<div dir="ltr"><div><div><div><br></div>Listers,<br><br>For the day 2 KeIGF online discussion on Cyber Security and Trust, allow me to take you back to last year KICTANet's thread when anonymous Kenya hacked KDF Twitter accounts. Key issues were raised with no follow ups. 1.The govt not consulting local talent which has skills and capacity and 2. appreciation of digital security risks by various industries. It seems like nothing much has changed. How do we take it forward?<br></div></div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jul 21, 2014 at 8:22 PM, John Kariuki via kictanet <span dir="ltr"><<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="color:#000;background-color:#fff;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,Sans-Serif;font-size:12pt"><div><span>Matunda,Listers,</span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,'Helvetica Neue',Helvetica,Arial,'Lucida Grande',sans-serif;font-style:normal;background-color:transparent"><span>You are right.Breaches on cyber security need serious attention.</span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,'Helvetica Neue',Helvetica,Arial,'Lucida Grande',sans-serif;font-style:normal;background-color:transparent"><span><br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,'Helvetica Neue',Helvetica,Arial,'Lucida Grande',sans-serif;font-style:normal;background-color:transparent"><span>The ICT Policy in 2006 summarized the matter as
follows:</span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,'Helvetica Neue',Helvetica,Arial,'Lucida Grande',sans-serif;font-style:normal;background-color:transparent"><span><br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,'Helvetica Neue',Helvetica,Arial,'Lucida Grande',sans-serif;font-style:normal;background-color:transparent"><span>"Electronic Security: The challenge is for the country to establish an adequate legal framework and capacity to deal with national security,network security,cyber-crime and cyber-terrorism; and to establish mechanisms for international cooperation to combat cross-border crimes.An e-security structure will be developed in collaboration with the relevant institutions." </span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,'Helvetica Neue',Helvetica,Arial,'Lucida Grande',sans-serif;font-style:normal;background-color:transparent"><span><span style="white-space:pre-wrap"> </span>Since 2006, matters the situation has become even worse than envisaged at that time due to increasing use of on-line services and Broadband Networks.</span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,'Helvetica Neue',Helvetica,Arial,'Lucida Grande',sans-serif;font-style:normal;background-color:transparent"><span><br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:HelveticaNeue,'Helvetica Neue',Helvetica,Arial,'Lucida Grande',sans-serif;font-style:normal;background-color:transparent"><span>John Kariuki</span></div> <div><br><br></div><div style="display:block"> <div style="font-family:HelveticaNeue,'Helvetica Neue',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:12pt"> <div style="font-family:HelveticaNeue,'Helvetica Neue',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:12pt"><div><div class="h5"> <div dir="ltr"> <font face="Arial" size="2"> On Monday, 21 July 2014, 17:38, Matunda Nyanchama via kictanet <<a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a>> wrote:<br> </font> </div> <br><br> </div></div><div><div><div class="h5"><div><div><div style="color:rgb(0,0,0);font-family:HelveticaNeue,'Helvetica Neue',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:12pt;background-color:rgb(255,255,255)"><div><span><br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span>On this score, I have made some observations:</span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span><br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span>- our people don't take seriously such breaches; I read an attitude of this sort: "it is a small irritant that will come." This is especially so for the public sector but also (to a small extent) private sector. Indeed, organizations like banks can afford to underwrite huge losses
through marginal variation in interest rates.</span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span><br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span>- there is no concerted effort to develop needed skills in this area in order to tackle/forestall such problems. With such skills in mind we would design, implement and continually monitor and respond to incidents based on best practices. (Note: there are no guarantees that one won't be hacked but one can minimize such damage as: reputation, loss/modification of information, etc.)</span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span><br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span>- we seriously need leadership in this space nationally (both in public and private sectors); if there exists any, it is not felt. Such leadership would be evangelistic in nature pushing for appreciation of such risks and how to deal with them. Such awareness would raise concern (hopefully) and thus assure allocation of commensurate resources (people, money, technology, etc.) to confront the problem. (NB: my experience in North America tells me that this area is very much underfunded and whatever little funding comes through would be spent on easy to acquire stuff like CCTV ... some installed without requisite processes, skills, etc for maximum gain (ROI) ...)</span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span><br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span>- many technology managers (and many others in management) treat security with obscurity. Keep things obscure and profess security. I once was in a discussion with a senior official in GoK and heard things such as: we cannot disclose what measures we have taken to protect government information because the same can be used by you people to target us! He failed to appreciate that you can still be hacked with use of known reconnaissance approaches. OK: if you really want help, get some of our top talent, give them security clearance and allow them to build robust systems that assure security.</span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span><br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span>- a friend recently gave the story of a manager (a protege of top management) that kept his job, protected by his benefactors but who many knew wasn't performing. This manager could continually avoid bringing in talent that might help him but which talent may also expose his failing! Only when the organization was hit and top management embarrassed with loss (material, reputational) did they hire an external consultant whose report exposed the manager's fraud that he had perpetuated for years on end! ... long story short, he was given a soft landing, and slowly eased out of the organization. ... Lesson: get the right talent and skills for the job if indeed you are committed to delivering in your mandate.