As the nation accelerates towards digitalisation of public infrastructure and e-governance, safeguarding sensitive data and ensuring the uninterrupted functioning of vital agencies becomes paramount. Cybersecurity and other digital threats are virulent and increasingly sophisticated to detect in real-time, calling for automation and innovations in dealing with these attacks.
Kenyan businesses, corporations and individuals have become victims of expensive ransomware payouts, cryptomining attacks and massive data leaks of sensitive information to hackers.
According to a cyber security report by Serianu, Kenya lost approximately Sh 21.2 billion to cybersecurity in 2022, second only to Nigeria which lost Sh65.5 billions, with financial institutions most affected.
Cyber attacks rose by nearly 50 per cent in the last six months of 2023 compared to a similar period the previous year. The Communications Authority of Kenya data shows that more than 60 million cyber threats were detected nationwide in comparison to 37.1 million in 2021.
Over the past six months alone, Naivas supermarket, Kenya Airports Authority, Jubilee Insurance, Safaricom, Kenya Revenue Authority, Kabarak University, National Transport and Safety Authority and other entities have been victims of cyber attacks and massive data breaches in Kenya.
A couple of days ago, a crippling cyber-attack by Rhysida ransomware group rendered the Kenya Bureau of Standards systems ineffective in testing and inspecting all goods, consequently exposing the consumers to the risk of harmful products. The attack reportedly paralysed the entire KEBS network: payment, human resource operations and massive data leaks of customer, staff and transactional data were allegedly stolen by hackers.
These incidents have rejuvenated the debate over the security of Kenya’s public digital infrastructure against cyber crimes. A stern wake up call for the government and relevant stakeholders to invest in robust cyber security measures, threats mitigation strategies and practices to build the public trust in their critical systems, manage their data assets effectively and safeguard sensitive data from cybercriminals.
Given the evolving digital threats landscape and data privacy regulations, these incidents could have been averted with robust data governance practices. Data governance refers to the set of policies, procedures and standards that organisations use to manage their data assets effectively.
Enforcing strong access controls to critical systems and sensitive data limits the circumstance of a cybercrime. By limiting access to data on a need-to-know basis and using authentication and authorisation mechanisms such as passwords, two-factor authentication and role-based access controls, companies can prevent unauthorised access to sensitive data.
For illustration, if a company had implemented role-based access controls, it would have prevented the cybercriminals who breached the company's system from penetrating sensitive data they weren't authorised to view.
By encrypting sensitive corporate data, companies can prevent unauthorised access even if a data breach occurs. For example, if a company had translated its customers' credit card details, cybercriminals who breached the company's system would not have been able to read the credit card numbers.
By regularly monitoring data access and usage, companies can identify and prevent unauthorised access and misuse of sensitive data. For example, if a company had been monitoring its system logs, it would have detected the suspicious activity of cybercriminals who breached its system and taken action to prevent the data breach.
Data governance also involves training employees in data security best practices, including password management, data handling and data storage. By training employees in data security best practices, companies can reduce the risk of data breaches resulting from employee error or negligence.
For example, if a company had trained its employees on how to handle sensitive data securely, an employee might not have inadvertently shared sensitive data with a third party.
Regularly assessing and reviewing data governance and security goals is no longer a choice for businesses that need consistent and harmonious protection from cybercriminals.
By following these data governance best practices, you can ensure that your organisation is well-equipped to anticipate online threats, apply incident response plans, neutralise attacks and impact and recover quickly in the event of a large-scale data breach.
The writer is data scientist at UNEP
