Tope S. Aladenusi
cyber-attack hit the main website of the British Broadcasting Corporation (BBC) and its iPlayer Streaming service on New Year’s Eve. The BBC’s websites were unavailable for several hours as a result of the attack. This was the first widely reported cyber-attack of the year 2016. Whilst it is bad enough to hear such news at the start of the year, what should be of main concern is the number of unreported or stealth cyber-attacks that have and will occur in 2016. As the Internet and technology continues to evolve, the world becomes more connected and no one is immune to these threats.
2015 was an incredible year for cybersecurity in Nigeria. In May 2015, the cybercrime bill was signed into law in Nigeria by erstwhile President Goodluck Jonathan. The implications of this to individuals and corporations is that cybercrime is now properly defined and legal consequences are attached to any defiance of this law.
At the start of last year, an annual forecast of Nigeria’s cybersecurity landscape was detailed in our 2015 Nigeria Cybersecurity Outlook. This included forecasts that the likelihood of cybersecurity issues were expected to reduce towards the last quarter of the year due to the successful implementation of the Bank Verification Number (BVN) exercise; an initiative powered by the Central Bank of Nigeria (CBN). This prediction was confirmed in a report presented by the Chairman of the Nigeria Electronic Fraud Forum (NEFF) who is also Director, Banking and Payment System Department, CBN; Mr. Dipo Fatokun during the forum’s annual dinner. He stated that the loss arising from electronic payment fraud had fallen by 63% and there had been a reduction of 45.98% in attempted online fraud by the end of 2015 as against the beginning of the same year. This drop could be partly attributed to the successful implementation of the BVN; a commendable initiative implemented to secure Nigeria’s payment system in 2015.
The 2015 forecast also indicated higher risk of current and former employees or contractors resorting to cybercrime as a means to maintain their standard of living. During the course of the year, forensic specialists were kept busy (hopefully with pockets full) as several companies had to engage digital forensic specialists to investigate cybercrime perpetrated by various suspects who are largely made up of employees and former employees of the victim organizations.
The forecast further highlighted the fact that there would be an increase in cyber-attacks of websites and information technology (IT) infrastructure of political organizations and public institutions, and these would appear as headlines in local dailies. The prediction became a reality and at various points during the year, there were several allegations of hacking attempts on the websites of public institutions and political parties. Some worthy mentions are; the reported hack and de-facing of the Independent National Electoral Commission (INEC) website in March 2015 and also that of the Lagos state government in December 2015.
2015 segued into 2016 and the cybersecurity journey of hacks, attacks and triumphs still continue. In 2016, there is undeniably a high likelihood these threats and countermeasures will take the following dimensions:
Sophisticated phishing techniques will be on the rise
With a lens on Nigeria, phishing mails which is a type of social engineering has become the attack of first choice. This has been a recurring theme in years past but in 2016, there is a likelihood of more sophisticated use of these attacks with the aim to cause havoc. Typically most of the phishing mails are poorly crafted oftentimes containing spelling and grammar errors, however we are likely to get to the era where the mails are properly crafted and the messages more targeted to the victims. Targeted messages might leverage prior information about the victims from social media, Internet or earlier compromises. It is envisaged that there will be more collaboration between the public sector, private sector and academia in promoting user awareness in identifying phishing and social engineering attempts.
Rise of local hacktivism and recognition of Nigerian Hackers
In 2016, there will be more focus on the growth of local home grown hackers. Both ethical and unethical sects will gain more recognition. Two (2) Nigerian teams represented Africa at the 2015 Global Cyberlympics Finals Competition and it is expected that more Nigerian teams will participate at the 2016 edition. The Cyberlympics is a worldwide international hacking competition to increase education and ethics in information security. Nigeria will be recognized as the hub of the best cyber defense team in Africa. As there will be more recognition for the ethical hackers in 2016, the unethical sect will also rise in popularity. Western style hack attempts by terrorists may grow in Nigeria as local hacktivists are likely to take it a notch higher to make hack attempts on government and private institution infrastructures.
Enforcement of the Cybercrime Act
The cybercrime act passed into law in 2015 is a welcome development but many key stakeholders such as the judiciary and law enforcement agencies are yet to come up to speed in understanding and implementing the Act. We should expect the enforcement of the cybercrime act to be more pronounced in 2016 and the office of the National Security Adviser will play a more active and leading role in the campaign.
Anyone or organization that violates any of the laws should expect to suffer the consequences. Companies will need to share and report threats to the National Computer Emergency Response Team (National CERT) Coordination Center in accordance with the Act. Individuals/organizations that need to prosecute violators will need digital forensics services to preserve data in a manner that is admissible in the court of law. Specialists would also be required to analyse digital data to answer key questions such as “where did the data go?”, “who had access to it?” and “has it been modified?” etc. Consequently, there will be a rise in the demand for computer forensic professionals.
Biometric Data Harmonization
A presidential order was issued in 2015 to all Ministries, Departments and Agencies (MDAs) that request and retain biometric data, to expeditiously harmonize their biometric databases. It is expected that the data harmonization will effectively link all MDA databases. The Vice President, Professor Yemi Osinbajo explained that government’s interest in the citizens’ data harmonization is to assist the government in its quest to improve the socio-economic landscape of Nigeria, particularly targeting the poorest and most vulnerable persons, as well as to issue unique identification numbers to every Nigerian and legal resident for the improvement of national security, among others.
Upon successful completion of the data harmonization process, it is expected that the government will be properly positioned to track and investigate cyber criminals. As it would be able to accurately tell for most citizens who they are, their age, home address, work place, phone numbers, bank details and a whole other information in just one database.
Cyber Insurance
Organizations in Nigeria will begin to explore cyber insurance. This will likely begin in the financial services industry which is the major target of cyber-attacks in Nigeria. Cyber insurance is designed to mitigate losses from a variety of cyber incidents, including data breaches, business interruption, and network damage. This should hedge a firm from cyber losses and curtail recovery costs in the event of a cyber-attack. The coverage also protects against third party liabilities a business might suffer as a result of a failure of system security. Cyber insurance has not been a popular insurance policy in Nigeria but in 2016, there is a high possibility that insurance companies will see this as a premium policy to deliver once clients start requesting for it.
Outsourcing of Information Security services
Information Security specialist skills are limited in many companies. With the ever-changing threat landscape and the need for 24/7 monitoring and response on technological platforms especially in financial institutions, organizations will need to continually invest more in implementing additional security infrastructure, security training for their personnel and active recruitment for currently skilled professionals. There is a high likelihood that more organizations may choose to outsource their information security function rather than investing heavily in a cyber-intelligence center. For companies that are willing to keep things in-house they will be constrained to explore tools and techniques that have capabilities for machine learning/artificial intelligence to prevent, detect, predict and respond to cyber threats in order to improve their cyber incident response capabilities.
The unending battle in cyberspace continues, criminal actors, policy makers, ethical hackers, innocent bystanders have all been drawn into a battle. Each second lays the plane for a new battle field. Let’s see what 2016 brings.
I wish you a cyber-prosperous New Year.
Tope S. Aladenusi
Aladenusi is a Partner at Deloitte Nigeria.
