Page 1,785«..1020..1,7841,7851,7861,787..1,7901,800..»

Biden Administration Toughens Sanctions, Export Controls in Response to Continued Harmful Activities of the Russian Government – JD Supra

September 21, 2022 | Author: admin

On September 15, 2022, the Biden Administration announced a new package of sanctions and export controls to hold the Russian government accountable for its war against Ukraine. These new measures were implemented by the U.S. Departments of State, Treasury, and Commerce and include new sanctions designations, a prohibition on the provision of quantum computing services to any person in Russia, and enhanced export control restrictions on Russia and Belarus.

U.S. Government Expands Sanctions on Facilitators of Russias Aggression in Ukraine

The Department of the Treasurys Office of Foreign Assets Control (OFAC) imposed blocking sanctions on 2 entities and 22 individuals. The new Specially Designated National (SDN) targets include individuals who have furthered the Russian governments objectives in Ukraine, including some individuals connected to human rights abuses, as well as leaders of key financial institutions, and other entities serving Russias financial market infrastructure.

In addition to the OFAC designations, the State Department also made several designations, primarily targeting Russias defense and high-tech industries as well as certain officials. For example, the State Department designated the Russian electronics manufacturer Limited Liability Company Group of Companies Akvarius (Aquarius), which has been involved in the development of secure smartphones for Russian military and intelligence personnel. Alongside this designation, OFAC issued General License No. 51 to permit the wind down of transactions involving Aquarius (or any entity in which it directly or indirectly 50 percent owns) through 12:01 a.m. Eastern Daylight Time, October 15, 2022.

OFAC Bans Provision of Quantum Computing Services and Cautions Financial Institutions

OFAC issued a determination pursuant to Executive Order (EO) 14071 prohibiting the exportation, reexportation, sale, or supply, directly or indirectly, from the United States, or by a United States person, wherever located, of quantum computing services to any person located in the Russian Federation. This prohibition is designed to cut off Russias access to key services from U.S. companies and is effective October 15, 2022.

OFAC issued guidance with this determination indicating that quantum computing services include any of the following services when related to quantum computing, quantum computers, electronic assemblies thereof, or cryogenic refrigeration systems related to quantum computing: [1] infrastructure, web hosting, or data processing services; [2] custom computer programming services; [3] computer systems integration design services; [4] computer systems and data processing facilities management services; [5] computing infrastructure, data processing services, web hosting services, and related services; [6] repairing computer, computer peripherals, or communication equipment; [7] other computer-related services; [and] [8] services related to the exportation, reexportation, sale, or supply, directly or indirectly, of quantum computing, quantum computers, electronic assemblies thereof, or cryogenic refrigeration systems related to quantum computing to any person located in Russia (i.e., an individual who is a citizen or national of the Russian Federation, or an entity organized under the laws of the Russian Federation).

Exceptions to the new ban include any service to an entity located in Russia that is owned or controlled, directly or indirectly, by a U.S. person; and any service in connection with the wind down or divestiture of an entity located in Russia that is not owned or controlled, directly or indirectly, by a Russian person.

In addition, OFAC issued a determination that Section 1(a)(i) of EO 14024 applies to the quantum computing sector of the Russian Federation economy, and, as a result, OFAC can impose sanctions on any person operating in this sector of the Russian economy.

OFACs quantum computing restrictions complement the new export restrictions on quantum computing hardware, software, and technology summarized below, as well as the State Departments sanctions on Russian companies in the quantum computing space.

Apart from targeting quantum computing services, OFAC also cautioned non-U.S. financial institutions, warning that they could be sanctioned for materially assisting sanctions targets or sanctioned activities, including for entering certain agreements with the National Payment Card System (NSPK), an entity owned by the Central Bank of Russia that operates Russias MIR National Payment System. Any such agreements that expand the use of the MIR National Payment System, which clears and settles payments primarily in Russia, could support evasion of U.S. sanctions and result in an SDN designation.

Commerce Expands Export Controls on Russia and Belarus

In conjunction with the sanctions measures, the Commerce Departments Bureau of Industry and Security (BIS) issued a new rule to expand and tighten export controls on Russia and Belarus. These heightened export control restrictions, which took effect September 15, 2022, are intended to further limit access to items that enable Russians military capabilities and sources of revenue that could support Russias military capabilities, thus enhancing the effectiveness of the multilateral sanctions.

First, the rule expands the industry sector sanctions in Section 746.5 of the Export Administration Regulations (EAR), which impose a licensing requirement for exports, reexports, and transfers (in-country) of certain EAR99 items. The rule adds Belarus to the scope of the industry sector sanctions, which formerly only applied to Russia, in an effort to prevent diversion of these items to Russia.

The rule also adds export restrictions on EAR99 items that may support Russias chemical and biological weapons production capabilities, along with items that enable advanced manufacturing. These items are identified in new Supplement No. 6 to Part 746, and examples include: discrete chemicals (identified by Chemical Abstract Numbers or CAS), biologics, fentanyl, precursors, and related equipment such as full face-mask air-purifying and air-supplying respirators, fermenters, reaction vessels, certain laboratory equipment, and nucleic acid synthesizers and assemblers.

Additionally, the new restrictions cover quantum computing and advanced manufacturing hardware, software, and technology. These items are now covered by the Russia/Belarus foreign direct product rule as well, which, prior to this new rule, did not apply to foreign-produced items that would be designated as EAR99 if manufactured in the United States.

