Category: Vox 4 Thought

With a growing number of South African organisations being targeted by global cyber attackers, integrated ICT and infrastructure company Vox has announced the launch of a new subsidiary, Armata Cyber Intelligence, to provide the technology solutions and niche expertise needed to help local businesses better protect themselves against cyber threats.

“South Africa is now the third most targeted country in the world when it comes to cyber attacks, with the average cost of an attack increasing from R3 million in 2020 to R4 million in 2021. Armata aims to deliver cost-effective intelligent cybersecurity solutions that help achieve zero interruption to our client’s business systems while maintaining the highest level of protection for their data, thereby gaining complete confidence in our offerings,” says Richard Frost, Product Head: Network and Endpoint Security.

The company follows the NIST Cybersecurity Framework, which provides best practice guidelines around how internal and external stakeholders at organisations can better manage and reduce the risk of cyber attacks. The framework is built around five main functions: Identify, Protect, Detect, Respond and Recover.

“Cybersecurity is made up of products, people and processes. Many organisations, especially SMBs, lack the funds to support all three in-house. Vox’s solution to this is to offer the product and services on a month-to-month basis to provide clients with a more affordable price. This allows clients to scale the solution to their budget and contain their costs in a predictable and controllable manner,” says Frost.

At launch, Armata’s offerings will include cybersecurity solutions, security services, managed security services, consulting services, and audits and assessments. This will help organisations comprehensively deal with endpoint security, email security, network security, cloud security, application security, digital security (on mobile and internet of things devices), web services security, and network access control.

It further helps organisations in the areas of identity and access management, backup, data discovery, data loss prevention, information rights management, vulnerability scanning, application code review and threat feeds, whereby customers have access to security intelligence collected from a variety of sources that can be used to proactively mitigate against cyber threats.

“In addition, Armata will offer customers user awareness testing programmes in order to ensure that employees are aware of the security risks. The need for both corporate and personal security education has always been critical, but it has now been brought to the fore with more people working from home, which leaves corporate networks and data more susceptible to attacks through an employee’s home network or other unprotected public networks, says Frost.

“By being cyber smart, we can effectively prevent 80% of attacks simply by knowing what to do. The rest of the attacks will be handled by your security solutions.”

Tim Wood, Executive Head – IS & IT at Vox

While companies invest a great deal of time and effort in securing their systems, remote and hybrid working has forced businesses and their staff to acknowledge that security goes beyond IT. For all the best technology, a human lapse could result in a catastrophic breach.

Let’s use an analogy that many South Africans will be accustomed to. Security conscious estates or complexes have varying levels of access control. These complexes have high walls, electric fences, security guards manning key entry points, and many – if not all – have security monitoring and patrolling the premises 24/7.

It’s possible that this environment could lull someone into a false sense of security, and they’d let their guard down. However, we know that this would be a mistake. Just because the complex or estate boasts these security measures, there are still several ways someone could be at risk.

When they enter and leave the complex, they could become targets of criminals. When they are inside their own unit, they may not be aware of an undetected breach at the estate’s entrance. It is possible criminals are operating from within the secured estate. What if they have adult children going in and out late at night?

Obviously, this is not an exhaustive list of possibilities, but the point is obvious – it would be a mistake to be lulled into taking anything for granted because we understand that security extends beyond the physical measures in place. And so, in the South African context, one invests in physical security, and then continually remains aware of risks and behaves in a way to minimise them.

Similarly, securing a company requires a conscious effort and it involves an interplay of people, processes, and technology. In a traditional workplace setup, a company can – and will – do all that it can to control its environment. As the pandemic has shown so vividly, this environment no longer exists only in a physical form, yet the requirement to secure it remains.

A company can no longer lock the doors and rely on the fact that access is restricted. Systems need to be accessed remotely and in providing for this you lose control of the environment. As sobering as it is, you must start with the premise that your staff will, at some point, leave their laptop unattended in a public space.

Securing company systems requires protecting your software, protecting your hardware, protecting and backing up your data, and the ongoing education of your system’s users. To get this right, it is important to ask – and answer – who is accessing your systems; from where; using what; how; and why are they accessing them?

Who is trying to access your systems?

In an ideal scenario, it is your employee attempting to access company systems. However, someone may have stolen login credentials, which would be a targeted and planned attack. Alternatively, it is also possible someone encountered an unlocked device and is opportunistically attempting to gain access. There are various ways to mitigate this risk. User access management is paramount. A company needs strong password policies such as complexity rules and password resetting timetables. Multi-factor authentication adds a layer that could be the difference between being breached or not.

One cannot always rely on an employee to remember to lock their devices every time they are not using them, and so auto-lock is crucial. Encrypting external devices such as hard drives and USB sticks is vital – what if an employee leaves a USB stick on a coffee shop table or airport lounge chair?

