Cybercrime in South Africa has increased drastically, costing 0.14 percent of GDP or around R5.8 billion between 2013 and 2014, according to McAfee’s Global Cost of Cybercrime Report. Tackling this threat to our country needs a collaborative approach between the public and private sector armed with the right technology and public education.
In The South African Cyber Threat Barometer, Craig Rosewarne, MD of Wolfpack Information Risk explains: “Government cannot combat crime alone, and key partnerships across multi-industries in South Africa are vital to our country’s success going forward.”
According to Rosewarne, both Government and private institutions have a role to play in addressing cybercrime. The results of which can be used to initiate policies and guidelines to prevent similar attacks in the future. Such insights could help us upgrade our security systems for improved monitoring and analysis – an area currently needing some specialized ‘TLC’.
An interesting bellwether in this government-private landscape is the U.S. Earlier this year, Barack Obama announced his new, intensified stance regarding the management of cybersecurity, which outlines standards that companies operating infrastructure should follow in order to protect from cyberattacks. This executive order has sparked debate around the world – including in South Africa. The US is now focusing on developing an order that will make it easier for private companies to share information about cyberattacks with the government, which will ensure a safe and accessible way to highlight a threat before it hits elsewhere.
In South Africa, the threat is beginning to be taken seriously by the government as well. However, even though the South African Police Service has introduced an electronic crime unit, it acknowledges that there is a lack of awareness and education about the risks associated with cybercrime in general, as well as the importance of reporting suspicious cybercrime activities.
The South African Cyber Threat Barometer points out a number of collaborative initiatives that need to be considered in the South African context. To start, government, with the support of a team of private sector collaborators, needs to implement relevant cybercrime and identity theft legislation to officiate the rules on what is actually punishable. The next step is to pool all the available resources, both public and private sector, and form a united front of cybercrime warriors with clear roles and methods for collaboratively fighting the problem.
Of course, every superhero unit needs financial backing, and though some efforts have been made in the past, government still needs to place cybercrime nearer the top of its priority list. Perhaps with some encouragement from the private sector, the government will pull out ‘the big guns’ and increase their focus on improving the policies and units we already have in place as well as develop new bodies to address the issue.
While this happens, Mimecast will continue to play its part in protecting customers from the threats they face and educating the wider market about the risks and steps we can all make to mitigate them, and by doing so, better protect ourselves, and our wider economy and society.
For more information on Mimecast’s email security, please click here and download our solution brief.
Email wasn’t designed for sending sensitive or confidential information yet it remains the most common form of communication in business. Meanwhile, traditional approaches to encryption have been costly and complex.
Credit card details, personal identifiable information and financial data are regularly put at risk when shared over traditional email services.
The result has been that employees regularly disclose sensitive, personal or confidential information to the outside world – often by accident but sometimes even maliciously. The price is the loss of business reputation, valuable intellectual property and customer confidence. Not to mention the risk of potentially expensive legal action.
This is why today we’re announcing the launch of Mimecast Secure Messaging. This new service is designed to help employees confidently send and receive sensitive or confidential information via email.
Recipients access messages via a secure Web portal, fully customized and branded with the sender’s company name, colors and logo – helping ensure brand recognition and recipient confidence.
Here are just three scenarios where Secure Messaging would make a difference:
Secure Messaging is part of Mimecast’s wider cloud email security suite; working alongside gateway, DLP and content controls to help organizations meet compliance regulations, including PCI-DSS, HIPAA and GLBA.
Email security is an essential part of your overall security strategy. It protects users from new and emerging email threats and enforces security controls on information flows. Technologies including anti-virus and anti-spam cover the external threats, but you must also enforce controls on the email flow from within your organization.
In the wake of continued high-profile data breaches, email users now expect to see a higher level of protection to be confident that appropriate measures have been taken to safeguard their sensitive data.
Consider the emails that your organization sends to customers, suppliers and prospects. Will your recipients be satisfied by your security approach?
The U.S. healthcare industry is the latest victim in a series of massive cyber-attacks. Most recently, Premera Blue Cross, a not-for-profit insurance provider, underwent a cyber-hack that reportedly exposed the medical and financial information of 11 million members. Last month, Anthem, the nation’s second-largest health insurer, was the target of one of the biggest data breaches ever reported, with cyber-attackers gaining access to the medical records, social security numbers, income data and home addresses of as many as 80 million members.
This string of targeted data breaches proves that no industry is safe from the attention of cyber criminals. And now, more than ever, email security should be top-of-mind for all organizations.
The healthcare industry, in particular, has a unique set of challenges to consider when it comes to IT infrastructure – specifically, email security. Budget is a known hurdle, as most healthcare organizations have allocated the majority of their IT dollars to improving systems to manage electronic patient records and systems to meet Healthcare Insurance Portability and Accountability Act (HIPAA) compliance.