Note that BIS previously imposed a license requirement for exports, reexports, and transfers to and within Russia on a broad range of other EAR99 industrial sector inputs and products. The new rule also adds items to this list in Supplement No. 4 of Part 746, which now includes, for example, fork-lift trucks, integrated circuits, and cameras. These controls and licensing requirements also now cover any modified or designed parts, components, accessories, or attachments for the listed equipment, other than fasteners and certain specified minor components. These changes are intended to align the EARs controls with those of U.S. allies.

Second, the rule expands the military end use/end user (MEU) and military-intelligence end use/end user (MIEU) controls applicable to Burma, Belarus, Cambodia, China, Russia, and Venezuela. The rule expands the scope of BISs is informed process authority so that BIS can quickly provide notice to exporters that exports of specified items to an identified party require a license in the interests of U.S. national security or foreign policy.

Notably, the new rule also allows BIS to designate military and military-intelligence end users located worldwide. Entities located outside of the countries directly subject to the MEU/MIEU controls will be specifically identified on BISs MEU List or Entity List, or, in the case of the MIEU controls, in Section 744.22 of the EAR, in an effort to help alleviate diligence burdens on U.S. industry. BIS cautioned that for military and military-intelligence end users located in Burma, Belarus, Cambodia, China, Russia, and Venezuela, exporters are expected to continue conducting due diligence as to whether such entities meet the regulatory definitions of these terms. In other words, even if not specifically listed in the MEU List, for example, the MEU controls continue to apply to entities located in Burma, Belarus, Cambodia, China, Russia, and Venezuela if they develop, produce, maintain, or use military items.

Third, this rule adds dollar value exclusion thresholds for luxury goods identified in Supplement No. 5 to Part 746. As background, in March 2022, BIS implemented restrictions prohibiting, without a license, exports, reexports, and transfers of certain luxury goods to Russia and Belarus, as well as certain Russian and Belarusian oligarchs and malign actors who have been sanctioned under various Russia- and Ukraine-related EOs (regardless of where they are located). The new dollar value thresholds are intended to align U.S. controls with those of U.S. allies.

Fourth, the rule makes several clarifications and corrections to existing export controls on Russia and Belarus. For example, the rule updates the list of items eligible for export to Russia and Belarus under License Exception Consumer Communications Devices (CCD) in Section 740.19 of the EAR, which permits exports of certain communications devices to individuals and non-governmental organizations in Russia, Belarus, and Cuba. Examples of eligible items added to the list include tablets, microphones, speakers, and commercial headphones. To promote the free flow of information, even those items subject to the Russian and Belarusian industry sector sanctions and luxury goods controls discussed above are eligible for License Exception CCD.

The BIS rule also clarifies that the more favorable treatment policy for affiliates of U.S. and allied country entities, including for exports of mass market items to Russia and Belarus as well as eligibility for License Exception ENC, also applies to branch and sales offices of companies headquartered in the United States or a Country Group A:5 or A:6 country. Formerly, such treatment only explicitly applied to separately incorporated subsidiaries and joint ventures.

In addition, BIS added an exclusion to the licensing requirements to permit the movement of an item subject to the EAR within Russia or Belarus for the purposes of returning it to the United States or to a Country Group A:5 or A:6 country, provided the owner retains title to and control of the item while it remains in Russia or Belarus.

The new restrictions build on existing sanctions and export controls on Russia, Belarus, and certain regions of Ukraine. We wrote about those measures in previous Alerts, most recently including: Biden Administration Adds Economic Measures Against Russia During G7 Meeting New Tariffs, Gold Import Restrictions, Sanctions and Export Designations, New U.S. Sanctions and Export Restrictions Target Professional Services and Russias Media, Banking, Defense, and Industrial Sectors, Biden Administration Increases Sanctions, Export Control Restrictions Amid Russias Continued Aggression in Ukraine, Treasury, Commerce Target Russias Tech Sector, Defense Industrial Base.

[View source.]

Read more from the original source:
Biden Administration Toughens Sanctions, Export Controls in Response to Continued Harmful Activities of the Russian Government - JD Supra

Read More..
Posted in Quantum Computing | Leave a Comment

What is Internet Security? – Kaspersky

September 21, 2022 | Author: admin

What is internet security? - Definition and meaning

Internet security is a term that describes security for activities and transactions made over the internet. Its a particular component of the larger ideas of cybersecurity and computer security, involving topics including browser security, online behavior and network security. We spend a large proportion of our lives online, and some of the internet security threats we can encounter include:

Individuals and organizations can protect themselves from these kinds of threats by practicing internet security.

To ensure privacy and security on the internet, its important to be aware of different types of internet attacks. Common internet security threats include:

Phishing is a cyber-attack involving disguised emails. Hackers try to trick email recipients into believing that a message is genuine and relevant a request from their bank or a note from a co-worker, for example so that they click on a link or open an attachment. The goal is to deceive people into handing over their personal information or downloading malware.

Phishing is one of the oldest internet security threats, dating back to the 1990s. It has remained popular to this day since it is one of the cheapest and easiest ways for criminals to steal information. In recent years, phishing techniques and messages have become increasingly sophisticated.

