, chief executive officer (CEO) of MTN Nigeria, had said in October that banks might be disconnected from the USSD platform due to debt arising from the use of the quick codes by their customers.
Toriola had said mobile network operators (MNOs) might, subject to regulatory approval, suspend use of the service on the network for banking operations, as the debt had continued to pile up and was becoming unsustainable to the operators.
Also, Gbolahan Awonuga, executive secretary of the Association of Licensed Telecommunication Operators of Nigeria (ALTON), said in October that the debt between telecoms operators and commercial had hit N250billion.
Earlier, the telcos had lamented that they could no longer provide the services free, proposing a cut of N4.50k per 20 seconds from the charges paid by customers to the banks.
But the banks kicked against this, adding that it would raise costs by 450 percent.
Credit: Daily Post
Obafemi Banigbe, CEO of 9mobile, recently shared his expertise at the Alliance for Innovative Regulation (AIR) virtual conference, tackling the pressing issue of digital payment fraud in West Africa.
His insightful perspectives offered valuable insights into combating identity theft, a major threat to electronic money transfer security across the African continent.
Speaking as a panellist in a session moderated by Nick Cook, Chief Innovation Officer at AIR, Banigbe outlined how telcos play a pivotal role in protecting financial transactions.
“Fraud is fundamentally a human challenge, not just a technological one,” he remarked, emphasising that identity theft remains central to electronic money transfer fraud and requires a community-driven, human-centred approach.
He emphasized the critical role of telecommunications companies as guardians of security in the financial ecosystem. He outlined the proactive measures 9mobile and other telcos are taking to fortify financial systems, focusing on several key areas.
Banigbe highlighted the integration of Know Your Customer (KYC) systems, which leverage collaborations with national ID databases, banking records, and mobile number registries to enhance customer verification.
He also stressed the importance of robust security tools, including SIM registration, Biometric authentication (fingerprint and facial recognition) and One-Time Password (OTP)-based authentication. These measures he said collectively strengthen verification processes, ensuring a more secure financial ecosystem.
Banigbe reiterated the importance of partnerships between financial institutions and payment platforms. These collaborations enable the secure sharing of intelligence, ensuring compliance with data protection laws.
This, in turn, facilitates the detection of suspicious activities while maintaining privacy. He also highlighted the need to address delays in fraud tracking. To achieve this, he advocated for the deployment of real-time blacklisting mechanisms. This would enable swift action on reported incidents, preventing fraudsters from exploiting time gaps.
While highlighting the need for industry-wide collaboration, Banigbe pointed to the cost-effectiveness of shared investments in advanced security architecture. “No single organisation can tackle this alone. A united effort among telcos, financial institutions, and regulators is key to safeguarding our financial systems,” he asserted.
The panel discussion, which featured other notable speakers, including Ikenna Ndugbu (Moniepoint), Sheila Senfuma (Consumers International), and Modupe Ladipo (Prosperar Consulting), explored diverse aspects of combating digital payment fraud.
They discussed the role of robust compliance frameworks and transaction monitoring tools; addressed accessibility challenges for vulnerable populations, including people with disabilities like visual impairment that disallows them from baseline financial literacy; highlighted the specific vulnerabilities faced by women in informal financial systems and advocated for culturally sensitive financial inclusion strategies.
Banigbe further remarked on the need for proper access control within organisations to combat possible internal staff collusion with external fraudsters to make security systems more vulnerable.
“Regulating access will help prevent fraudulent activities within organisations,” he said, pointing to the need for stronger internal controls to safeguard sensitive processes.
He spotlighted the crucial role of telcos in creating a secure and inclusive digital financial ecosystem. Collaboration, Banigbe stressed, is essential to achieving lasting results in the fight against fraud.
“It is an ecosystem, and there should be a joint effort to enlighten the public on digital payment fraud and advocate for victims of fraud,” he concluded, calling for unified action among telcos, financial institutions, and regulators.
With over 100 participants attending the conference, the collective commitment to combat digital payment fraud is evident. Discussions continue to focus on leveraging technology, driving public awareness, and strengthening collaborative frameworks to address the pervasive threat of identity theft.
