E-Business
Taking Enterprise Security to the Board

It’s that time of year, again, with many companies busying themselves in the art of budgeting and forecasting for 2018.
In some companies, this means the Chief Information Security Officer (CISO) having to communicate the importance of including enterprise security in this planning, using a language that the members of the board will understand.
“For some, this will mean being given a short amount of time to make sure a group of non-technical people understand the company’s business risks and believe that your plan to mitigate them is comprehensive, necessary and worthy of investment,” said Anton Jacobsz, managing director at Networks Unlimited.
“The keyword here is ‘business’ – we have got to translate our on-the-ground security concerns into business terms, risks and outcomes. We’re all very good at listing statistics but the ability to translate this into business outcomes, which is the language your board understands, is what will win the day.
“Your board’s time, attention span and ability to consume ‘geek speak’ is limited, but there are steps you can take to ensure the time you spend with them matters,” Jacobsz explained.
Time for a few home truths
Is your exco one of the many that thinks their organisation is not going to be of interest to cyber criminals? If yes, then it may be time to explain clearly that every single organisation, regardless of size or business focus, is likely to experience a cyber security breach at one point or another. The reason for this is data.
If your business processes payments of any kind, for example salaries or online payments, or if you transmit or store records, or if you’re developing a cure for a dread disease like cancer, then you have information that a hacker can sell.
Ryan Kearney, Executive Vice President of Product Development and Chief Technology Officer of F5 Networks, advised that telling a compelling story about a security breach, preferably in your industry or locale, will help board members understand the risks here.
“Give examples from your own company. Identify critical information assets – intellectual property, sensitive customer data – and paint a picture of what would happen and what it would cost if they were compromised,” he said.
Use statistics to convince, not just frighten
There are ways to move the statistics conversation from one that leaves exco with a feeling of dread to one where they truly understanding the real potential impact to the enterprise.
F5’s Kearney says the following types of statistics could be used to educate and surprise board members:
- 73 percent of companies suffered at least one security breach in the past year.
- About a third of employees targeted for phishing will open fraudulent e-mails.
- More than one in 10 take the bait – and it only takes one.
- Less than two minutes can elapse from the hacker hitting send to your systems being compromised.
- Hackers are inside your organisation, on average, for at least four months before they’re discovered.
- Web apps are the number one entry point for breaches.
“As the C-suite leader in charge of cyber defence, it is up to the CISO to explain the impact of this to the board,” says Jacobsz. “This is the point where you should be talking in terms of tangible and intangible losses, which are sure to resonate with them.”
Tangible costs as a result of security breaches include fines as a result of breaks in customer SLAs, revenue losses due to downtime, compliance/audit fines, potential legal fees and incident response costs, which incorporate unplanned costs for hiring third party breach experts.
Less immediately obvious damage could include issues like the impact a breach could have on your company’s brand; existing and potential customer perception/loss; the loss of your competitive advantage and even the potential for the board’s personal reputation being affected.
Introduce security awareness to the company culture
If you talk of such things around the braai, you might have heard somebody complaining about how their company doesn’t allow Dropbox or Wetransfers – how archaic, right? Wrong, said Jacobsz.
“These policies are enforced because someone, somewhere along the lines, opened a mail, clicked on a Dropbox link and downloaded a file from an unknown, untrusted source resulting in a cyber security breach. But this can be avoided. A secure business is one where everyone is educated about threats and does their part to reduce risk.”
F5’s Kearney agreed, saying it starts with rigorous and repeated training and continues with individual buy in.
Furthermore, as a key participant in creating the company culture at the outset, the board members themselves must also be challenged to champion efforts that have no received budget approval, he said.
“You have done your homework and secured funds for some of your efforts but if you have risk areas that need addressing but have no budget allocation, board members need to know this and either accept the risk or champion a solution. There’s no better way to get something accomplished than by saying the board requested it get done.”
Discuss incident response and cyber insurance
As mentioned earlier, the likelihood of organisations remaining untouched by security breaches is minimal. Being prepared is the best line of defence, and employing the services of a good incident response firm is the first step.
The second is considering options in cyber insurance, which is the fastest growing insurance in the world and is projected to grow by 300 percent from $2.5 billion today in annual premiums by 2020. Here, show your work and do the maths for your board – calculate how much your business can absorb and insure the rest.
“Use your board-facing time wisely,” said Jacobsz.