Where is the employee working from?

Remote working means that an employee must access systems from various locations. In many instances it will be their home, but they could also be accessing systems from an airport or café. As a priority organisations should implement virtual private network (VPN) technology to ensure encrypted and private access to the corporate network.

As part of the ongoing education, employees should learn to become aware of their surroundings and the potential for eavesdropping. They should make the care and security of physical assets like laptops a priority. This extends to clean desk policies – nothing should be left lying around, while each employee should understand how to appropriately dispose of printed documents.

What devices are they using to access systems?

As far as reasonably possible, it would be wise to restrict access to company systems from devices other than company-managed assets. It is not ideal for staff to use personal or shared devices. With company-managed assets, a business can invest in central device management software, including the ability to wipe devices remotely. It enables companies to encrypt hard drives, ensure appropriate back-ups are in place and to update devices with the latest operating systems and malware and antivirus software.

How is the employee accessing your systems?

While employees may access company systems through their dedicated home fibre, it is also possible they are connecting via public Wi-Fi access points. Again, it can never be overstated – education is paramount. Take the time to teach staff about the dangers of unsecured Wi-Fi and honeypots, as well as being aware and alert to their surroundings.  Then reinforce this message consistently.

Why are they accessing the company system?

They may need to access emails and collaboration tools, but it may also be that they work in critical areas such as payments. There are various things a company can do here, including limiting access levels dependent on the employee’s job function, monitoring the device activity of staff working in critical areas and running vulnerability scans and penetration tests, which are simulated cyberattacks against your own system to isolate vulnerabilities that need to be addressed.

Securing a business’s systems is an ongoing task. It is about cultivating a company-wide security mindset as much as it is about investing in the best available technology.

Very much like living in South Africa today.

It’s already well documented that the frequency of Cyber Crimes is on the rise.

Looking back, the introduction of lockdowns, curfews and tougher legislation led to a drastic decrease in traditional crime statistics worldwide. Good news, right? Well, not entirely, as with this decrease in people going outside came an increase in staying online and, sadly, a similarly steady rise in Cyber Crime.

Worryingly, experts predict that by the end of 2021, we can expect one cyberattack incident every 11 seconds (Source: Technewsworld online, 2021). This number is in fact double that of 2019 (one every 19 seconds), and four times the rate of just five years ago (one in 40 seconds). A lot can change in a short space of time, right?

Sadly, this rapid increase in Cyber Crimes worldwide comes at a substantial cost for businesses involved – not just, as you may expect, in the damages incurred, but also due to the added expense of additional security measures. Worldwide, Cyber Attacks dealt an estimated $1 trillion worth of damages (around 1% of the Global GDP) in 2020 alone. This number is on the rise and, as such, Cyber Security has now become a fundamental component of any brand hoping to embrace the Digital Revolution yet remain unscathed.

So, what does tomorrow hold in the world of Cyber Security?

Truth be told, the concept is still relatively new, and only in recent years has it been recognised as its own entity and independent of traditional IT Security. Gone are the days where your industry standard Firewall and a licensing fee paid by the tech guy was sufficient protection for your organisation.

The world of technology is ever evolving and, as such, the threats as well as the measures used to negate them are in a constant state of evolution. Not every new innovation and solution sticks around for good (just look at Blackberries as an example) but, what is indisputable, is that technology is rapidly becoming increasingly intertwined with our daily lives.

From conversations to banking, dating, shopping and watching movies, technology is impacting devices and services that weren’t previously considered part of the IT infrastructure. We’ve seen smart fridges and TVs connected to the Internet – many fail to realise that they present areas of potential weakness which a hacker can dispute. Our first prediction is that as our reliance on the Internet increases (as it’s bound to), so too will we begin to adopt new, all-encompassing security solutions which cater for multiple devices. We also foresee a world wherein the future of Cyber Security is less concerned with protecting the individual device (although that is important), but rather our Data and information, wherever it may be held.

That being said, the most glaringly obvious Cyber Security challenge today deals with remote and hybrid workspaces. Like it or not, the concept is here, and looks likely to be a part of our reality for the foreseeable future.

This creates a haven for Cyber Criminals, who pounce on areas of weakness and vulnerability before you even know what hit you. No longer can companies or individuals assume that the corporate level office security is sufficient – we need to, as individuals, account for misconfigured systems or unsuspecting employees who may unknowingly put your organisation at risk.

More and more, companies and organisations are ushering in a “zero-trust” mindset, which necessitates that all associates approach any engagement as if they were a security risk. It’s a well-documented fact that Cyber Criminals have been preying on remote workers and, with the concept not going away any time soon, you can expect more stringent internal company policies and a larger emphasis on home Cyber Safety.

The unfortunate reality is that Cyber Attacks will become more targeted.