Hackers are always looking to exploit a private network or system's vulnerabilities so they can steal confidential information and data. Remote access technology gives them another target to exploit. Remote access software allows users to access and control a computer remotely and since the pandemic, with more people working remotely, its usage has increased.

The protocol which allows users to control a computer connected to the internet remotely is called Remote Desktop Protocol, or RDP. Because businesses of all sizes so widely use RDP, the chances of an improperly secured network are relatively high. Hackers use different techniques to exploit RDP vulnerabilities until they have full access to a network and its devices. They may carry out data theft themselves or else sell the credentials on the dark web.

Malware is a portmanteau of "malicious" and "software". It's a broad term related to viruses, worms, trojans, and other harmful programs that hackers use to cause havoc and steal sensitive information. Any software intended to damage a computer, server, or network can be described as malware.

Malvertising is a portmanteau of malicious and advertising. The term refers to online advertising, which distributes malware. Online advertising is a complex ecosystem involving publisher websites, ad exchanges, ad servers, retargeting networks, and content delivery networks. Malvertisers exploit this complexity to place malicious code in places that publishers and ad networks dont always detect. Internet users who interact with a malicious ad could download malware onto their device or be redirected to malicious websites.

Ransomware is a type of malware that prevents you from using your computer or accessing specific files on your computer unless a ransom is paid. It is often distributed as a trojan that is, malware disguised as legitimate software. Once installed, it locks your systems screen or certain files until you pay.

Because of their perceived anonymity, ransomware operators typically specify payment in cryptocurrencies such as Bitcoin. Ransom prices vary depending on the ransomware variant and the price or exchange rate of digital currencies. It isnt always the case that if you pay, the criminals will release the encrypted files.

Ransomware attacks are on the rise, and new ransomware variants continue to emerge. Some of the most talked-about ransomware variants include Maze, Conti, GoldenEye, Bad Rabbit, Jigsaw, Locky, and WannaCry.

The term botnet is a contraction of robot network. A botnet is a network of computers that have been intentionally infected by malware so they can carry out automated tasks on the internet without the permission or knowledge of the computers owners.

Once a botnets owner controls your computer, they can use it to carry out malicious activities. These include:

Computers become part of a botnet in the same ways that they are infected by any other type of malware for example, opening email attachments that download malware or visiting websites infected with malware. They can also spread from one computer to another via a network. The number of bots in a botnet varies and depends on the ability of the botnet owner to infect unprotected devices.

Public Wi-Fi carries risks because the security on these networks in coffee shops, shopping malls, airports, hotels, restaurants, and so on is often lax or non-existent. The lack of security means that cybercriminals and identity thieves can monitor what you are doing online and steal your passwords and personal information. Other public Wi-Fi dangers include:

You don't have to worry so much about someone spying on the Wi-Fi network at home because you own the network hardware. But there are still threats in the US, internet service providers (ISPs) are allowed to sell data about their users. While the data is anonymized, it can still be an unsettling thought for those who value privacy and security on the internet. A VPN at home makes it much harder for outsiders to correlate your online activity to you.

If you are wondering how to ensure internet protection and how to protect your data online, sensible internet security tips you can follow include:

Multifactor authentication (MFA) is an authentication method that asks users to provide two or more verification methods to access an online account. For example, instead of simply asking for a username or password, multifactor authentication goes further by requesting additional information, such as:

Multifactor authentication decreases the likelihood of a successful cyber-attack. To make your online accounts more secure, it is a good idea to implement multifactor authentication where possible. You can also consider using a third-party authenticator app, such as Google Authenticator and Authy, to help with internet security.

A firewall acts as a barrier between your computer and another network, such as the internet. Firewalls block unwanted traffic and can also help to block malicious software from infecting your computer. Often, your operating system and security system come with a pre-installed firewall. It is a good idea to make sure those features are turned on, with your settings configured to run updates automatically, to maximize internet security.

Our browsers are our primary gateway to the web and therefore play a key role in internet security. A good web browser should be secure and help to protect you from data breaches. The Freedom of the Press Foundation has compiled a detailed guide here, explaining the security pros and cons of the leading web browsers on the market.

A strong password will help you maintain internet security. A strong password is:

These days, its no longer enough to substitute lookalike characters for letters or numbers for example, P@ssw0rd for password since hackers are wise to it. The more complex and involved your password, the harder it is to crack. Using a password manager will help by generating, storing, and managing all your passwords in one secure online account.

Keep your passwords private avoid sharing them with others or writing them down. Try to avoid using the same password for all your accounts and remember to change them regularly.

Internet security antivirus is critical for ensuring privacy and security online. The best internet security software protects you from different types of internet attacks and protects your data online. Its important to keep antivirus software up to date most modern programs update themselves automatically to stay on top of the latest internet security threats.

Internet security for kids is critical protecting children from harmful or inappropriate content and contacts, as well as malicious software or attacks. Teaching your children online safety tips can help to keep them safe.

Children are spending more and more time online, and its important to talk to them about how to stay safe on the internet. Making sure that kids know what information to keep private online is essential, for example explaining why they need to keep their passwords private, and not give out personal information. Keeping the computer in a common area, where you can watch and monitor its use, can also be a useful way of ensuring children use the internet safely.

Many kids enjoy watching YouTube videos. So, to make this a safer experience, you can use YouTube parental controls. You may also want to use YouTubes dedicated app for children, YouTube Kids. This provides a more child-friendly interface, and videos on the app are reviewed by a combination of human moderators and automated filters to help ensure videos are appropriate for younger children.