Professor Adewale Obadare, a renowned cybersecurity expert and the first Professor of Practice in Cybersecurity in Nigeria, shared his valuable insights on how to break into the cybersecurity industry. With over 58 professional certifications and numerous awards, including the Outstanding Digital Trust Leader Award, Obadare’s expertise is unparalleled.
Dr. Obadare Peter Adewale
Speaking at FirstBank’s Cybersecurity Career Webinar that was held over the weekend, Prof. Obadare emphasized that cybersecurity is a field with numerous opportunities, including job security, competitive salaries, and global recognition.
However, he noted that many individuals struggle to break into the industry due to a lack of understanding of their strengths and weaknesses.
To succeed in cybersecurity, Obadare advised individuals to identify their cognitive strengths and choose a career path that aligns with their skills.
He emphasized that there are two primary paths in cybersecurity: technical and governance, risk, and compliance (GRC).
Obadare debunked the myth that certifications are unnecessary, stating that they provide a structured way of learning and are essential for building cognitive competence.
He defined cognitive competence as the acquisition of knowledge and theoretical understanding, which is synonymous with knowledge and mastery of concepts and theoretical knowledge.
Obadare shared a personal anecdote to illustrate the importance of cognitive competence. He recalled a situation where a colleague, who was practically skilled but lacked cognitive competence, deleted a critical system file (NTLDR) while backing up a critical system.
Obadare, who had acquired cognitive competence through certification, knew that deleting the file would prevent the system from booting up. He intervened, recovered the file, and restored the system.
He further emphasized that cognitive competence is essential for making informed decisions and taking effective actions in cybersecurity.
He encouraged individuals to acquire certifications, such as CompTIA Security+, to build their cognitive competence and provide a structured way of learning.
In addition to cognitive competence, Obadare highlighted the importance of functional competence, which is the ability to translate theoretical knowledge into practical skills.
He emphasized that individuals need to strike a balance between cognitive and functional competence to succeed in cybersecurity.
While advising prospective Nigerians seeking to take up career in cybersecurity, Obadare advised them to be humble, open-minded, and willing to learn from others.
According to him, “My advice to individuals seeking to break into cybersecurity is to acquire certifications to build cognitive competence. Cultivate behavioral competence by being humble, open-minded, and willing to learn from others. Continuously learn and self-improve, as cybersecurity education and career is a journey, not a destination”.
In conclusion, Obadare’s insights provided a valuable roadmap for individuals seeking to break into the cybersecurity industry. By acquiring certifications, developing practical skills, and cultivating a positive attitude, individuals can set themselves up for success in this rapidly evolving field.
NCC, CBN to Resolve Telecoms, Banks’ USSD Debt Issue
First Women Radio Virtual Assistant Makes a Debut in Nigeria
9mobile CEO Highlights Key Solutions for Securing Electronic Money Transfers in Africa
NITDA DG Harps on the Role of Innovation in Nigeria’s Sustainable Development
PalmPay Reaffirms Commitment to Ensuring a Safe Financial Ecosystem @ Anti-Fraud Walk
First Bank Proposes New Name after Upgrading Banking Platforms
Edo State Launches Data Centre in Benin
Echefu Launches LUFT TV, another Pay TV after Failed TSTV Project
Nigeria Makes List of Top 10 Countries with Highest Cases of Internet Scams
UBA, Mastercard Launch Special Debit Card for 75th Anniversary
E-Financial3 days agoEFCC Says Nigerian Banks are Notorious Conduits of Financial Crimes
Telecom3 days agoNASENI Retreat Focuses on Aligning Development Institutes’ Goals
News3 days agoTEDxPAU 2024: Exploring New Possibilities and Shaping Tomorrow
Uncategorized3 days agoNIMC Introduces Paid National ID Card Amid Low Revenue
E-Business3 days agoData Commission, NAICOM Partner to Safeguard Data in Insurance Industry
E-Financial3 days agoN159m Up for Grabs in Fidelity Bank’s GAIM 6 Promo
Telecom16 hours agoNCC, CBN to Resolve Telecoms, Banks’ USSD Debt Issue
Telecom16 hours agoProf. Adewale Obadare Shares Key Insights on Breaking into Cybersecurity