The downside of being locked down is that, while the majority of us were wishing for Nando’s, picking up some extra weight or learning a new skill, Cyber Criminals used that time to hone their abilities and develop new methods of infiltration – meaning vigilance is more important now than ever before.

It’s not all doom and gloom, however, as the Security industry has not taken these challenges lying down. In fact, the International Data Corporation (IDC) predicts that, globally, people will be spending $174 billion on Cyber Security alone by the year 2024 (Source: Fieldeffect.com, online). Cyber Security represents one of the largest and fastest growing online market segments worldwide and, with the increase in awareness and breaches, you can only expect this number to grow.

But what comes next?

Well, by looking ahead, we can immediately notice a few key talking points in the world of CS.

If you feel like you’re reading more about digital threats now, it’s because people are more aware of this very real danger and (finally!) giving it the attention it deserves. We foresee a significantly increased focus on prevention, education and awareness across the board. As of yet, not many organisations have adequate response planning in the event of a breach, and we anticipate that this will change as incident preparedness and response guidelines become more common.

Furthermore, the introduction of new regulatory concerns has ensured that organisations are now forced to be accountable and responsible for their Data Security. It’s very likely that, in time, there becomes a minimum Security threshold for businesses to maintain, and we expect mandatory training, audits and compliance assessments.

Truth be told, it’s hard to predict the future (if we could, we’d be in that business instead of Cyber Security), but one thing is certain – the rate at which threats are evolving will evoke a similarly powerful response. We predict more stringent protocols, a greater focus on awareness and, most of all, Vox leading the way when it comes to keeping you safe.

Between PoPIA, global hacks and an abundant use of the term “ransomware”, it seems like Cyber Security is the talk of the town.

Let’s face it though, it’s for good reason, as a seemingly endless space of Cyber Crimes has led to numerous Data Breaches, the compromisation of personal information on an international scale and, with the implementation of new privacy laws, a unanimous fear of the worst case scenario.

Admittedly, it all seems a bit doom and gloom, but you’ll be pleased to know that Cyber Security is not just an empty, pie-in-the-sky promise of a brighter business future and protection for those who can afford it. In fact, many brands make the mistake of thinking “it won’t happen to me” – it can, and, if you’re not careful, there’s a high chance it will.

The good news is that it’s not exclusive to said industry monoliths. Instead, it’s feasible, attainable, affordable and, given the all too legitimate reality of potential attacks, crucial.

First things first, however – how does Cyber Security interlink with my FTTB?

It’s easy to think the two are unrelated as, at first glance, they’re completely different products operating in separate hemispheres. However, they’re more intertwined than you may expect, with Cyber Security becoming a fundamental component of maintaining your brand safety while still enjoying optimum Fibre to your Business.

First off, Fibre on its own is vastly superior in terms of safety and overall security. Not only is it less prone to theft or interception, but the high speeds involved allow for minimal interference and easier preventative action should a breach occur.

With Vox Business Fibre, not only can your Data safely be stored in our Cloud facilities, but you have access to the fastest, most reliable means of transmitting your information. Combine this with our numerous Security based offerings (such as Firewalls, AntiVirus, Patch Management and Backup) and not only is your organisation safeguarded against threats, but also backed up with the necessary support to minimise any damage incurred.

That’s great, but what does this mean for my business?

Well, the average cost of a Cyber Breach has risen from around R3million pre-Covid to around R4 million for any SME unfortunate enough to be impacted by it. Compare this to the minimal monthly costs of maintaining a security strategy which prevents said breaches, and the reward far outweighs the potential risk.

It’s not some tale of woe from a distant land either, as South Africa is the 3^rd most targeted country in the world when it comes to Cyber-attacks. And, if you’re thinking “my company is too small for anyone to worry about”, we’re sorry to break it to you but SME’s are actually the perfect target, as their lack of adequate security measures makes them significantly easier targets than huge corporations with high-end protection.

Hopefully you’re not running around waving your hands in panic by now, because we’re here to tell you that, despite all the above, there’s still a ray of hope.

In fact, with the correct solutions and proper training, you can reduce your risk by up to 95% (fun fact: 95% of security breaches are the result of human error – so a little training can mitigate a large portion of the risks involved).

With Vox and our best-in-class Cyber Security Solutions, we’re making your organisational safety easily accessible to all Vox Fibre customers. These solutions are tailor-made to ensure your business enjoys the best protection available, in doing so protecting your business, your Data and your important customer information.

Better yet? Our solutions aren’t limited to high-end businesses with a massive staff component either, as they can cater for the SME with 20 or less users as well as the 40 plus range accordingly. The best part? Your security budget isn’t tearing your ceiling a new one – as they start as low as R3 436.00pm.