Email was designed to be as open and accessible as possible, to allow people to communicate with each other. The drawback of this accessibility is that certain aspects of email are not secure, allowing attackers to use emails to cause internet security problems.

Email security refers to the methods used to protect email accounts and correspondence against unauthorized access, loss, or compromise. Given that email is often used to spread malware, spam, and phishing attacks, email security is an important aspect of internet security.

Spam emails also known as junk emails are unsolicited messages sent out in bulk. Most email providers use algorithms to filter out spam messages, but they can still appear in your inbox despite this. Steps to take include:

If you do find yourself overwhelmed with spam, it could be a sign that your email address has been exposed in a data breach. When this happens, it is recommended to change your email address.

Network security refers to any activity designed to protect the usability and integrity of your network and data. It targets a variety of threats and stops them from entering or spreading on your network.

Your Wi-Fi router is an essential aspect of internet security. It checks all incoming and outgoing traffic and controls access to your Wi-Fi network and, through that, your phones, computers, and other devices. Router security has improved in recent years, but there are still steps you can take to enhance internet protection.

Changing the default settings of your router, such as the default router name and login details, is an important first step. This can help to make your Wi-Fi network less of a target for potential hackers, as it indicates that the router is being actively managed.

There are various features and settings you can disable to increase the security of your Wi-Fi router. Features such as remote access, Universal Plug and Play and Wi-Fi Protected Set-Up can all be taken advantage of by malware programs. While they may be convenient, turning them off makes your home network safer.

The best way to protect your data online when using public Wi-Fi is to use a virtual private network (VPN). A VPN creates an encrypted tunnel between you and a remote server operated by a VPN service. All your internet traffic is routed through this tunnel, which makes your data more secure. If you connect to a public network using VPN, other people on that network should not be able to see what you are doing providing enhanced internet protection.

The Internet of Things (IoT) is a term used to describe physical devices other than computers, phones, and servers, which connect to the internet and can collect and share data. Examples of IoT devices include wearable fitness trackers, smart refrigerators, smart watches, and voice assistants like Amazon Echo and Google Home. It is estimated that by 2026, there will be 64 billion IoT devices installed around the world.

All these devices connected to the internet create new opportunities for information to be compromised. Not only is more data than ever being shared through the IoT, but the nature of that data is often highly sensitive. This underlines the need to be aware of internet security threats and to practice good cybersecurity hygiene.

Mobile security refers to the techniques used to secure data on mobile devices such as smartphones and tablets and is another aspect of internet protection.

Your smartphone can be vulnerable to tapping, especially if it has been jailbroken or rooted. Phone tapping can allow third parties to listen to your calls or read messages. If youre concerned your phone may have been hacked, you can look out for signs like unusual background noise on calls, your phones battery depleting faster than usual, or behaving in strange ways.

If your phone seems to be turning itself on or off without your input, or if apps appear that you dont remember installing yourself, that could indicate that somebody else has access to your phone. Receiving strange SMS messages, containing a garbled series of letters and numbers, or getting a higher than usual phone bill could also indicate phone tapping.

If you have concerns about your mobile security, you can read more mobile security advice here.

Spoofing generally involves cybercriminals trying to convince you that information is coming from a trusted source. Phone spoofing is when scammers deliberately falsify the information which appears on your caller ID to disguise their identity. They do this so that victims think an incoming call is coming from their local area or a number they recognize.

To stop phone spoofing, check to see if your phone carrier has a service or app that helps identify and prevent spam calls. You can also look into third-party apps such as RoboKiller or Nomorobo to help you screen calls but be aware that these apps require you to share private data with them.

Often, if you receive a call from an unknown number, the best thing to do is not answer it. Answering scam calls is a bad idea because the scammers then perceive you as a potential target.

If youre seeing signs that your smartphone has spyware, look at the apps installed on your device. Remove anything that you are unsure of, or dont remember installing.

Updating your phones operating system can help, as can more extreme measures such as resetting your phone to factory settings. While this might be inconvenient, it can be well worth doing if youre concerned that your phone security has been compromised.

You can use Kaspersky Internet for Android to identify and remove malicious viruses and malware from Android phones. Our detailed article on how to remove a virus from Android explains how you can also do this manually.

So, what are the best internet protection methods? Follow these best practices to protect yourself from internet security threats and different types of internet attacks:

The best internet security software will protect you from a range of internet security threats, including hacking, viruses, and malware. A comprehensive internet security product should be able to locate device vulnerabilities, block cyberthreats before they take hold, and isolate and remove immediate dangers.

Webcam hacking is when hackers access your mobile and computer cameras and record you. This internet security threat is known as camfecting. The number of recorded attacks is relatively low, although most occur without the victim ever realizing they have been compromised, which means they go unaccounted for.

One lo-fi way to block webcam access is by using duct tape but in a world where many people use video conferencing every day for work or keeping in touch, its not feasible to do this. A much better prevention method is to use an antivirus solution that offers webcam protection Kaspersky Internet Security offers this feature. Its also a good idea to turn your desktop or laptop computer off when not in use.

Ad blockers clear web pages of ads and by blocking ads from displaying, you remove the risk of seeing and clicking on an ad that may be harmful. Ad blockers also have other benefits. For example, they may reduce the number of cookies stored on your machine, increase your internet privacy by reducing tracking, save bandwidth, help pages load faster, and prolong battery life on mobile devices.

