KnowBe4 Africa - Afrikan Heroes

KnowBe4 and IDC Raise the Cybersecurity Flag in Sub-Saharan Africa

July 16, 2022

Cyberextortion remains an ongoing threat in sub-Saharan Africa with data leakages and targeted attacks in top two positions; Growing investment into connectivity and IoT increasing the cybercrime attack surface; There is a linear relationship between GDP and cybercrime.

The KnowBe4 and IDC Impact of Cyberextortion on Africa report released in June 2022 has revealed a complex cybercrime landscape in sub-Saharan Africa (SSA) with data leakages, insider threats, malicious emails and targeted attacks continuing to seriously impact business security in the region. These threats are compounded by budget constraints and that nearly 60% of SSA organisations plan to increase connectivity and IoT use cases over the next 12 months. Growing investments into cloud, Internet of Things (IoT), connectivity and digital solutions increase the risks alongside the digital benefits.

Anna Collard SVP Content Strategy & Evangelist at KnowBe4 Africa

The volume of threats facing organisations in Africa has grown exponentially over the past few years and there is a clearly visible linear relationship between the continent’s gross domestic product (GDP) and cybercrime – as one increases, so does the other, yet only about a third (17) of Africa’s 54 countries have completed a national cybersecurity strategy. This opens up the threat landscape considerably and puts organisations at greater risk.

The top threats facing organisations in SSA in 2022 are data leakage (61%), insider threats (43%); targeted attacks using phishing (37%); cloud-related attacks (34%); and ransomware attacks (30%). The top five global threats are business email compromise, cloud misconfigurations, software supply chain attacks and non-compliance. Phishing or social engineering attacks remain the second most common type of cybercrime and are evolving in terms of technique and success rates. These challenges are influencing security strategy for organisations going forward with 43% focusing on security for cloud migration, 40% on strengthening secured access for a distributed workforce, and 36% focused on strengthening customer trust in digital services.

According to the report, 56% of organisations in SSA are in the first two stages of data security maturity which means that many are still struggling to find their security footing in this shifting landscape. A lot like trying to find balance in the middle of an earthquake, cybersecurity threats are keeping decision makers and security teams off balance, particularly in light of skill-shortages, budgets and increased regulatory complexity.

“Chief Information Security Officers (CISOs) are struggling to find competent staff that can handle the security alerts they receive while also keeping up with data protection regulations, and building networks capable of withstanding the cyberthreats,” says Anna Collard SVP Content Strategy & Evangelist at KnowBe4 Africa. “In addition, one out of every three companies believes that there is insufficient integration between security and IT teams with 30% saying that hiring and retaining security skills is a challenge.”

Cyberextortion is lucrative. And cybercriminals don’t expect much retaliation from African states. This means it is unlikely to stop and very likely to become even more prevalent on the continent. Organisations have to focus on security investments and strategies that will allow combating this threat with more agility and resilience. This means prioritising a defence in depth model with cloud security; privacy and compliance; choosing the right security service providers and building a security culture among both decision makers and employees.

Kelechi Deca

Kelechi Deca has over two decades of media experience, he has traveled to over 77 countries reporting on multilateral development institutions, international business, trade, travels, culture, and diplomacy. He is also a petrol head with in-depth knowledge of automobiles and the auto industry

KnowBe4 Partners With Cybersecurity Centre Gives Scholarship for Women in South Africa

June 3, 2022

Anna Collard, SVP of content strategy & evangelist, KnowBe4 Africa

A leading provider of one of the world’s largest security awareness training and simulated phishing platforms, KnowBe4, today announced it has partnered with the Centre for Cyber Safety and Education to launch the KnowBe4 Women of Colour in Cybersecurity (South Africa) Scholarship.

The recipient of this award will receive an R110,000 ($7,090.68) scholarship on behalf of KnowBe4 as well as an (ISC)2 certification education package. This is a one-time award and students may reapply each year in the future to be considered for another scholarship. Applicants will be scored in three categories: passion, merit and financial need.This scholarship aims to assist in diversifying the cybersecurity workforce in South Africa among women.