“Make sure you prioritise and focus on the top cyber risks bringing solutions to the table. Above all, demonstrate your burning issues in small, easy to digest chunks. Do this and you and your boards will soon be singing in harmony and protecting the company at the same time.”
E-Business
Kaspersky Uncovers Sophisticated Deception Campaign using DeepSeek AI as Bait

Security researchers at Kaspersky have revealed how cybercriminals used geofencing, compromised business accounts and coordinated bot networks to distribute malware disguised as DeepSeek AI software, generating over 1.2 million views on X.
Kaspersky’s Threat Research and AI Technology Research have jointly identified a sophisticated deception campaign exploiting the rapid growth and public interest surrounding DeepSeek AI — a popular generative AI chatbot — in order to distribute malware through fraudulent websites.
In their investigation, Kaspersky researchers revealed that cybercriminals established deceptive replicas of the official DeepSeek website, using domain names like “deepseek-pc-ai[.]com” and “deepseek-ai-soft[.]com.”
A distinctive feature of this campaign was its use of geofencing technology, where malicious websites examine each visitor’s IP address and dynamically alter content presentation based on geographic location, enabling attackers to fine-tune their approach and reduce detection risks.
“This campaign demonstrates notable sophistication beyond typical social engineering attacks,” explained Vasily Kolesnikov, senior malware analyst at Kaspersky Threat Research.
“Attackers exploited the current hype around generative AI technology, skillfully combining targeted geofencing, compromised business accounts and orchestrated bot amplification to reach a substantial audience while carefully evading cybersecurity defenses.”
According to Kaspersky’s analysis, the campaign’s primary distribution channel was the social media platform X. Attackers strategically compromised the social media account of a legitimate Australian company to widely disseminate fraudulent links. This single malicious post drew significant attention, reaching approximately 1.2 million impressions and generating hundreds of reposts.
Researchers determined that these reposts largely originated from coordinated bot accounts — evident due to their similar naming conventions and profile characteristics — indicating a deliberate amplification of the malicious content.
Visitors lured to the fraudulent websites were directed to download a fabricated DeepSeek client application. Instead of the authentic software, these sites delivered malicious installers using the Inno Setup installation platform.
Once executed, these compromised installers attempted to contact remote command-and-control servers to retrieve Base64-encoded PowerShell scripts. These scripts subsequently activated Windows’ built-in SSH service, reconfigured it with attacker-controlled keys and enabled full remote unauthorised access to compromised systems.
All malware payloads connected to this campaign are proactively identified and blocked by Kaspersky security products such as Trojan-Downloader.Win32.TookPS.* variants.
E-Business
GBB to Train Over 300 Civil Servants on Govmail

Galaxy Backbone (GBB), the nation’s foremost digital infrastructure and services provider, is set to train over 300 civil servants, including Email Administrators and Heads of ICT, on the adoption, management, and administration of Govmail—the secure official email platform for Nigeria’s public sector.
The training, which will be conducted in batches throughout the month of March 2025, aims to ensure maximum impact and effective knowledge transfer.
This initiative is in alignment with the Federal Government’s digitalisation agenda, which prioritizes secure, efficient, and technology-driven governance. By equipping civil servants with the necessary expertise to optimize Govmail, the government is ensuring seamless communication across Ministries, Departments, and Agencies (MDAs) while strengthening data security and operational efficiency.
Prof. Ibrahim Adeyanju, the Managing Director/CEO of Galaxy Backbone, reaffirmed the organisation’s commitment to driving Nigeria’s digital transformation through innovative and secure technology solutions.
“As the nation’s leading provider of digital infrastructure, GBB is playing a pivotal role in ensuring that government communications are secured, professional, and aligned with global best practices. This training will enhance civil servants’ ability to effectively utilize Govmail in carrying out their official responsibilities,” he stated.
The training is being conducted in collaboration with the Office of the Head of the Civil Service of the Federation (OHCSF), who has sent out a Circular to all MDAs informing them of this specialized training aimed at providing hands on experience with GOVMAIl features and ensure uniform adoption of and compliance with government approved digital communications standards. This further reinforces the government’s commitment to a digitally-driven public service.
It would be recalled that the Head of the Civil Service of the Federation recently described Govmail as a ‘game changer’ for government communication. This underscores the significance of the platform in enhancing inter-agency collaboration, data sovereignty, and information security across all MDAs.
Through this capacity-building initiative, GBB is reinforcing its role as a key enabler of Nigeria’s digital transformation journey, ensuring that public sector professionals are well-equipped to harness the full potential of digital tools in their daily operations.
