Cybersecurity priorities for the public sector

Introduction

Globally, massive cybersecurity breaches have become almost commonplace, regularly grabbing headlines that alarm organisations, big and small, and government institutions, citizens, the general public and the business community. But for all of the attention such incidents have attracted in recent years, many government institutions, parastatals and county governments still struggle to understand and manage emerging cyber risks in an increasingly complex digital society. As our reliance on data and interconnectivity increases, developing resilience to withstand cyber shocks—that is, large-scale events with cascading, disruptive consequences—has never been more important.

Several trends observed in 2019 continued to dominate the landscape in 2020. The threat to governments’ general elections from information operations remains high, as does the risk of attacks against critical public infrastructure. Traditional techniques such as phishing emails remain a highly prevalent infiltration method for both criminal and espionage actors.

Financially motivated attacks have increased in prominence, mostly targeting mobile payment platforms which are connected to core banking systems. New trends have also emerged, including a more concerted move towards attacks related to data leakage, both personal data and corporate data.

The rapid adoption of a digital economy in Kenya has led to more business operations being conducted online. This phenomenon provides immense opportunity for efficient service delivery by improving relationships between service providers and the general public.

However, in seizing these opportunities, public organisations become more vulnerable to an increasing number of evolving cyber threats. Indeed, any organisation that uses technology, whether storage devices or even email, will be susceptible to an online attack.

Managing the threat of cyber attack As access to the internet expands, so do cybercrime rates in Africa where businesses and governments are starting to face a new type of threat for which few are currently prepared. According to the Communications Authority of Kenya, the internet penetration rate in Kenya is 41% and about 89% of the population are active internet users. These statistics are expected to continue rising as internet penetration continues to improve in towns and rural areas.

Only a minority of countries in Africa have taken steps in anticipation of the cybercrime problem posed by the development of the online financial industry in Africa. Kenya has drafted a Computer Misuse and Cybercrimes Act in 2018 to set up a legal framework that will allow lawmakers and enforcement agencies to establish legal grounds for the investigation and prosecution of cybercrime matters. However, laws are not enough to help protect organisations and businesses from an increasingly sophisticated type of threats.

To effectively manage cyber attacks, public organisations must broaden their focus beyond just security and technology and develop a high-level, senior government and official-driven enterprise-wide playbook to deal with such threats. Such a strategy requires the central government and county governments to take ownership of cyber risk, and be willing to commit the resources required to address it. Failure to do so could result in damage to government institutions operations, reputation, brand and intellectual property.