Publications
Partners
Cape Town - South African companies open themselves to being hacked by being ignorant of the risks to their operations because of hacking, says an expert.
Specifically, many managers downplay the real risks that a breach could cause.
"Often companies think, 'So what if we get breached? I don't have anything valuable,'" Craig Rosewarne of Wolfpack Information Risk told Fin24.
Wolfpack is a threat intelligence firm that specialises in understanding and predicting cyber threats. The firm pegged the losses to South African businesses as a result of cybercrime to between R2.5bn and R5bn annually.
Rosewarne warned that downplaying the cyber risk could be catastrophic to the operations of any organisation.
"This [ignoring the risk] is a common misconception as hackers not only want to gain access to your banking details, often they want to compromise your machine so that they can use it to conduct fraudulent business, or perhaps record business conversations."
Malware
A survey found that 64% of South Africans faced serious threats from cyber criminals intent on stealing their money.
"When explaining how they lost the money, 14% of respondents in South Africa stated that hackers had stolen their money by gaining access to their payment services accounts, 20% believed they had fallen for fraudsters’ tricks and entered their credentials on a fake website and 8% were sure that their log ins and passwords had been intercepted by malware," said Kaspersky Lab which carried out the survey.
The security firm added that nearly half of all computer users experienced an incident of malware infection. Cyber criminals use malware, primarily delivered via spam, to infect machines.
"People may have a sense that clicking on a link could be a bad idea, but their curiosity gets the better of them. This can unwittingly expose not only the individual to cyber attacks but the entire company network," said Brandon Bekker, MD of Mimecast South Africa.
Spam remains an effective way to deliver malware to computer users. (Duncan Alfreds, Fin24)
A recent News24 survey revealed that at least 5% of people click on suspicious links sent to them, with 2% saying that they lost a significant amount of money.
Despite the increase in the number of attacks, Rosewarne said that local hackers were a long off the sophistication of international operators.
"The actual local cyber-criminal activity is not as advanced here as it is in other countries. There are a range of international syndicates operating in SA that used traditional criminal methods, but some are more sophisticated.
"For example, Romanian and Russian cyber criminals have the necessary tech skills and some have even been arrested here in SA."
Legislation
Tools that are ostensibly designed for legitimate purposes can be exploited by those with malicious intent.
"A mobile spyware tool for example can be bought for $10 a month. While these tools are designed for suspicious spouses or concerned parents, they can be abused by employers, psychopaths, bullies, trolls, and even rogue news reporters or more experienced criminals," said Rosewarne.
Legislation in SA does not compel companies to report hacking attacks nor data breaches, and Rosewarne argued that companies should be forced to disclose, especially where it compromised consumers.
"Definitely, they [companies] should be compelled as it is the ethical thing to do. But the risk of reputational harm is too great and often outweighs the decision to do so. Until legislation enforces this, most companies likely won't report data breaches. There is also a lack of trust by many in the capability of law enforcement."
Watch this video where Leon van Aswegen of Trustwave explains the basic tips you can do to protect yourself from cyber criminals.
- Follow Duncan on Twitter