E-Business
NITDA Identifies Key Barriers to Cybersecurity in Nigeria

National Information Technology Development Agency (NITDA) has identified outdated frameworks, inadequate expertise, and low awareness as major barriers to effective cybersecurity interventions in Nigeria.
Dr Ayodele Bakare, deputy director, Cybersecurity Department, NITDA, made this known on Friday during a meeting with a delegation from the United Kingdom (UK) in Abuja.
The discussion focused on building a national cybersecurity infrastructure.
Bakare highlighted that cybersecurity is a borderless issue, requiring both local and international collaboration as well as strategic interventions to address emerging threats.
He noted that while Nigeria has existing cybersecurity frameworks and policies, their effectiveness in tackling evolving threats—particularly those driven by Artificial Intelligence (AI)—remains questionable.
Some of the key frameworks he mentioned include the Cybercrime Act 2015, which was recently amended in 2024, and the Nigerian Data Protection Act 2023, both of which play a crucial role in shaping the country’s cybersecurity landscape.
“NITDA, seven years ago, released the National Public Key Infrastructure as a regulation. We also have other sectoral frameworks, such as the Risk-Based Cybersecurity Framework for financial institutions released by the Central Bank of Nigeria.
“Given the fact that we have all these frameworks, their effectiveness is still a question, and I think the first thing is for a rebase line on the basis that informs the existing frameworks.
“The majority of the frameworks were issued far before now, and there are emerging risks like AI-driven threats, and some of the frameworks that we have are not really addressing them,” he said.
Bakare also pointed out that despite ongoing public awareness efforts, cyber threats such as device code phishing remain widespread.
He shared a personal experience of nearly falling victim to such an attack, emphasising that many Nigerians are still unaware of modern cyber threats.
He called for enhanced, interactive awareness campaigns to better educate the public on cyber risks.
In addition, Bakare highlighted Nigeria’s shortage of skilled cybersecurity professionals, stating that the country has only about 8,300 cybersecurity experts for a population of 220 million. He stressed the urgent need to develop skills in the sector.
“We are looking for platforms that can provide an efficient way of training people, and we are also looking at collaborations that can help bring down the cost of cybersecurity certification courses.
“Averagely, you see Nigerians spending between 2,000 dollars to 5,000 dollars for this certification, which is very expensive, and reducing the cost will increase the number of experts,” he said.
Bakare also raised concerns about governance, risk management, and compliance among government institutions, revealing that NITDA is working on an audit regime to ensure adherence to cybersecurity frameworks.
He further noted the need for more efficient threat intelligence platforms that can gather, analyse, and share information on cybersecurity threats.
According to him, adopting cloud-based solutions could help institutions identify and mitigate external threats more effectively.
“The government is making efforts to ensure the management and effective utilisation of the National Public Key Infrastructure (PKI) to secure online transactions and communications in collaboration with stakeholders.
“For government institutions, we are working on a framework for Zero Trust, which should create an efficient platform.
“The platform will ensure that before you access any information-based system, either cloud-based or on-premise, you have to go through a Zero Trust platform.
“This is to ensure that digital trust is effectively maintained and that the incidences of data leakages are reduced,” Bakare said.
He added that NITDA is developing a National Cybersecurity Architecture that will consolidate various cybersecurity initiatives and frameworks into a single, unified strategy.
“We are working towards an architecture that will serve as the single source of truth for Nigeria’s National Cybersecurity Strategy and help streamline efforts for effective management of cyberspace,” he said.
- Telecom1 day ago
ST Team Partner Proxy Coding School to Launch Free Tech Skills Initiative
- E-Business1 day ago
GBB to Train Over 300 Civil Servants on Govmail
- Broadcasting1 day ago
NAFDAC’s Fight Against Counterfeit Drugs Reaches New Heights with Ibadan Raid
- Telecom9 hours ago
MTN Nigeria Reaffirms Support for Grassroots Sports During Edo State Visit
- News9 hours ago
Igniteher BootCamp: A Pathway to Women Empowerment and Economic Growth
- News9 hours ago
Konga Health Set to Revolutionize Skincare Awareness Among Students
- E-Business9 hours ago
Kaspersky Uncovers Sophisticated Deception Campaign using DeepSeek AI as Bait
- Telecom9 hours ago
Telegram Introduces New Features to Address Unsolicited Messages