Some adblockers are free, while others cost money. Bear in mind that not all ad blockers block every online ad, and some websites may not run properly if you have the ad blocker turned on. You can, however, enable adblockers to allow online ads from specific websites.

Parental controls refer to the settings that enable you to control what content your child can see on the internet. Parent controls, used in conjunction with privacy settings, can help increase internet security for kids. Setting up parental controls varies by platform and device Internet Matters has a comprehensive series of step-by-step guides for each platform. You can also consider the use of a parental control app, such as Kaspersky Safe Kids.

A PC cleaner is a tool that removes unnecessary and temporary files and programs from your system. Kaspersky Total Security has a PC cleaner feature that allows you to find and remove applications and browser extensions you rarely use or that were installed without your consent.

Internet protection these days needs to cover all the devices we use to go online laptops, desktops, smartphones, and tablets. The best internet security software will allow you to install the antivirus program on multiple devices, giving you cross-platform protection from internet security threats.

Online shopping security tips to remember include:

Online banking security tips include:

In a world where we spend much of our lives online, internet security is an important issue. Understanding how to overcome internet security threats and different types of internet attacks is the key to staying safe and protecting your data online.

Kaspersky Internet Security received two AV-TEST awards for the best performance & protection for an internet security product in 2021. In all tests Kaspersky Internet Security showed outstanding performance and protection against cyberthreats.

Related Articles:

View post:
What is Internet Security? - Kaspersky

Read More..
Posted in Internet Security | Leave a Comment

The Employer Benefit Of Employee Cyber Security – Employee Benefits & Compensation – United States – Mondaq

September 21, 2022 | Author: admin

To print this article, all you need is to be registered or login on Mondaq.com.

Published: New Hampshire Business Review

September 15, 2022

Many business leaders and human resources professionals believethat cyber security is the responsibility of their informationtechnology staff and managed services provider. However, ensuringthat employees and their families have appropriate cyber securityprotection is an employee benefit that benefits employers aswell.

Mistakes, lack of awareness, and general vulnerability ofemployees remains the most significant cyber security risk for mostemployers. Simply training employees about cyber threats typicallyfails to reduce that risk sufficiently. To have a truly cybermature workforce, employers need to engage employees in cybersecurity. Teaching employees about the threats to themselves andtheir families, and making personal protection services availableto them, is a much better method to engage employees in cybersecurity.

Training. Cyber security training is not mostpeople's idea of a good time. However, employees sit up andtake notice when trainers talk to them about the prevalence andseverity of the cyber threats to themselves personally, includingtheir identities, credit files, financial accounts, personaldevices, and home networks. Additionally, explaining that theiraging parents and children face these same threats never fails toget employees meaningfully engaged. Employers can then translatethat personal engagement into an increased awareness and commitmentto the cyber security policies and practices that protect thebusiness.

The following are a few training opportunities that typicallymotivate employees: (a) taking control of your credit bureauaccounts, extinguishing fraudulent or unnecessary credit, andfreezing or locking your credit; (b) obtaining identity, credit,and financial crime protection for yourself and your family; (c)ensuring that your personal financial accounts are secure fromtheft; (d) hardening your home network and online accounts; and (e)ensuring the online safety of yourself and your family members.

Identity, Credit and Financial CrimeProtection. Employers seeking a deeper and longer-lastingengagement from employees also offer certain personal protectionservices as an employee benefit. By doing so, employers demonstratethat they have the same level of commitment to their employees'personal cyber welfare as they are asking from those employees withrespect to the cyber security of the business.

These benefits typically include either a fully or partiallypaid subscription to a third-party service that monitors the creditbureaus, Internet, dark web, and other online resources for theftor misuse of the identity of the employee and his or her familymembers, and fraud specialists to restore an individual'scredit and identity in the event of theft or misuse. Such asubscription also can include reimbursement for funds stolen as aresult of cyber scams.

Employers are increasingly finding that these services are beingoffered by their existing employee benefits providers as extensionsof other benefits, such as health insurance. Employers also cansecure subscription services directly from the third-partyproviders, typically at discounted rates for their employeepopulations.

Personal Accounts and Residential Networks.Employers also benefit from making certain other safeguardsavailable to help employees protect their home networks and theirpersonal email, social media, financial, and other online accounts.The work-from-home model necessitated by the pandemic (and likelyto remain in some form permanently) highlighted the threats toemployers of employees accessing business systems from insecureresidential and public Wi-Fi networks. Likewise, the insecurity ofpersonal accounts are common points of entry for hackers to exploitto access business systems through employee devices.

To mitigate these risks, employers are helping employees withresidential firewalls, personal virtual private networks (VPNs),and password management applications for themselves and theirfamilies. These measures are becoming increasingly availablethrough the subscriptions services discussed above. Additionally,many employers are realizing that these safeguards are particularlyimportant for business owners, executives, and other managementemployees who have remote access to financial, personnel, and otherhighly sensitive information.

For a business to meaningfully reduce its vulnerability to cyberattack, it must truly engage its employee population in cybersecurity. One of the most effective techniques to do so is to teachand empower them to protect themselves and their families, thentranslate that engagement into a heightened awareness and mutualcommitment to protect the business as well.

