BSc (Hons) Cyber Security
The rapid digitisation of consumers’ lives and enterprise records has led to a significant rise in cybercrime. According to Purplesec, “The global annual cost of cybercrime is estimated to be $6 trillion per year, and on average, a malware attack costs a company over $2.5 million (including the time needed to resolve the attack[1]”. This has gravely threatening individuals, corporations and government agencies. Thus, in January 2018, the World Economic Forum placed cyber-attacks in the top three global risks for the year[2].
Cyber-criminals are conducting more frequent attacks ranging from destructive ransomware, data breaches, IoT botnets and mobile malware to sophisticated multi-vector technologies. It is evident that we are witnessing a new generation of cyber-attacks. Security vulnerabilities in both hardware and software applications are being exploited by cyber-criminals weaponising ransomware continuously to extort money and cripple large institutions.
As some of you may be aware, The Gambia Central Bank (https://www.cbg.gm/) suffered a malware attack resulting in a data breach and “allegedly stole 2TB (terabytes) of highly sensitive data, involving personal and confidential information relating to employees, customers, and the management of the bank. The hack allegedly happened on the evening of Sunday, November 13th, 2022”[3].
This has not come as a surprise to most security experts. For far too long, organisations, government institutions, and private companies have disregarded and underspent on cyber security. A significant number of companies in The Gambia are vulnerable to an attack. Hence we need to take a proactive approach in dealing with cyber security related matters. It is high time for all organisations to conduct a security review of their Infrastructure and remediate the findings.
Now that the issue of the central bank is in the public domain, cybercriminals will start targeting other institutions in the country. Furthermore, there is a great possibility that other companies might be compromised without their knowledge. Thus, IT managers and Chief Information Security Officers (CISOs) should review their security controls immediately.
The list below includes security measures that could help organisations reduce their attack surface.
- Decommission or upgrade all legacy systems (Windows Server 2008, Windows XP,7).
- Conduct regular (yearly) Penetration test and remediate all findings.
- Implement Microsoft Advanced Threat protection anti-virus.
- Implement Multi-Factor Authentication (MFA) across your platforms.
- Segregate internal network.
- Avoid utilising unsupported applications.
- Ensure that Admin Portals are not accessible for the internet.
- Implement password policy and provide password management tools for all employees.
- Implement Information Security Policy and provide yearly Information security Training to all employees.
- Do not allow Bring your own device (BYOD) without adequate policy and controls in place.
Author: Bamba Mbye , Cyber Security Consultant at FSP.
Hons degree in Cyber security
[1] https://purplesec.us/resources/cyber-security-statistics/#:~:text=The%20global%20annual%20cost%20of,than%20it%20was%20in%202015.
[2] https://www.weforum.org/agenda/2019/01/biggest-global-risks-facing-our-world/
[3] https://www.kerrfatou.com/breaking-news-central-bank-hacked/
Please inform us latest Tuesday 22nd November of your approval to cover the event. That is to avoid any difficulties before the event.