According to the SANS Institute, as of 2021, women make up only nine per cent of cybersecurity professionals on the continent of Africa. Additionally, South Africa currently has an unemployment rate of 34.5%.

More alarmingly, that statistic broken down reveals that the unemployment rate among women in South Africa is nearly 38% per Statista. The unemployment rate among black women and women of colour is at 41% and 29.1%, respectively, according to recent media reports.

“This new scholarship is part of a broader effort by KnowBe4 to drive opportunities that help to create more diversity throughout the cybersecurity workforce in South Africa and beyond,” said Anna Collard, SVP of content strategy & evangelist, KnowBe4 Africa. “We are grateful for our partnership with the Centre for Cyber Safety and Education to provide this scholarship and are looking forward to selecting a very deserving recipient.”

The application period opens on 1 June 2022 and closes on September 19, 2022.

For more information on and to apply for the KnowBe4 Women of Colour in Cybersecurity (South Africa) Scholarship administered by the Centre for Cyber Safety and Education, visit https://www.iamcybersafe.org/s/knowbe4-women-of-colour-south-africa.

Kelechi Deca

Kelechi Deca has over two decades of media experience, he has traveled to over 77 countries reporting on multilateral development institutions, international business, trade, travels, culture, and diplomacy. He is also a petrol head with in-depth knowledge of automobiles and the auto industry

The Rise of Cyberfeminism

February 14, 2022

Anna Collard, SVP of content strategy and evangelist for KnowBe4 Africa

Changing the differences in power that exist in digital discourse and embracing diversity across all platforms. Cyberfeminism is defined as both a philosophy and a movement. As a philosophy, it acknowledges the differences in power between men and women, specifically around digital discourse, and what needs to be done to change these differences. As a movement, it is focused on empowerment, for all types of diversity. It is an important consideration in today’s society, not least because women will be put at risk if they do not find their digital footing in the age of the internet.

“Women are not given as many opportunities to explore the potential of digital and to learn more about how they can engage with technology, particularly in Africa,” explains Anna Collard, SVP of content strategy and evangelist for KnowBe4 Africa. “Because of this, they are at risk of being left behind as the world moves into digital everything. They run the risk of remaining stuck in the professions that have been traditionally menial or traditionally labelled as those belonging to women. This dynamic has to change.”

Women bring a unique flavour to any business environment, and diversity can fundamentally change the innovative mindset of an organisation. This makes digital equality a critical touchpoint for both humanity and the organisation. For it is innovation that will disrupt the traditional and reshape the future. Yet, a study by the International Telecommunications Union (ITU) found that women in Africa are using the internet measurably less than men.

“The digital gender gap is not a perception, it is a reality, and if this continues, a large percentage of women will lose out,” says Collard. “To change this, we need to look at the primary causes of this gap and find inventive ways of bridging it.”

One of the first reasons for the gap remains the attitudes and norms perpetuated by patriarchal society. There is a lack of big data around women – a problem that author Caroline Criado-Perez dubbed ‘silencing half the world’s population’ – and this impacts gender across everything from healthcare to employment. The embedded attitudes and perceptions influence behaviour and attitudes, and is particularly persistent in African countries. This is further underscored by a survey undertaken by the OECD that found men tend to have priority over women when it comes to accessing the internet and often have control over what women can access on the internet.

“These are deep, ingrained, systemic barriers that are built on patriarchal thinking that are difficult to measure, but have a sustained impact on women,” says Collard. “Now add to this the fact that women of colour are more likely to be targeted by online hate speech, and that African girls are concerned about their online safety, and the entire picture is very much out of balance.”

A 2020 survey undertaken by KnowBe4 also found that digital literacy and cybersecurity education as a whole were lacking – not just around gender. Only 3.7% of the African teachers participating said that they offered cybersecurity as a subject and yet, this is a critical touchpoint for ensuring online safety.

“We need to move the lines, change the perceptions and embrace the idea of cyberfeminism,” concludes Collard. “We need to focus our efforts as individuals and organisations towards strengthening women’s rights, inventing into digital and data literacy and education, ensuring everyone has access to the internet, and integrating gender equity targets into national ICT policies.”

