By Tendai Makaripe
ON Tuesday, December 15, 2020, Google services, including YouTube, Google Meet, Hangouts, Google Maps, Google Docs, Google Drive, and Google Calendar, went offline in a huge outage that lasted for about 40 minutes.
There was widespread panic among users across the world, particularly those in the United States of America (USA) with some fearing a security breach.
Security experts like Will Geddes speculated that Google may have been sabotaged by hackers.
“The attack was initially targeted against the USA. There are several US federal departments and organisations that have also been attacked,” said Geddes in an interview with talkRADIO’s Mike Graham.
“So this is quite concerning. This could be the 9/11 of cyber hack attacks. It could be possibly a state actor is behind it.”
Google later issued a statement downplaying hacking fears, noting that they had “experienced an authentication system outage… due to an internal storage quota issue,” but experts felt the internet services giant was trying to manage the situation.
Cases of hackers breaching security systems, manipulating them for financial gain among other reasons, have been a global problem for a long time.
In November last year, United Kingdom (UK) based football club, Manchester United’s Information Technology (IT) systems were affected by a cyber-extortion attack.
The hacker logged into the club’s scouting system, targeting its confidential information on transfer targets and scouting missions while disabling the email system.
These situations are not restricted to the western world only but are replayed in many localities across the globe.
Zimbabwe’s insurance and pensions sector is no exception.
Players in the industry are not only confronted by the challenge of balancing business with growing health concerns related to COVID-19 but the reality that their cybersecurity protocols will be tested like never during this pandemic period.
The Insurance and Pensions Commission’s (IPEC’s) Circular 8 of 2020 requested that companies resort to having skeletal staff at their premises for the provision of necessary services while the rest shift to remote working.
Remote working conditions are associated with risks like phishing scams, ransomware, and other risks and breaches.
Mindful of the risk associated with remote working, the Global Cyber Centre of New York joined hands with Cyber Ladies, the Israeli Economic Mission to North America, and Perimeter 81 to hold the first cybersecurity virtual event in which hazards of remote work and solutions for seamlessly securing organisational networks were discussed.
Unfortunately, little has been done in the Zimbabwean context to come up with an idea-sharing platform where players help each other fight the imminent danger.
Life Offices Association of Zimbabwe director, Reginald Chihota is wary of the impending challenge.
“Remote working that is currently so widespread is likely to prompt a rise in hacking attempts by terrible actors seeking to exploit vulnerabilities for various purposes such as to get customer data, siphon off financial information, or disrupt services,” he said.
A survey by newzimbabwe.com revealed that Zimbabwe’s insurance and pensions sector is sitting on a time bomb as most of their systems are not robust enough to fend off the risk posed by hackers or a myriad of challenges that might arise because of remote working.
Insurance expert, Innocent Tinarwo also bemoaned the lack of adequate preparedness among insurance companies as far as cyber protection is concerned.
“I know that a lot of companies, not just insurance companies, are sitting on a time bomb because most of their systems are not 100 percent protected, and having one that is full proof in terms of cyber-attacks is expensive to run and maintain.Investing in robust systems will also be pushed down to the customer, which will make insurance products expensive,” he said.
“So companies can only do so much to protect their data but the danger of not investing in system protection can be devastating particularly to companies that store confidential information like medical aid societies, hospitals, and insurance companies among others.”
Companies have a fiduciary role to protect the privacy of client information from hacking because the effects can be detrimental.
Analyst, Fortune Nyamusa, concurred with Tinarwo, saying the movement to a work-from-home context meant that employers inherited the security risk of their employees’ personal home network.
“Traditionally, the focus was on securing organisational assets, but now employers have to ensure the security of remote work environments.
“This is because, in the office environment, we have IT managers who are mandated with controlling the security of all WiFi networks; in the home setting, employees’ home networks possibly have weaker protocols. Hackers get easier access to the network’s traffic in such cases,” he said.
Nyamusa further said company machines have better and advanced software applications installed on them compared to home networks.
“The danger here is that an employee’s personal device opens up novel information about the private life of the user to hackers; this might include information related to social security, tax information, and bank accounts,” he added.
Another challenge that can allow hackers to crack into home networks is the use of simple passwords by employees in the home setting.
Using simple passwords across several platforms allows hackers to gain unauthorized access to multiple accounts in a brief period.
While there are a few companies with good cyber and network security systems in place, a number appear ignorant of the actual risks involved in connecting remotely and what they should do to solve the looming challenge.
The few financially powerful companies have created Virtual Private Network (VPN) systems that they authenticated to ensure maximum security.
Cybersecurity expert, Sivan Tehila has misgivings regarding VPN systems.
“Employers should discard hardware-based legacy VPNs in favour of cloud-agnostic and scalable network security solutions,” said Tehila.
“Legacy VPNs can leave gaping holes in your remote security efforts, as they are difficult to deploy and configure. They also lack the ability to effectively secure policy-based remote access to on-premises resources, hybrid cloud environments, and business applications,” she added.
Local insurance and pensions players are also at risk of phishing scams because of their less robust systems.
Phishing simply refers to the fraudulent attempt to get sensitive data or information such as usernames, passwords, and credit card details by impersonating oneself as a trustworthy entity in digital communication.
“Phishing attacks are behind most data breaches because the deceptive emails, malicious links, or attachments that they send can easily hoodwink an employee and give the hacker access to his or her device,” said IT expert Mike Sakupwanya.
“This can cause the breach of client confidential information, and while there are insurance products that cover insurance companies if they are breached, the company will naturally lose public trust.
“No one would want to do business with an organisation that they cannot trust with their information.”
Digital transformation consultant and business development manager of ZimSelector.com, Zelina Francis said local industry regulators should play a key role in accelerating the pace at which organisations in insurance and other sectors put in place robust security protocols.
“It is worth encouraging regulators to take a cue from global watchdogs that have asked insurance and other industry chiefs difficult questions about their cyber resilience position and levying heavily punitive fines to organisations that suffer avoidable breaches, compromising customer data, service, or funds,” said Francis.
While one appreciates that the cost of setting up an efficient cybersecurity system is expensive, players in the insurance and pensions sector have to grab the bull by the horns lest the ticking time bomb they are sitting on explodes!