Many business leaders and human resources professionals believethat cyber security is the responsibility of their informationtechnology staff and managed services provider. However, ensuringthat employees and their families have appropriate cyber securityprotection is an employee benefit that benefits employers aswell.

Mistakes, lack of awareness, and general vulnerability ofemployees remains the most significant cyber security risk for mostemployers. Simply training employees about cyber threats typicallyfails to reduce that risk sufficiently. To have a truly cybermature workforce, employers need to engage employees in cybersecurity. Teaching employees about the threats to themselves andtheir families, and making personal protection services availableto them, is a much better method to engage employees in cybersecurity.

Training. Cyber security training is not mostpeople's idea of a good time. However, employees sit up andtake notice when trainers talk to them about the prevalence andseverity of the cyber threats to themselves personally, includingtheir identities, credit files, financial accounts, personaldevices, and home networks. Additionally, explaining that theiraging parents and children face these same threats never fails toget employees meaningfully engaged. Employers can then translatethat personal engagement into an increased awareness and commitmentto the cyber security policies and practices that protect thebusiness.

The following are a few training opportunities that typicallymotivate employees: (a) taking control of your credit bureauaccounts, extinguishing fraudulent or unnecessary credit, andfreezing or locking your credit; (b) obtaining identity, credit,and financial crime protection for yourself and your family; (c)ensuring that your personal financial accounts are secure fromtheft; (d) hardening your home network and online accounts; and (e)ensuring the online safety of yourself and your family members.

Identity, Credit and Financial CrimeProtection. Employers seeking a deeper and longer-lastingengagement from employees also offer certain personal protectionservices as an employee benefit. By doing so, employers demonstratethat they have the same level of commitment to their employees'personal cyber welfare as they are asking from those employees withrespect to the cyber security of the business.

These benefits typically include either a fully or partiallypaid subscription to a third-party service that monitors the creditbureaus, Internet, dark web, and other online resources for theftor misuse of the identity of the employee and his or her familymembers, and fraud specialists to restore an individual'scredit and identity in the event of theft or misuse. Such asubscription also can include reimbursement for funds stolen as aresult of cyber scams.

Employers are increasingly finding that these services are beingoffered by their existing employee benefits providers as extensionsof other benefits, such as health insurance. Employers also cansecure subscription services directly from the third-partyproviders, typically at discounted rates for their employeepopulations.

Personal Accounts and Residential Networks.Employers also benefit from making certain other safeguardsavailable to help employees protect their home networks and theirpersonal email, social media, financial, and other online accounts.The work-from-home model necessitated by the pandemic (and likelyto remain in some form permanently) highlighted the threats toemployers of employees accessing business systems from insecureresidential and public Wi-Fi networks. Likewise, the insecurity ofpersonal accounts are common points of entry for hackers to exploitto access business systems through employee devices.

To mitigate these risks, employers are helping employees withresidential firewalls, personal virtual private networks (VPNs),and password management applications for themselves and theirfamilies. These measures are becoming increasingly availablethrough the subscriptions services discussed above. Additionally,many employers are realizing that these safeguards are particularlyimportant for business owners, executives, and other managementemployees who have remote access to financial, personnel, and otherhighly sensitive information.

For a business to meaningfully reduce its vulnerability to cyberattack, it must truly engage its employee population in cybersecurity. One of the most effective techniques to do so is to teachand empower them to protect themselves and their families, thentranslate that engagement into a heightened awareness and mutualcommitment to protect the business as well.

Cameron G. Shilling

Director, Litigation Department & Chair of Cybersecurity andPrivacy Group

The content of this article is intended to provide a generalguide to the subject matter. Specialist advice should be soughtabout your specific circumstances.

Read more:
The Employer Benefit Of Employee Cyber Security - Employee Benefits & Compensation - United States - Mondaq

Read More..
Posted in Internet Security | Leave a Comment

EU and US authorities move to strengthen cyber-security protections – E&T Magazine

September 21, 2022 | Author: admin

The European Union's executive arm has proposed a new piece of legislation to ensure that smart devices meet cyber-security standards, making the bloc less vulnerable to attacks like the one suffered by Uber.

From laptops to fridges to mobile apps, smart devices connected to the internet will have to be assessed for their cyber-security risks under draft European Union rules announced on Thursday.

"[The Act] will put the responsibility where it belongs, with those that place the products on the market," EU digital chief Margrethe Vestager said in a statement.

Under the proposed bill, known as the Cyber Resilience Act, companies would face fines of as much as 15m (13m) or up to 2.5 per cent of their total global turnover if they fail to fix any problems that are identified.

The Covid-19 pandemic and the war in Ukraine have increased the risk of cyber attacks, according to EU authorities. Although most companies do have plans in place to protect their digital infrastructure, the Commission stressed that most hardware and software products are not currently subject to any cyber-security obligations.

The EU said a ransomware attack takes place every 11 seconds, and the global annual cost of cyber crime is estimated at 5.5tn (4.8bn) in 2021.

"When it comes to cyber security, Europe is only as strong as its weakest link, be it a vulnerable member state or an unsafe product along the supply chain," said Thierry Breton, the EU commissioner for the internal market. "Computers, phones,household appliances, virtual assistance devices, cars, toys each and every one of these hundreds of millions of connected products is a potential entry point for a cyber attack."

