Hacking yourself must become the norm

Issue 3 2021 Information Security

With the Protection of Personal Information Act (PoPIA) coming into full effect in July 2021 and bringing with it the threat of financial and reputational damages for organisations that are found to be in contravention, businesses need to take a more proactive approach toward cybersecurity, including ongoing penetration testing and continuous refinement of policies and procedures around dealing with personal information.

Richard Frost.

In a digital age where businesses are more reliant on online and cloud services to interact and engage with customers and even sell their products and services, the impact to organisations and the rewards to threat actors in bringing down or breaching these services are increasing rapidly. Not only are the threats increasing daily, but they are also becoming more dynamic and growing in complexity. This can leave defence technologies - which are by nature more static than the evolving threat landscape - exposed.

The breaches have been growing in number, with more businesses around the globe being targeted and the personal information of tens of thousands or even millions of individuals being compromised. In the past, such was often greeted with uproar and indignation from consumers, only for the story to fade away over a matter of weeks. This has been changing locally and abroad; the implementation of data privacy regulations in the US, UK and EU have seen large corporations being penalised for the loss of customer data during breaches, including British Airways, Equifax, Google, Uber and Yahoo amongst others.

Similarly, the PoPI Act states that organisations must take appropriate measures to protect personal information against unlawful access or processing, as well as loss, damage, or unauthorised destruction. In a nutshell, it is all about first getting consent from an individual and then putting in place policies, procedures and technologies to ensure proper protection and confidentiality of personally identifiable information, from point of capture to transmission, processing and storing.

Non-compliance can result in the Information Regulator imposing sizeable penalties of up to R10 million, imprisonment of up to 10 years, or even both. Worse than the financial impact (which larger companies might be able to cough up), is the reputational damage, with the act requiring affected organisations to publicly acknowledge breaches, disclose what was affected and more, putting their brand in a bad light.

Considering that network and data breaches now go beyond the realm of technical challenges and into having a financial implication for businesses, what can they do to better protect themselves? Organisations will have to be more diligent in identifying all their assets, looking at where and how data is stored, discovering what information sits on every system across your organisation (what about confidential data stored on employee laptops and not on secure shared drives?) and more. Systems are also continually changing as updates are rolled out and controls and policies need to be put in place to keep track of all information.

Making ongoing testing the norm

As such, rather than just implement measures and hope it does the work, it is becoming increasingly important for organisations to carry out regular penetration tests to uncover exploitable vulnerabilities and identify the impact to the business – before a hacker does. Ongoing testing militates against future issues, provides assurance of the security of a system, evaluates how a potential threat actor could gain access, prioritises gaps to be dealt with and to be better equipped to protect themselves against cyber-attacks.

Organisations should turn to partners who fully understand the requirements of regulation such as PoPIA, as well as cybersecurity, data privacy and more, as well as use trusted methodology – tailored to meet the customer’s environment – that takes into account guidelines from sources such the Open Web Application Security Project (OWASP), Payment Card Industry (PCI), MITRE Attack Framework and the Technical Guide to Information Security Testing and Assessment. At the very least, these tests should encompass the following:

• Gathering publicly available information using sources such as search engines and websites to map out an organisation’s public footprint and point out areas of concern.

• Network scanning, performing automated sweeps of IP addresses of systems provided and discovered from on-network and off-network sources.

• System profiling to identify operating systems and version numbers running on the system for further testing.

• Service profiling to identify services and applications running on systems, as well as their version numbers for further testing.

• Vulnerability identification, validation and exploitation: potential vulnerabilities are identified and validated to minimise errors (false reports of problems). This involves attempts to exploit the found vulnerability.

There is also a growing need to drive awareness around PoPIA, as has been stipulated by the act, in order to build familiarity with the regulation and to ensure that employees working with personally identifiable information are fully aware of what is required from them. It goes beyond just one act however and organisations need to use non-technical language so that employees are clearly aware of the sensitivities around working with such data, as well as the dangers of storing such data on unsecured personal devices.

This has become especially critical in an age of remote working, so that organisations can ensure that confidential data is only accessible by authorised persons and put in place the necessary policies and procedures to ensure that such information is only stored to the organisation’s secured and shared storage space – be it a data centre or a cloud service. With PoPIA in full effect, not getting this right has become an exceedingly costly proposition for business.


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

New ransomware using BitLocker to encrypt data
Technews Publishing Information Security Residential Estate (Industry)
Kaspersky has identified ransomware attacks using Microsoft’s BitLocker to attempt encryption of corporate files. It can detect specific Windows versions and enable BitLocker according to those versions.

Create order from chaos
Information Security
The task of managing and interpreting vast amounts of data is akin to finding a needle in a haystack. Cyberthreats are growing in complexity and frequency, demanding sophisticated solutions that not only detect, but also prevent, malicious activities effectively.

Trend Micro launches first security solutions for consumer AI PCs
Information Security News & Events
Trend Micro unveiled its first consumer security solutions tailored to safeguard against emerging threats in the era of AI PCs. Trend will bring these advanced capabilities to consumers in late 2024.

Kaspersky finds 24 vulnerabilities in biometric access systems
Technews Publishing Information Security
Customers urged to update firmware. Kaspersky has identified numerous flaws in the hybrid biometric terminal produced by international manufacturer ZKTeco, allowing a nefarious actor to bypass the verification process and gain unauthorised access.

Responsible AI boosts software security
Information Security
While the prevalence of high-severity security flaws in applications has dropped slightly in recent years, the risks posed by software vulnerabilities remain high, and remediating these vulnerabilities could hinder new application development.

AI and ransomware: cutting through the hype
AI & Data Analytics Information Security
It might be the great paradox of 2024: artificial intelligence (AI). Everyone is bored of hearing it, but we cannot stop talking about it. It is not going away, so we had better get used to it.

NEC XON shares lessons learned from ransomware attacks
NEC XON Editor's Choice Information Security
NEC XON has handled many ransomware attacks. We've distilled key insights and listed them in this article to better equip companies and individuals for scenarios like this, which many will say are an inevitable reality in today’s environment.

iOCO collaboration protection secures Office 365
Information Security Infrastructure
The cloud, in general, and Office 365, in particular, have played a significant role in enabling collaboration, but it has also created a security headache as organisations store valuable information on the platform.

Cybercriminals embracing AI
Information Security Security Services & Risk Management
Organisations of all sizes are exploring how artificial intelligence (AI) and generative AI, in particular, can benefit their businesses. While they are still figuring out how best to use AI, cybercriminals have fully embraced it.

Surveillance on the edge
Axis Communications SA Guardian Eye Technews Publishing Surveillance
Edge processing, a practical solution that has been available for some time, has proven its utility in various scenarios, tailored to the unique requirements of each user.