It is an issue that needs more awareness. But it also needs firmer commitment from industry, the public sector and organisations alike. If companies approach their talent acquisition strategies with a greater emphasis on gender equality, then more will be done to foster this talent from the ground up.

Kelechi Deca

Kelechi Deca has over two decades of media experience, he has traveled to over 77 countries reporting on multilateral development institutions, international business, trade, travels, culture, and diplomacy. He is also a petrol head with in-depth knowledge of automobiles and the auto industry

Disinfect your phone

August 18, 2021

By Anna Collard

Imagine if your mobile phone could be used to spy on you, listen to your conversations and send information and images from your device to a third party? This is not an imagined, dystopian future; it is the story of the Pegasus spyware put on mobile devices by clients of Israeli spyware software firm NSO. Although the Pegasus spyware is meant to be used by law enforcement only and is targeted at high-value individuals, this story provides some food for thought as, according to Anna Collard, SVP Content Strategy & Evangelist at KnowBe4 AFRICA (www.KnowBe4.com), mobile malware and spyware are not only aimed at the wealthy and the important – they can have a serious impact on anyone’s life.

“Other mobile threats such as banking malware for example use a similar process to the Pegasus spyware to get to users’ devices. “For example, many of these types of malware get installed by people clicking on a link that they received via SMS or WhatsApp and end up downloading a malicious app that could result in advertising click fraud, mobile ransomware, banking trojans or in some cases, even roots or jail breaks their phone to obtain full remote control over the device. The malware then allows for the criminals to listen to calls, take screenshots and see what the user types – catching passwords and banking details.”

Criminals use social engineering tools and approaches to lull users into a false sense of security. Pretending to be anything from a parcel tracking link to a banking confirmation link, these malware messages are designed to provoke people to make impulsive mistakes. And these mistakes can lead to your device being completely compromised, putting you and your financial security at risk.

“These smart malware infiltrations are designed to get past people’s defences,” says Collard. “Another form of distribution is taking advantage of devices that have not been updated or exploiting vulnerabilities on the phone or in apps that do not yet have patches. It is really important to ensure that your mobile devices are updated, and to ensure that you minimise risk by removing unnecessary apps, only downloading apps from official apps stores and by avoiding clicking on links from your mobile device.”

“Unfortunately, people are more likely to click on a link using their mobile device because they think they are safer than a computer. You need to be cautious and ensure that if you do not know the sender, you do not download anything or click on anything. Do not believe an SMS message that tells you to update your WhatsApp software or a link that tells you to update an app that comes through a social media platform. Always update from the App Store or Google Play, nowhere else.” Also, be aware of clickjacking, which is a form of mobile phishing that comes with an invisible link, which is covered by a “bothersome” graphic element that is made to look like a small hair or a speck of dust. This tricks the user into wiping the hair or dust off the mobile’s screen, which activates the link and launches a connection to the phishing site.

Keeping your mobile device free from infection means that you watch what you click, you do not trust unexpected links from unknown sources, do not share information with anyone – especially if they call and pretend they are from your mobile phone provider or bank – and do not provide people with your OTPs unless you have initiated the transaction with a trusted agent yourself. Mobile devices are as much at risk as computers, so stay aware, stay alert and stay secure.

Anna Collard is the founder of Popcorn Training – now KnowBe4 Africa; Cyber Security Awareness & Culture Evangelist

Kelechi Deca

Kelechi Deca has over two decades of media experience, he has traveled to over 77 countries reporting on multilateral development institutions, international business, trade, travels, culture, and diplomacy. He is also a petrol head with in-depth knowledge of automobiles and the auto industry

Hacking The Mind of Cybercriminals – How Threat Actors Think

June 28, 2021

The rise of cybersecurity challenges as a result of the activities of cybercriminals has necessitated the call for more online surveillance. Cybercriminals come in many different flavours, but the majority of them are in it for one thing: financial pay-off. They want the money that comes with offering their tools or services, selling stolen data, extortion like ransomware or plain fraud. And they all have one thing in common – your organisation is on their radar.