If adopted, the regulation would require manufacturers to take into account cyber security in the design and development of their devices, and businesses would remain responsible for their security throughout the products' expected lifetime, or a minimum of five years. Market authorities would have the power to withdraw or recall non-compliant devices and to fine companies that fail to abide by the rules.

The new policy builds on existing rules proposed by the European Commission in 2020, known as theNIS 2 Directive, which, in turn, expands on the scope of the current NIS Directive.

The Commission stated that the law will benefit consumers since it will improve data and privacy protection, as well as companies, which could save as much as 290bn (253bn) annually in cyber incidents versus compliance costs of about 29bn (25bn).

The EU is not alone in this push toward stricter cyber-security measures. The US White House has also released this week new federal software security requirements following the 2020 SolarWinds cyber attack, which compromised several government agencies.

The new guidance, 'Enhancing the Security of the Software Supply Chain to Deliver a Secure Government Experience', advises agencies on how to ensure that their third-party software usage complies with National Institute of Standards and Technology (NIST) guidance. Software vendors can also provide a plan of action and milestones if the NIST standards cant be achieved.

Not too long ago, the only real criteria for the quality of a piece of software was whether it worked as advertised, said federal chief information security officer Chris DeRusha. With the cyber threats facing federal agencies, our technology must be developed in a way that makes it resilient and secure, ensuring the delivery of critical services to the American people while protecting the data of the American public and guarding against foreign adversaries.

The guidance has been published on the same day that ride-hailing company Uber revealed it had contacted US law enforcement after suffering a massive security incident.

The breach is likely more extensive than its 2016 data breach and potentially may have compromised its entire network. The hacker was believed to have breached multiple internal systems, with administrative access to Uber's cloud services including Amazon Web Services (AWS) and Google Cloud (GCP). There was no indication thatUbersfleet of vehicles or its operation was in any way affected.

"The attacker is claiming to have completely compromised Uber, showing screenshots where they're full admin on AWS and GCP," Sam Curry wrote in a tweet. The security engineer at Yuga Labs, who corresponded with the hacker, added: "This is a total compromise from what it looks like."

Uber has since shut down online access to its internal communications and engineering systems, while it investigated the breach, according to a report by The New York Times. The Times said the hacker reported being 18 years old and saying they broke in because the company had weak security.

Uber said via email that it was currently responding to a cyber-security incident. We are in touch with law enforcement. However, cyber-security experts have taken the opportunity to stress the importance of establishing strong cyber protections, to avoid falling victim to hackers.

Ubers data breach reminds us that no organisation is safe, and everyone has a role to play in digital fortification," said John Davis, director UK & Ireland, SANS Institute, EMEA, after hearing of the news.

"Awareness and vigilance are vital weapons in our response to these threats. Businesses are battling enormous pressures in todays climate, amid rising inflation and supply chain issues, and hackers are looking to exploit this. Cybercriminals are levelling up. Their attacks are more prevalent, more sophisticated and harder to detect."

Dan Davies, CTO atMaintel, added: The recent cyber-security breach at Uber demonstrates how ensuring the security of communication channels should be a number one priority for businesses. Hackers able to comprise these systems then have the potential to target further internal networks and cause major disruptions. One chink in the armour could lead to a killer blow for the entire organisation."

Over the past year, organisations across the world, from the UK's NHS to the US's Apple, and even the Albanian government, have suffered severe cyber attacks that have disrupted their services and put their users' personal information at risk.

Sign up to the E&T News e-mail to get great stories like this delivered to your inbox every day.

See the article here:
EU and US authorities move to strengthen cyber-security protections - E&T Magazine

Read More..
Posted in Internet Security | Leave a Comment

Digital Financial Inclusion and Security: The Regulation of Mobile Money in Ghana – Carnegie Endowment for International Peace

September 21, 2022 | Author: admin

The Cybersecurity, Capacity Development, and Financial Inclusion project, or CyberFI, brings together a robust, transparent community of practitioners and researchers working on digital financial inclusion. This series focuses on understanding financial inclusion ecosystems on their own termswhat countries are doing, what is working, and what isnt. Six country case studies help capture the diversity of financial markets on the African continent: South Africa, Nigeria,Cameroon, Ghana, Uganda, and Zimbabwe.

Ghanas economy, like many others, is still recovering from the impact of the coronavirus pandemic.1 Despite this, the mobile money industry in Ghana enjoyed a big boost during the pandemic. In 2018, Ghana launched one of the first interoperable systems in Africa, which allows transactions between different telecom service providers in Ghana; reports reveal that the interoperability-supported payments reached 308 million Ghanaian cedis (GH) ($57 million) by 2019.2Since then, mobile money has risen to become the most popular digital financial service (DFS) in Ghana, and in recent years, Ghana has been identified as one of the biggest mobile money markets and the fastest-growing one in Africa.3 The Bank of Ghana reported in 2021 that mobile money accounts, which numbered 32.7 million in February 2020, grew to number 40.9 million by February 2021.4 Mobile money service provides users with electronic accounts linked to their phone numbers from which they can store, send, and receive money.5 The simplicity of this service coupled with the convenience it offers has made it an ideal DFS solution for many Ghanaians, but there are also many challengesincluding cyber crime, the need for infrastructure and digital capacity, and government policies such as the new Electronic Transactions Levy (or e-levy) and digital ID systemsthat have inhibited digital financial inclusion (DFI).6 This paper discusses the state of DFI in Ghana and the regulatory framework for DFS, with particular attention paid to mobile money services as the major DFS player in the country and to the governments digital security strategies in relation to DFS.