At the end of the day, a small monthly outlay is nowhere near the potential costs incurred by a Security Breach. Factor in that the new POPIA regulations present the threat of further fines (or even jail-time) for any organisation deemed to be negligent with their customer information, and the decision to take the matter as seriously as possible is a no-brainer.

The sad reality is that we live in a world full of threats – both in the real world and, unfortunately, the digital one as well. Just as your business wouldn’t leave its office unlocked and invite thieves to help themselves, your virtual security needs to be guarded under lock and key. Well, with Vox Cyber Security Solutions, you won’t just have a lock and key, but rather a padded cell, armed guard and machine-gun wearing Pitbull to boot.

While companies invest a great deal of time and effort in securing their systems, remote and hybrid working has forced businesses and their staff to acknowledge that security goes beyond IT. For all the best technology, a human lapse could result in a catastrophic breach.

Let’s use an analogy that many South Africans will be accustomed to. Security conscious estates or complexes have varying levels of access control. These complexes have high walls, electric fences, security guards manning key entry points, and many – if not all – have security monitoring and patrolling the premises 24/7.

It’s possible that this environment could lull someone into a false sense of security, and they’d let their guard down. However, we know that this would be a mistake. Just because the complex or estate boasts these security measures, there are still several ways someone could be at risk.

When they enter and leave the complex, they could become targets of criminals. When they are inside their own unit, they may not be aware of an undetected breach at the estate’s entrance. It is possible criminals are operating from within the secured estate. What if they have adult children going in and out late at night?

Obviously, this is not an exhaustive list of possibilities, but the point is obvious – it would be a mistake to be lulled into taking anything for granted because we understand that security extends beyond the physical measures in place. And so, in the South African context, one invests in physical security, and then continually remains aware of risks and behaves in a way to minimise them.

Similarly, securing a company requires a conscious effort and it involves an interplay of people, processes, and technology. In a traditional workplace setup, a company can – and will – do all that it can to control its environment. As the pandemic has shown so vividly, this environment no longer exists only in a physical form, yet the requirement to secure it remains.

A company can no longer lock the doors and rely on the fact that access is restricted. Systems need to be accessed remotely and in providing for this you lose control of the environment. As sobering as it is, you must start with the premise that your staff will, at some point, leave their laptop unattended in a public space.

Securing company systems requires protecting your software, protecting your hardware, protecting and backing up your data, and the ongoing education of your system’s users. To get this right, it is important to ask – and answer – who is accessing your systems; from where; using what; how; and why are they accessing them?

Who is trying to access your systems?

In an ideal scenario, it is your employee attempting to access company systems. However, someone may have stolen login credentials, which would be a targeted and planned attack. Alternatively, it is also possible someone encountered an unlocked device and is opportunistically attempting to gain access. There are various ways to mitigate this risk. User access management is paramount. A company needs strong password policies such as complexity rules and password resetting timetables. Multi-factor authentication adds a layer that could be the difference between being breached or not.

One cannot always rely on an employee to remember to lock their devices every time they are not using them, and so auto-lock is crucial. Encrypting external devices such as hard drives and USB sticks is vital – what if an employee leaves a USB stick on a coffee shop table or airport lounge chair?

Where is the employee working from?

Remote working means that an employee must access systems from various locations. In many instances it will be their home, but they could also be accessing systems from an airport or café. As a priority organisations should implement virtual private network (VPN) technology to ensure encrypted and private access to the corporate network.

As part of the ongoing education, employees should learn to become aware of their surroundings and the potential for eavesdropping. They should make the care and security of physical assets like laptops a priority. This extends to clean desk policies – nothing should be left lying around, while each employee should understand how to appropriately dispose of printed documents.

What devices are they using to access systems?

As far as reasonably possible, it would be wise to restrict access to company systems from devices other than company-managed assets. It is not ideal for staff to use personal or shared devices. With company-managed assets, a business can invest in central device management software, including the ability to wipe devices remotely. It enables companies to encrypt hard drives, ensure appropriate back-ups are in place and to update devices with the latest operating systems and malware and antivirus software.

How is the employee accessing your systems?

While employees may access company systems through their dedicated home fibre, it is also possible they are connecting via public Wi-Fi access points. Again, it can never be overstated – education is paramount. Take the time to teach staff about the dangers of unsecured Wi-Fi and honeypots, as well as being aware and alert to their surroundings.  Then reinforce this message consistently.

Why are they accessing the company system?

They may need to access emails and collaboration tools, but it may also be that they work in critical areas such as payments. There are various things a company can do here, including limiting access levels dependent on the employee’s job function, monitoring the device activity of staff working in critical areas and running vulnerability scans and penetration tests, which are simulated cyberattacks against your own system to isolate vulnerabilities that need to be addressed.

Securing a business’s systems is an ongoing task. It is about cultivating a company-wide security mindset as much as it is about investing in the best available technology.

Very much like living in South Africa today.