Anna Collard, SVP Content Strategy and Evangelist at KnowBe4 Africa

This is why it is critical to understand how cyber criminals operate, the tools they use and the approaches they take to embed robust security within the organization, says Anna Collard, SVP Content Strategy and Evangelist at KnowBe4 Africa.

“With ransomware going rampant and victim organisations paying up to millions of U.S. dollars to the extortionists, this problem is just going to get worse. The U.S. government recently announced that ransomware is a national cybersecurity challenge and that there will be serious implications for anyone attacking the United States or their critical infrastructure.

This may lead more criminals to shift their attention towards the emerging economies like Africa, where we do not have the government’s support or capacities to stop and prosecute cybercriminals, making it a safer place to operate,” says Collard.

People Hacking

Social engineering or people hacking are a popular way to distribute ransomware – predominately by tricking people into falling for their phishing scams.

“Another technique to be aware of is password spraying,” she explains.

“This is when the bad actor selects a common password, like the organisation’s name, followed by the year, and tries it against every user in the organisation. They scrape names of employees from LinkedIn and then using this information; try the possible password against the list of names. Then it keeps on cycling until it hits a winning entry. This is a solid case for ensuring that every single employee uses proper passwords or a password manager and multi-factor authentication where possible.

“This level of attack really underscores how important it is to undertake consistent employee training and security skills development,” says Collard.

“No matter how secure your perimeter, no matter how much money is spent on high-end security systems, one poor password can open the doors to the threat actors.”

Multi-Factor Authentication and Security Education – Keys for Online Safety

Multi-factor authentication and robust training are not just invaluable for employees in the office, they are even more critical today as people work from home and multiple locations – particularly as employees migrate to coffee shops for power and Wi-Fi during load-shedding. Public Wi-Fi is wide open and home networks with poor passwords or out of date software are open doors.

“It is also really important to make sure that employees use a VPN, although that is also not a guaranteed protection,” says Collard as a recent report by the Orange Cyber Defense team explained.

“With home routers being vulnerable due to people not configuring them correctly or updating them, it might be worthwhile sending pre-configured routers and firewalls to employees’ homes, especially for those who access highly confidential information.”

Another challenge for the organisation is keeping up with vulnerabilities and patch management, which is a complicated task in bigger environments.

“Leading hackers and experts like Kevin Mitnick are drawing lines under the importance of putting people’s understanding of these threats at the forefront,” says Collard.

“Make sure that passwords are secure, that they are not stored in diaries or on open platforms like Slack or Google Hangouts, that they understand how to identify social engineering attacks and keep security hygiene at the forefront of all communication. People need to know what is out there, and that they have the skills to play an important role in protecting themselves and the organisation.”

It’s the Small Mistakes that Cost the Most

Today, the threat actors are organised and well paid. They benefit immensely from their pursuit of vulnerabilities, simple mistakes and human error. Organisations have to sit on the sharp end of the security stick with robust monitoring and detection systems, clear policies, consistent training and security boundaries.

Kelechi Deca

Kelechi Deca has over two decades of media experience, he has traveled to over 77 countries reporting on multilateral development institutions, international business, trade, travels, culture, and diplomacy. He is also a petrol head with in-depth knowledge of automobiles and the auto industry

Organisation Calls for Creating of a Secure Culture

March 15, 2021

“There is a clear link between security culture and secure behaviour and that, in itself, correlates to a clear reduction in risk for the organisation,” this was the submission of Anna Collard, SVP Content Strategy and Evangelist, KnowBe4 Africa. According to her, “By improving your security culture, you are immediately improving employee behaviour and potentially plugging one of the biggest security gaps in every business – people. People are often the weakest link. The ones who click on the link, who open the phishing email, who share their company passwords and who accidentally create vulnerabilities within the organisation.”

Anna Collard, SVP Content Strategy and Evangelist, KnowBe4 Africa

Security. This is a word that can make a grown CFO tremble and an entire SOC crumble. It is the word that captures a complex landscape littered with complexity, cybercriminals and technology. It defines how well an organisation adheres to a growing body of legislation – GDPR, POPIA and other data protection regulations – and how its reputation fares when a breach is revealed and information exposed. Security should be on every boardroom agenda, in ongoing employee training, and in investment into the right tools and solutions. But, perhaps most importantly, security should be an inherent part of the company’s culture because it is this factor that ultimately determines its security risk and posture.