</span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span><br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span>BTW: we are into consulting and training in this area. I know of bids we have lost on (despite presenting the best technical proposals) </span><span style="font-size:12pt;background-color:transparent"> because of other considerations. Your guess is as good as mine as to why, but don't be surprised to have some "wired/connected" individuals winning security assignments but which they can't deliver on; and if they do, the result would be sloppy and why ... because they engage unskilled people ....</span></div><div style="color:rgb(0,0,0);font-size:12pt;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span style="font-size:12pt;background-color:transparent"><br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span style="font-size:12pt;background-color:transparent">- Finally (for now), the compliance regime is extremely weak! I know a thing or two about the Auditor General's office and information security skills isn't one of their strengths. The focus on financial audit (recently they reported Kshs 300 + billion unaccounted for) takes all the attention while other aspects go unattended: critical infrastructure protection, ICT specification/acquisition/deployment/management/.../disposal ... all go unattended.</span></div><div style="color:rgb(0,0,0);font-size:12pt;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span style="font-size:12pt;background-color:transparent"><br></span></div><div style="color:rgb(0,0,0);font-size:16px;font-family:'Times New Roman';font-style:normal;background-color:transparent"><span style="font-size:12pt;background-color:transparent">... there is a
lot to say; let this suffice for today. </span><br></div><div></div><div> </div><div><font size="2"><span style="font-family:times,serif">----------------------------------------------------------------------------------------------</span><br style="font-family:times,serif"></font><font size="2"><span style="font-family:times,serif">Matunda Nyanchama, PhD, CISSP; <a href="mailto:mnyanchama@aganoconsulting.com" target="_blank">mnyanchama@aganoconsulting.com</a></span><br style="font-family:times,serif"><span style="font-family:times,serif">Agano Consulting Inc.; </span><a rel="nofollow" style="font-family:times,serif" href="http://www.aganoconsulting.com/" target="_blank">www.aganoconsulting.com</a>; </font><font size="2">Twitter: <a rel="nofollow" href="http://twitter.com/#%21/nmatunda" target="_blank"><span style="color:rgb(54,99,136)">nmatunda; </span></a></font><font size="2"><span style="text-decoration:underline"></span>Skype: okiambe</font><font size="2"><span style="border-collapse:separate"><span style="font-family:verdana,helvetica,sans-serif;font-size:11px"></span></span><br style="font-family:times,serif"><span style="font-family:times,serif">----------------------------------------------------------------------------------------------</span></font></div><div style="color:rgb(0,0,0);font-family:times,serif;font-style:normal;background-color:transparent"><span style="font-family:times,serif"><font size="2">Manage your ICT risks</font></span><span style="line-height:1.22;font-family:times,serif;font-size:10pt">! We are the experts you need! The trusted partners you deserve!</span></div><div><span style="font-family:times,serif"><span style="font-size:10pt">Call: <span style="font-weight:bold">+1-888-587-1150 (Canada) +254-20-267-0743
(Kenya) </span>or <a rel="nofollow"><span style="font-weight:bold">info@aganoconsulting.com</span></a></span></span></div><div style="color:rgb(0,0,255);font-family:times,serif;background-color:transparent"><span style="line-height:16px;font-size:16px;font-weight:bold"><var></var>Licensed by Communications Commission of Kenya (CCK)</span></div><div style="color:rgb(0,0,255);font-family:times,serif;font-size:13px;font-style:italic;background-color:transparent"><span style="font-family:times,serif"><span style="font-size:10pt"><span style="font-style:italic"> </span></span></span><span style="font-family:times,serif">----------------------------------------------------------------------------------------------</span><span style="font-family:times,serif;font-style:italic"></span><span style="font-family:times,serif" lang="EN-CA"></span></div><div><span style="font-family:times,serif;font-size:13px"><div>"The best revenge is massive success" - Frank Sinatra<span style="font-style:italic"></span></div></span><span style="font-family:times,serif">-----------------------------------------------------------------------------------------------</span><br style="font-family:times,serif"><font style="font-family:times,serif" size="1">This e-mail, including attachments, may be privileged and may contain confidential or proprietary information intended only for the
addressee(s). Any other distribution, copying, use, or disclosure is unauthorized and strictly prohibited. If you have received this message in error,
please notify the sender immediately by reply e-mail and permanently delete the message, including any attachments, without making a copy. Thank you.</font><br></div></div></div></div><br></div></div><span class="">_______________________________________________<br>kictanet mailing list<br><a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a><br><a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br><br></span>Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/ngethe.kariuki2007%40yahoo.co.uk" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/ngethe.kariuki2007%40yahoo.co.uk</a><span class=""><br><br>The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.<br><br>KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or
qualifications.<br><br></span></div> </div> </div> </div> </div></div><br>_______________________________________________<br>
kictanet mailing list<br>
<a href="mailto:kictanet@lists.kictanet.or.ke">kictanet@lists.kictanet.or.ke</a><br>
<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
<br>
Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/lizorembo%40gmail.com" rel="noreferrer" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/lizorembo%40gmail.com</a><br>
<br>
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.<br>
<br>
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><font style="font-family:comic sans ms,sans-serif" face="arial, helvetica, sans-serif">Best regards.<br><br>Patience is what you admire in the driver behind you, but not in the one ahead.<br></font></div>
</div>