The focus and spend on systems to support HIPPA compliance coupled with little-to-no IT resources means data security often isn’t prioritized. The economics of this decision are changing. The Target breach settlement of $10 million, in response to a class action suit, will likely open the doors for similar class action suits against other major organizations with large-scale breaches.
It is important to remember that healthcare information is one of the most personal and sensitive types of data – people care deeply about who can access this. There is a high expectation that healthcare data is protected, and this expectation is often held to a higher standard when compared to other industries.
Today’s sophisticated attacks combine social engineering and spear-phishing to penetrate organizations’ networks and steal critical data. Most of the major data breaches that have occurred over the past year have been initiated by this type of threat. The only defense against this level of attack is a layered approach to security. Email security solutions that might have been adequate several years ago often lack features to protect against these spear-phishing attacks.
By following these easy steps, email security no longer has to be costly or complex for the healthcare industry. Make sure you have:
- Broad Spectrum Email Security: Malware protection needs to go beyond email attachments and include the destination of any embedded email. Effective spear phishing protection needs to happen at the time of the user click to ensure that malicious sites are identified based on the browser platform being used.
- Transport-level Encryption: Emails should be encrypted during transmission between email servers to provide protection from interception.
- Secure Webmail: The most secure approach is some form of secure webmail delivery, in which the message is stopped at the gateway. The recipient of the email gets a delivery notification with a link that is used to access the original email. Secure webmail delivery solutions typically require a password to access the email which adds another layer of security to message access, giving worried doctors peace of mind. Ideally, the solution will also track recipient access.
Half the problem with protecting your enterprise from every hacker, phisher, visher and botnet herder is the helpful part of human nature, that wants to be…helpful. We’ve known for a very long time that the vast majority of successful cyber-attacks rely on this helpfulness to achieve their goal. We know that social engineering plays a significant role in these attacks, from the most complex right down to the most ‘mundane’ phishing email; and our attackers know this too.
I sense that enterprise cyber security has reached a turning point that will solve this problem.
For years, we’ve been talking about the de-perimeterization of the network, as end users and cloud services make the corporate firewall less relevant. CIOs and IT Managers I’ve spoken to have long been trying to shoe-horn their existing cyber-security into this new model, but have been losing the battle. The ubiquitous nature of connectivity and mobile computing was not so much the straw for this poor camel, but the entire haystack.
So, this is where I sense a pivot occurring, in the way we think about enterprise cyber-security; one that leaves those legacy ideas on the LAN and introduces a more task-orientated set of security rules. Rules that consider how the humans’ use our enterprise services and how those same humans are exploited. And importantly, rules that change the game in our favor, as opposed to the business-as-usual cyber security arms race we suffer under.
Of course, security professionals have been asking for more training for their human users since the dawn of the ILOVEYOU virus, but sadly this has always been low on the priority list for the budget controllers in businesses.
Security and IT professionals also know there is no single technology solution that will protect humans either. Sadly, until very recently, that’s about as far as the conversation went. Enough budget would be allocated for ‘reasonably regular’ (i.e. every six months, if you’re lucky) security training – and we’d all cross our fingers that no one would do anything stupid.
But they did, and they still do. Humans click links, especially in emails, and there’s no way of stopping them from doing that. So we’ve begun to learn that a new approach is needed here. An approach that is the foundation to the wider pivot I mentioned above. If technology can’t completely help us, and in isolation security training isn’t effective anymore—maybe the answer is in the last place we would have looked a few years ago? In the humans.
It’s after all our users who have become the front line for attackers looking to gain access to your network and we know this is because the humans are easier to hack than the code they write. So instead of constantly hardening our code and infrastructure why don’t we start to harden our humans?
Invoke a Human Firewall to help protect our businesses and de-fang the threats that target them. We know that our routine security training doesn’t work and we know our technology is less effective—so why not use the technology to help train users in a more real-time manner, or at the point of click in an email. Subtly warn them they might be able to experience something malicious, and block them if it does turn out to be a watering-hole or drive-by attack. But help them understand the risks, educate them constantly and in new and exciting ways, not once or twice a year in traditional training session.
It’s only when you start to get humans thinking for a fraction of a second longer than normal before performing a task, running an attachment or clicking a link, have you started to drive a behavior change in them. It’s this behavior change that we need to encourage, one that makes them a tiny bit suspicious of those emails that look ever so slightly odd, one that means they’re more aware than we could have ever hope for.
This behavior change is what invokes your human firewall, it’s the only way you’ll protect your humans from themselves, and it’s the only way we might be able to solve our cyber-security woes.