Cybersecurity risks come in many shapes, sizes, attack vectors, and levels of damage in the digital space. Regrettably, these cyber threats are rapidly growing and evolving, making the development of a lasting solution to counter these attacks difficult.
Ransomware is a type of malicious software, or malware, designed to deny access to a computer system or data until a ransom is paid. Ransomware is spread through phishing emails or by unknowingly visiting an infected website. It can be devastating to an individual or an organization. The data is released once payment is made to the attacker.
Usually, these demands come with a deadline and if the victim misses the deadline the data is erased forever or made public.
See Also: Benefits of Having an Insurance Broker
Unfortunately, Nigerians copy everything from the western world both good and bad. Imagine being locked out of all your emails addresses, bank applications and even your mobile phone or getting a warning/ransom email informing you the 5 last pages you’ve browsed on the internet with the first part your password would be released unless certain conditions are fulfilled and this is usually followed by an extortion request payable either in cash or transfer (most recently in use) in bitcoin (which is largely untraceable for now).
In recent times, there has been an upsurge in the use of bitcoin as a means of requesting and receiving a ransom. Last week, the city of Johannesburg, South Africa had to shut down its website, e-service platform and billing systems after a ransomware attack on its system by hackers who demanded 4 Bitcoins (about $30,000) as ransom. The city has refused to pay the ransom but still does not have access to parts of its site.
Earlier in the year, Dr Umar Ardo’s daughter, Aisha was kidnapped in Maitama, Abuja and her father had to pay $15,000 in Bitcoin for her release.
See Also: The Advantages of Having a Risk Manager
Large Energy Producers & Power Plants typically employed ‘Supervisory Control and Data Acquisition’ (SCADA) into their networks. However, SCADA seems to be the easiest targets for cyber hackers/terrorists.
Below are some of the most recent major cyber-attacks experienced:
Month/Year
|
Company Affected
|
Details of the Cyber Attack
|
Region
|
Jan-16
|
PetroBangla
|
The website of the company was hacked
few hours after the hacking
|
Asia-Pacific
|
Dec-15
|
Bharat Coking Coal Limited
|
The site was hacked for the 2nd time
in 3 months
|
Asia-Pacific
|
Dec-15
|
Saudi Aramco
|
Company received fake invoices which
resembled invoices of ONGC
|
EMEA
|
Dec-15
|
Ukrainian electricity distribution
companies
|
About 80,000 customers in Ukraine’s
Ivano-Frankivsk region experienced power cuts
|
|
Oct-15
|
British Gas
|
E mail addresses & passwords of
2,200 customers appeared online
|
EMEA
|
Oct-15
|
Oil & Natural Gas Corp
|
Company lost Rs 197 crores because of
an email fraud
|
Asia-Pacific
|
Jul-15
|
Korea Hydro & Nuclear Power
Corporation
|
The company's sensitive internal data
was leaked online on 8th July 2015
|
Asia-Pacific
|
May-15
|
Charles Harvey Eccleston, former
employee of Department of Energy
|
Eccleston was charged with an
attempted email “spear-phishing” attack in January 2015 targeting Department
of Energy employee email accounts
|
N.America
|
Apr-15
|
UP Power Corporation Limited
|
The company's online billing system
was hacked and power bills of consumers was affected
|
Asia-Pacific
|
Dec-14
|
Indian Oil Corp Ltd
|
The company's website was hacked by a
Turkish group named 'TurkGuvenligi'
|
Asia-Pacific
|
Dec-14
|
Korea Hydro and Nuclear Power Co Ltd
|
Hackers sent 5,986 phishing emails
containing malicious codes to 3,571 employees of the nuclear plant operator
to extract sensitive information
|
Asia-Pacific
|
Nov-14
|
Pemex
|
The mail box of 'Emilio Lozoya
Austin', CEO of Pemex was hacked
|
LATAM
|
The surge of cryptocurrencies and bitcoin-related Ponzi schemes has not been regulated by the Securities and Exchanges Commission or the Central bank of Nigeria. Both entities have warned Nigerians not to invest in such schemes.
Criminals are adopting crypto-ransoms
The appeal of Cryptocurrency is the inconspicuousness it gives the account holder. All a person needs to open an account is a digital address (more or less, a numbered account with no identity attached to it). There is no limit to the number of accounts a person can hold and nothing links any of the accounts.
Some simple ransomware attacks can be reversed by an expert, more advanced attacks are not decryptable.
See Also: 7 Types of Insurance you need to Protect Your Business
See Also: 7 Types of Insurance you need to Protect Your Business
How Ransomware Works
There are two major forms of ransomware are encryptors and screen lockers. Encryptors, lock data on a system making all content unusable without a decryption key. Screen lockers just block access to the system with a “lock” screen indicating it’s been encrypted.
The victim is thereafter notified to buy cryptocurrency such as Bitcoin to pay the ransom. Upon receipt of payment, the attacker sends the victim a decryption key and, in some cases, these keys never come and the information is either destroyed or released to the public.
Who Creates Cyber Exposures
How to Protect Yourself
⦁ Ensure your email passwords are secure and use anti-virus scanners that scan for malicious software, documents
⦁ Install antiviruses defend your online surfing and identify malicious online adverts.
⦁ For Organisations: Ensure your servers, backups, network is monitored constantly in case a crash. Having an up to date and secure back up reduces susceptibility to extortion.
⦁ Restrict access to free and unprotected Wi-Fi and mobile apps
⦁ Be wary about the websites you visit and the people who have access to your devices such as laptops, mobile phones, tablets, etc.
See Also: Why You Must Save Towards Retirement
Ultimately there are experts in the Cybersecurity and Insurance industries who advise on the mitigation and exposures of cyber risks. Although the appetite for insuring cyber risks in Nigeria is low due to the special nature of the risks and it is not fully understood by local underwriters.
Insurances for this risk can be purchased in foreign markets through local underwriters who insure a part of the risk and then cede the excess/remainder part to the international market who have the capacity and Technical Know-How to underwrite and administer Cyber Insurance policies.
For more information on Cyber Insurances available in the Nigerian market contact our Risk Engineering subsidiary The Industrial Risk Protection Consultants (IRPC) via email info@irpc.com.ng or call 0700 225 5426
⦁ Ensure your email passwords are secure and use anti-virus scanners that scan for malicious software, documents
⦁ Install antiviruses defend your online surfing and identify malicious online adverts.
⦁ For Organisations: Ensure your servers, backups, network is monitored constantly in case a crash. Having an up to date and secure back up reduces susceptibility to extortion.
⦁ Restrict access to free and unprotected Wi-Fi and mobile apps
⦁ Be wary about the websites you visit and the people who have access to your devices such as laptops, mobile phones, tablets, etc.
See Also: Why You Must Save Towards Retirement
Ultimately there are experts in the Cybersecurity and Insurance industries who advise on the mitigation and exposures of cyber risks. Although the appetite for insuring cyber risks in Nigeria is low due to the special nature of the risks and it is not fully understood by local underwriters.
Insurances for this risk can be purchased in foreign markets through local underwriters who insure a part of the risk and then cede the excess/remainder part to the international market who have the capacity and Technical Know-How to underwrite and administer Cyber Insurance policies.
For more information on Cyber Insurances available in the Nigerian market contact our Risk Engineering subsidiary The Industrial Risk Protection Consultants (IRPC) via email info@irpc.com.ng or call 0700 225 5426