I remember when life was so ‘simple’. TV was black and white- no ‘technicolours’, plasma, LCD and OLED! We went to the bank, our branch, and gave the teller a piece of paper showing our names and account numbers to get our account balances. We could frown and utter a few words in disbelief aimed at the teller if we did not agree with the amount, though this hardly ever happened.
There were no ATMs. Tellers were humans who worked in the banking hall. Payments were done in cash or cheque (and sometimes a banker’s draft). Mobile phones were rare not to talk of mobile money. Those were the days where cash was truly king.
Globalization and advances in technology have changed our world. Fintech has and continues to develop, bringing with it many innovations that afford us convenience. Unfortunately, as fintech and telecommunication have grown, so have vices that people employ for nefarious activities. There has been a proliferation of cybersecurity threats in both developed and developing economies. The harm these can cause is not lost on any professional who has interfaced with large volumes of data or information.
Cyber security has grown into a significant topic today. Almost every organization is affected in one way or the other and many companies have big budgets for risks, cybersecurity and mitigation. As some have worked on reducing its impact on businesses, some unscrupulous persons continue to design programmes that can wreak havoc and set an organization back. What really is cyber security?
Cybersecurity or cyber security? Well, here is the answer: American style tends to favor cybersecurity as one word while British style often uses cyber security as two words – cyber security. But the definitions don’t really waver. Cybersecurity and cyber security have the same meaning.
The term is defined differently by different institutions in the information technology industry. Kaspersky, global cyber security company founded in 1997, defines cybersecurity as the practice of defending computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. Also known as information technology security or electronic information security, it is the techniques of protecting computers, networks, programs and data from unauthorized access, criminal use or attacks that are aimed for exploitation.
The term applies in various contexts, from business to mobile computing, and can be divided into a few common categories, as seen below:
- Network security- the practice of securing a computer network from unauthorized access, whether targeted and purposeful attackers or just opportunistic malware.
- Application security- the focus is on keeping software and devices free of threats. A compromised application could provide access to the data it is designed to protect. Successful security begins in the design stage, well before a program or device is built and deployed.
- Information security assures and protects the integrity and privacy of data, both in storage and in transit.
- Operational security includes the processes and decisions executed for handling and protecting data and information assets. The permissions users have when accessing a network and the laid down procedures that determine how and where data may be stored or shared all fall under operational security.
- Disaster recovery and business continuity- these define how an organization responds to a cybersecurity event or any other incidence that causes the loss of operations or data. Disaster recovery plans and policies dictate how the organization restores its operations and information to return to the same operating capacity as before the event as quickly and as safely as possible. Business continuity is the plan an organization falls back on and implements while trying to operate without certain resources.
- End-user education addresses risks from the most unpredictable cybersecurity factor: people. Anyone can accidentally introduce a virus to an otherwise secure system by failing to follow good security practices. Therefore, teaching users prudent data handling practices: delete suspicious email attachments, do not plug in unidentified or suspicious drives, and various other important lessons is vital for the security of any organization.
The risks of having poor cybersecurity are numerous. Some are more serious than others. Among these dangers are malware erasing our entire system, a hacker breaking into our system with malicious intent and altering files, an attacker using our computer (thus masking their identity) to attack others, or an attacker stealing sensitive information like our credit card information and making unauthorized purchases. It is true that here is no guarantee and that, even with the best precautions, some of these things could happen to us. Nevertheless, there are steps that can be taken to increase security and minimize the chances.
Risks are usually from three sources:
- A Hacker, attacker, or intruder, a person who seeks to exploit weaknesses in software and computer systems for personal gain. Although the intentions are sometimes benign and motivated by harmless curiosity, the resultant actions are typically in violation of the intended use of the systems. They can range from mere mischief (creating a virus with no intentionally negative impact) to malicious activity (stealing or altering information).
- Malicious code – Malicious code (also called malware) is unwanted files or programs that can cause harm to a computer or compromise data stored on a computer. Various classifications of malicious code include viruses, worms, and Trojan horses. Malicious code may require you to actually do something before it infects your computer, like opening an email attachment for ‘a gift of a lifetime’ or going to a particular webpage. Some forms of malware spread without any user intervention and typically start by exploiting a software or system vulnerability. Once the victim computer has been infected, the malware will attempt to find and infect other computers in the same network. This malware can also propagate through email, websites, or network-based software. Often, malware claims to be one thing, while in fact doing something different behind the scenes. For example, a program that claims it will speed up your computer may actually be sending confidential information to a remote attacker.
- Vulnerabilities – Vulnerabilities are flaws in software, firmware, or hardware that can be exploited by an attacker to perform unauthorized actions in a system. They can be caused by software programming errors which give access to attackers. Attackers take advantage of these errors to infect computers with malware or perform other malicious and unsolicited activity.
Safeguards & Best Practices
How then, do we guard against these threats and vicious attacks? There are a few basic cyber security best practices we can observe. Most are not expensive to incorporate, whereas they could save us a significant amount of money, time and reputation.
- Constantly update software. This ensures that software patches which would prevent attackers from taking advantage of vulnerabilities or other issues are installed. A number of software programs incorporate the option of automatic updates. It is usually advisable to enable this option.
- Run up-to-date antivirus software. This is an important protective measure against known malicious attacks. When the automatic virus definition on the antivirus programme is enabled, maximum protection against the most current viruses can be achieved.
- Change default usernames and passwords. Programmes and apps usually provide usernames and passwords for initial access. This can and should be changed immediately to a sufficiently strong and unique password.
- Use strong passwords that will be difficult for an unauthorized person to guess or figure out.
- Implement a multi-factor authentication (MFA)- a process for validating a user’s identity and authorization. Beyond the username and password, one other two other verification means can be used. For instance, a secret question with a secret answer can be used.
- Use a firewall. This restricts unnecessary outbound linkages and blocks malicious software before they can enter a system to cause havoc.
- Be suspicious of unusual emails and messages. Phishing emails are one of the most prevalent among the risks. Attachments to such emails should not be opened, as much as practicable.
Businesses can stay safe and continue with these. The importance is mostly felt when disaster strikes and the organization is least prepared. Technology, information and data management support businesses today. Staying cyber secure therefore becomes a must for all.
In subsequent publication will be focus on the cyber security ecosystem in Ghana and how it pertains to the operations of entities in the financial service sector.
ABOUT THE AUTHOR
Through his writings Kwadwo has discovered his love and knack to simplify complex theories spicing them with everyday life experiences for the benefit of all. The Head of OctaneDC Research, Kwadwo Acheampong, has over a decade experience in fund management and administration, portfolio management, management consulting, operations management and process improvement. Feel free to send him your feedback on his article. Email: [email protected]
Cell: +233244563530