A recent study undertaken by KnowBe4 examined the behaviour and security culture of more than 97, 000 employees across 1, 115 organisations worldwide. The study dug down into the components and building blocks of security culture and unpacked how this has become a critical component for any robust security structure in a detailed whitepaper (https://bit.ly/3l7zVhP).

“IT leaders have always known exactly how important people are to the perfect security triumvirate – people, process and technology,” says Collard. “But, over the years, process and technology have been pushed to the forefront of investment and conversation, leaving the human element wide open and the business at risk. The reason for this shift is multi-fold – it’s hard to engage with a diverse workforce and the security message is not always that exciting.”

Yet, the research found a very clear proof that a robust security culture reduces the risk of credential sharing and improves the entire organisation’s security posture. In fact, it found that there was a 52x difference between the behaviours of people sharing credentials in a poor security class and the best which highlighted how a focus on security culture can significantly change the way employees adopt secure practices and behaviours. Which again underscores the value of setting up a security culture programme that explores the seven dimensions of security culture and how these can be improved within the organisation.

These seven dimensions include: attitude, behaviour, cognition, compliance, communication, norms and responsibility. And they provide the organisation with a solid framework within which to build an equally solid security culture that has longevity and relevance.

“The more that the business focuses on security culture, the more likely it is that employees will follow secure practices and adopt more secure behaviours,” concludes Collard. “This ground breaking research has provided a very clear and measurable link between security culture and secure behaviour and emphasises the value of investing into people, training and security communication best practice to ensure that this link is always maintained.”

Kelechi Deca

Kelechi Deca has over two decades of media experience, he has traveled to over 77 countries reporting on multilateral development institutions, international business, trade, travels, culture, and diplomacy. He is also a petrol head with in-depth knowledge of automobiles and the auto industry

Africa is a Goldmine of Cybersecurity Opportunities, Experts

November 28, 2020

Cyber experts have highlighted the huge business opportunities that exist in Africa especially in the field of cybersecurity even as the Internet of Things adoption grows exponentially in the continent. They are of the belief that Africa presents a wealth of opportunities for startups and innovators looking to address cybersecurity risk across the increasingly digitised continent. This submission was made by Anna Collard, SVP of Content Strategy & Evangelist for KnowBe4 Africa. Collard goes on to say that cybersecurity presents an incredible market opportunity in Africa, with the number of Internet users soaring and demand for IT security skills growing rapidly.

Anna Collard, SVP of Content Strategy & Evangelist for KnowBe4 Africa

“Security skills and services are in high demand everywhere. The number of African Internet users will double to one billion by 2022, and global cybersecurity spend will top $170.4 billion in 2022. At the same time, cybercrime is estimated to cost the global economy a total of $6 trillion by next year, and cybercriminals’ interest in Africa is growing, so it’s a ticking time bomb.”

Highlighting that one of the biggest challenges facing organisations around the world was a lack of skills to manage cybersecurity. “Worldwide, there are currently around four million vacancies in the cybersecurity field, and this is expected to rise to nearly 10 million in the coming years. In Africa, we only have approximately 10,000 certified cybersecurity professionals.”

In this environment, there are huge opportunities for individuals to upskill themselves as cybersecurity specialists, and for entrepreneurs and innovators to develop solutions to the growing cybersecurity challenge.

“In Africa, there are opportunities for startups offering managed cybersecurity services, niche security and forensics services, and for developers and innovators who build security into their solutions from the ground up.”

Collard says the demand for skills was so high that banks and financial services organisations were looking to launch their own cybersecurity academies; governments were working with the private sector to stimulate cybersecurity innovation. “More needs to be done to bring security skills into the school curriculum early; and to position cybersecurity as a prospective career choice, particularly for young women, who are underrepresented in the industry.”

Collard says recent KnowBe4 research in Africa’s education institutions found that only 3.7% offer cybersecurity awareness or training.

