Hacking yourself must become the norm

Issue 3 2021 Cyber Security

With the Protection of Personal Information Act (PoPIA) coming into full effect in July 2021 and bringing with it the threat of financial and reputational damages for organisations that are found to be in contravention, businesses need to take a more proactive approach toward cybersecurity, including ongoing penetration testing and continuous refinement of policies and procedures around dealing with personal information.

Richard Frost.

In a digital age where businesses are more reliant on online and cloud services to interact and engage with customers and even sell their products and services, the impact to organisations and the rewards to threat actors in bringing down or breaching these services are increasing rapidly. Not only are the threats increasing daily, but they are also becoming more dynamic and growing in complexity. This can leave defence technologies - which are by nature more static than the evolving threat landscape - exposed.

The breaches have been growing in number, with more businesses around the globe being targeted and the personal information of tens of thousands or even millions of individuals being compromised. In the past, such was often greeted with uproar and indignation from consumers, only for the story to fade away over a matter of weeks. This has been changing locally and abroad; the implementation of data privacy regulations in the US, UK and EU have seen large corporations being penalised for the loss of customer data during breaches, including British Airways, Equifax, Google, Uber and Yahoo amongst others.

Similarly, the PoPI Act states that organisations must take appropriate measures to protect personal information against unlawful access or processing, as well as loss, damage, or unauthorised destruction. In a nutshell, it is all about first getting consent from an individual and then putting in place policies, procedures and technologies to ensure proper protection and confidentiality of personally identifiable information, from point of capture to transmission, processing and storing.

Non-compliance can result in the Information Regulator imposing sizeable penalties of up to R10 million, imprisonment of up to 10 years, or even both. Worse than the financial impact (which larger companies might be able to cough up), is the reputational damage, with the act requiring affected organisations to publicly acknowledge breaches, disclose what was affected and more, putting their brand in a bad light.

Considering that network and data breaches now go beyond the realm of technical challenges and into having a financial implication for businesses, what can they do to better protect themselves? Organisations will have to be more diligent in identifying all their assets, looking at where and how data is stored, discovering what information sits on every system across your organisation (what about confidential data stored on employee laptops and not on secure shared drives?) and more. Systems are also continually changing as updates are rolled out and controls and policies need to be put in place to keep track of all information.

Making ongoing testing the norm

As such, rather than just implement measures and hope it does the work, it is becoming increasingly important for organisations to carry out regular penetration tests to uncover exploitable vulnerabilities and identify the impact to the business – before a hacker does. Ongoing testing militates against future issues, provides assurance of the security of a system, evaluates how a potential threat actor could gain access, prioritises gaps to be dealt with and to be better equipped to protect themselves against cyber-attacks.

Organisations should turn to partners who fully understand the requirements of regulation such as PoPIA, as well as cybersecurity, data privacy and more, as well as use trusted methodology – tailored to meet the customer’s environment – that takes into account guidelines from sources such the Open Web Application Security Project (OWASP), Payment Card Industry (PCI), MITRE Attack Framework and the Technical Guide to Information Security Testing and Assessment. At the very least, these tests should encompass the following:

• Gathering publicly available information using sources such as search engines and websites to map out an organisation’s public footprint and point out areas of concern.

• Network scanning, performing automated sweeps of IP addresses of systems provided and discovered from on-network and off-network sources.

• System profiling to identify operating systems and version numbers running on the system for further testing.

• Service profiling to identify services and applications running on systems, as well as their version numbers for further testing.

• Vulnerability identification, validation and exploitation: potential vulnerabilities are identified and validated to minimise errors (false reports of problems). This involves attempts to exploit the found vulnerability.

There is also a growing need to drive awareness around PoPIA, as has been stipulated by the act, in order to build familiarity with the regulation and to ensure that employees working with personally identifiable information are fully aware of what is required from them. It goes beyond just one act however and organisations need to use non-technical language so that employees are clearly aware of the sensitivities around working with such data, as well as the dangers of storing such data on unsecured personal devices.

This has become especially critical in an age of remote working, so that organisations can ensure that confidential data is only accessible by authorised persons and put in place the necessary policies and procedures to ensure that such information is only stored to the organisation’s secured and shared storage space – be it a data centre or a cloud service. With PoPIA in full effect, not getting this right has become an exceedingly costly proposition for business.

For more information contact Vox, +27 87 805 0000, info@voxtelecom.co.za, www.vox.co.za


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Protecting business from ransomware at the edge
Issue 4 2021 , Cyber Security
It might not always be possible to prevent ransomware from infecting remote networks, however, a robust backup and disaster recovery strategy can get the business back on track if systems are locked down.

USBs threats are back
Issue 4 2021 , Cyber Security
Kaspersky has uncovered a rare, wide-scale advanced persistent threat (APT) campaign; initial infection occurs via spear-phishing emails containing a malicious Word document and can then spread to other hosts through removable USB drives.

Incedo consolidates its cybersecurity defence
Issue 4 2021 , Cyber Security
Check Point Software´s end-to-end solution safeguards Incedo and its customers from a global spike in cyberattacks, while reducing costs and increasing productivity.

Top 10 security misperceptions
Issue 4 2021 , Cyber Security, Security Services & Risk Management
The Sophos Rapid Response team has compiled a list of the most commonly held security misperceptions they’ve encountered in the last 12 months while neutralising and investigating cyberattacks in a wide range of organisations.

Top cybersecurity considerations for SMEs in 2021
Issue 3 2021 , Cyber Security, News
Cisco has published its 2021 SMB Security Outcomes Study, highlighting what SMB leaders are doing to thrive in today's ever-evolving threat landscape, as well as offering actionable insights on where they should focus.

Local cyber is global
Issue 4 2021 , Cyber Security
Understanding the risks and how cybercriminals implement their attacks allows Performanta to prepare customers for a proactive security posture against these threats.

Cybersecurity in the physical security world
Issue 4 2021, Technews Publishing, Milestone Systems, Axis Communications SA, AVeS Cyber Security, Vox , Editor's Choice, Cyber Security, Integrated Solutions, IT infrastructure
Hi-Tech Security Solutions, in partnership with Milestone Systems, hosted a round table discussion to find out about the trends and realities and the importance of cybersecurity in the physical security and IoT world.

Design for the users, not against them
Issue 4 2021 , Editor's Choice, Cyber Security, IT infrastructure
Security is an evolving process, a liquid and malleable evolution that engages with user, technology and system to ensure absolute security coherence, says Henk Olivier, MD of Ozone Information Technology Distribution.

Automation and AI in security
Issue 4 2021 , Editor's Choice, Cyber Security, Commercial (Industry)
It’s important for businesses to have an internal strategy for automation and AI as these can relate to both cybersecurity and other parts of the business and provide a benchmark for evaluating the security vendor.

Secure-by-design and secure-by-default
Issue 4 2021, Regal Distributors SA , Cyber Security
“How can you make sure your video device manufacturer lives up to all their cybersecurity promises?” asks Fred Streefland, director of cybersecurity at Hikvision EMEA.