Good Morning, Mwende, further to your point regarding having not experienced critical security threat, it is important for end users and information owners to understand that just because they have not been compromised, it does not necessarily mean that they are secure since this in security context is "Security by Obscurity". It is important to understand that hackers write code with certain parameters of the target and thus when they execute such programs only applications that meet this criteria are compromised and thus the probabiity of them being victims is very slim. In addition, before organisations can go on a spending spree on security programs, applications and human resource it is worthwhile for them to know that "Insiders" pose the greatest security threat to their Information. With this in mind, there is need for internal Access Control mechanism to be implemented to help eliminate this threat. As far as our current level of preparedness goes, a random analysis of existing web applications, networks and hosting companies, its evident that we have a lot of work ahead of us. Case in point: 1. Recent "war drives" around Nairobi city center reveals that most wireless networks are unsecured which provides a very convinient entry point to most black hat hackers into the business network. 2. Most of the dynamic web applications have severe database security vulnerabillties. Using default security assesment methods, it is very easy to gain access to the underlying database data and structure. 3. Though its not considered as a "Critical" application, the "KICTANET database" stores passwords in clear text which is a violation of the database Confidentiality rule. To help protect our infrastructure and data, awareness is paramount as this sets the base on what security should be implemented and how. Also important are policies, standards procedures to help govern the process. Evans On Mon, May 4, 2009 at 4:52 PM, mwende njiraini <[email protected]>wrote:
Good morning!
Today we continue our discussions on cybersecurity specifically data and infrastructure security.
It now not uncommon to hear about cyber terrorism, cyber crime, cyber attacks, Information Warfare, etc. Recent examples of cyber attacks in Estonia and Georgia show that the Internet offers an inexpensive and easy weapon of modern warfare.
Fortunately, we as a country may not have yet experienced critical security threats possibly because majority of users/organizations have access to ‘less than broadband speeds’ thus providing no incentive for meaningful exploits. This presents a situation where low usage and poor connectivity has acted as our “security”.
However, with the growing use of the Internet, encouraged by the availability broadband connections locally, nationally (Fibre optic national project, operator networks) and internationally (TEAMS, SEACOM), the number of incidences of online security breaches are set to increase.
Thank you Harry Delano (email 29th April) for raising the following important questions for our discussion today.
- What is our level of cybersecurity preparedness (as government, operator, service providers, private sector organizations and educational institutions)? - Have we made an assessment of our cybersecurity preparedness levels, to date, particularly with the impending landing of international submarine fibre optic cable? - What is needed to protect our data and infrastructure from increased threats and at what cost?
Regards Mwende
_______________________________________________ kictanet mailing list [email protected] http://lists.kictanet.or.ke/mailman/listinfo/kictanet
This message was sent to: [email protected] Unsubscribe or change your options at http://lists.kictanet.or.ke/mailman/options/kictanet/ifani.kinos%40gmail.com