“The opportunities in this field extend far beyond becoming a certified cybersecurity specialist,” she points out. “We also need to see a security culture instilled in all organisations and cybersecurity taught from an early age since cybersecurity is no longer a technical skill – it is becoming a life skill.” Adding that “We need solutions to this problem – people will increasingly depend on secure digital platforms for everything they do, so they need to be taught how to do so safely.”

Kelechi Deca

Kelechi Deca has over two decades of media experience, he has traveled to over 77 countries reporting on multilateral development institutions, international business, trade, travels, culture, and diplomacy. He is also a petrol head with in-depth knowledge of automobiles and the auto industry

Women Account for Only 20% of the Cybersecurity Workforce

July 18, 2020

The Great Lockdown has opened the door to existing inequalities within the ICT industry especially in the area of cybersecurity. A new report released by Cybersecurity Ventures shows that women represent around 20% of the global cybersecurity workforce, and this is coming just two years after Frost & Sullivan pointed a menacing finger at the 1.8 million vacant cybersecurity seats by 2020 and the dearth of skills and people within an incredibly critical industry. There is a lack of female representation within this industry and a lack of actual skills needed to populate the growing number of requirements from organisations facing a rising cyber threat.

The answer, according to Anna Collard, MD of KnowBe4 Africa, is to encourage women to cross-skill and expand into cybersecurity roles and to make the industry more welcoming as a whole. “Cybersecurity isn’t just ones and zeros, it’s the people factor, it understands the nuances of business and the value of technology and being capable of managing multiple threads at the same time,” she adds, noting that “It can be project and people management, ethical hacking, coding as well as the ability to problem solve at speed. The industry is incredibly nuanced and this is what needs to be communicated to the next generation of cybersecurity professionals regardless of gender or education.”

This is not to say that women can’t dig themselves deep into technology, they obviously can. But Collard points out that cybersecurity has been made to feel more complicated than it actually is. Anyone can walk into this industry; all they need is a hunger for continuous learning. “Women need to see that taking on a role within cybersecurity is exciting, challenging and interesting. I certainly didn’t realise how varied and dynamic this space was until I fell into it, by accident. I studied International Economics and now I am the Managing Director of a company that’s dedicated to cybersecurity awareness training and development.”

Collard’s road from a student in Munich, learning about economics, interning in Singapore to the founder of a cybersecurity firm in South Africa wasn’t straight, but it was led by opportunity, mentorship and grit. People in the industry recognising the value that she added and how her skills could translate into cybersecurity. And this is key to changing the chromosome dynamic in this industry – providing women with the opportunity to expand their skills and explore new areas that previously they didn’t think were in their remit.

“I firmly believe in two things – mentorship and online resources,” says Collard. “Mentorship is critical to giving people, not just women, the confidence they need to explore this industry and the variety that it offers. Even more importantly, you can teach yourself whatever you need to know using online resources. I think that if a woman can teach herself how to make smoky eyes on YouTube, she can easily learn how to do anything in security. Anything.”

Collard has a point. Many professionals supplement their industry understanding with courses and research provided online. In fact, continuous professional development and a relentless curiosity are two key qualities that define a successful cybersecurity professional, no matter where they stand in the field.

“When I first started out, I did feel inferior to some of my male colleagues who had heavy tech backgrounds,” concludes Collard. “Then, I tapped into them as a resource and used their vast understanding and insight to help me upskilling myself. With their guidance and my own creative tendencies, I was able to see the bigger picture and develop a cybersecurity career that has seen me grow, and sell, my own cybersecurity business. This is an incredibly interesting and diverse industry where anyone open to learning can find a foothold, we just need to show them how.”

To fill the growing gaps in cybersecurity skills development and to improve gender diversity, the industry needs to demystify its perceived complexity and scrub away the sense that this is a male-dominated domain. This approach will not only help improve the imbalances in gender diversity but it will ignite an interest in the industry as a whole, filling in those gaping skill holes with much-needed talent from across all areas of business and market.

Kelechi Deca

Kelechi Deca has over two decades of media experience, he has traveled to over 77 countries reporting on multilateral development institutions, international business, trade, travels, culture, and diplomacy. He is also a petrol head with in-depth knowledge of automobiles and the auto industry