The emergence of digital financial services and inclusion in Ghana arguably began when the Ghana Interbank Payment and Settlement Systems Limited (GhIPSS) was established in 2007.7 As a foundation for financial inclusion, GhIPSS, which is an interbank payment and settlement company, was tasked with creating and managing interoperable payment system infrastructure for banks and other financial institutions.8 Essentially, it was created to provide the technology to help Ghana become a cashless society.

Dr. Nnenna Ifeanyi-Ajufo is an associate professor of law and the head of law at Buckinghamshire New University (United Kingdom). She was previously a law lecturer at Lancaster University (Ghana), where she taught cyber crime.

In April 2008, GhIPSS rolled out a novel national switch and smart card payment system dubbed e-Zwich.9 E-Zwich is a biometric smart card connected to all financial institutions in Ghana that allows users to deposit, withdraw, and transfer money.10 The card was targeted at the unbanked in Ghana, who amounted to a staggering 80 percent of the countrys population at the time.11 Unlike opening a bank account, which required documentation like letters of employment, recommendation and guarantor letters, or proof of address in the form of water or electricity bills, e-Zwich simply requires a users fingerprints. E-Zwich cardholders benefit from high security standards through the biometric (fingerprint) client authentication system. Card users were not restricted to banking halls but could transact at any location that had an e-Zwich point of sale (POS) device. The POS devices were available in all banks, some shops, and e-Zwich merchant stalls. The introduction of the e-Zwich system promoted DFI and Ghanas digital economy, but because of various challenges the e-Zwich began to suffer decline after it commenced operations.12 Some users and merchants began to experience failed transactions and other technological issues at the POS locations, leaving them unable to withdraw money or continue other transactions due to poor and unstable cellular networks on which transactions relied.13 Despite the difficulties with e-Zwich, GhIPSS has continued to play a crucial role for payment systems. All DFS providers in Ghana, from banks and telecom companies to fintech companies, are partnered with GhIPSS. The interoperability that GhIPSS introduced in 2018 made mobile money more seamless, convenient, and cost-effective across all networks.14

A notable catalyst to mobile moneys debut in Ghana was the Branchless Banking Guidelines issued by the Bank of Ghana in 2008 to encourage deposit-taking financial institutions (banks and non-banks) to pursue branchless banking.15 The guidelines were issued with the primary aim of promoting financial inclusion by extending core banking and financial services outside of banking halls to provide these services to the unbanked.16 The Branchless Banking Guidelines also acknowledged that to accomplish branchless banking, financial institutions would need the help of agents to distribute or retail the services offered. Telecommunication companies (telcos) were seen as potential agents, especially for mobile banking.17 The guidelines, however, made the point that the use of agents or third-party service providers did not remove the responsibility of banks to ensure that operating branchless banking does not compromise banking standards.18 Focused on the financial inclusion objective, the guidelines also established that the only permissible model to operate branchless banking was a many to many model, which prevents exclusive partnerships between financial institutions and agents.19

Although the potential role of telcos was considered in the guidelines, it was limited to that of agents for the financial institutions. It is evident that the Bank of Ghana hoped that financial institutions would pioneer the cause of DFI through branchless banking; instead, the telcos have championed the change and made significant contributions to DFI in Ghana, especially through the introduction and advancement of mobile money services. The good reception mobile money received in the Ghanaian market unarguably influenced the commencement of other digital financial services in the country.

Financial technology (fintech) is also a growing industry that is offering innovative financial services to Ghanaians. Zeepay Ghana Limited is currently Ghanas most successful fintech company. Founded in 2014 and wholly Ghanaian-owned, Zeepay received its dedicated electronic money issuer license in 2020.20 Zeepay essentially provides a single wallet in which customers can receive payments via different digital channels like money remittance, bank transfer, and mobile money. Customers can also withdraw from Zeepay agents if they choose. Zeepay, operating in over twenty countries globally, has partnered with all three mobile money operators and some banks for flexible payments, remittances, and transfers, and it is a major DFS player in Ghana. Zeepay is also licensed by the Financial Conduct Authority of the United Kingdom.21 ExpressPay is another growing fintech player in Ghana that allows users to conveniently pay various types of bills online and to send monies instantly to any bank account, making the tedious process of bank-to-bank transfers much simpler.22 Launched in 2018, Bitsika is also creating a platform that uses digital currencies to move money across borders at low or zero cost. Users can deposit and remit money across multiple currencies using the Bitsika app. By using digital currencies and distributed ledger technology, Bitsika is making cross-border payments instant and auditable at negligible costs.23

In compliance with the Branchless Banking Guidelines, MTNGhanas largest telecommunications service providerpartnered with nine banks and launched mobile money services in July 2009.24 Under the guidelines, it only had the capacity to be an agent of the banks. All mobile money accounts opened with MTN were linked to one of these nine banks. MTN invested heavily in creating awareness of the service by sending merchants to the unbanked and underserved areas of the country to educate about and market mobile money.25 All the merchants who penetrated the unbanked geography of Ghana were from partner banks who had shown interest in those areas. Each mobile money account registered by a merchant represented an account of the bank the merchant worked for. Registering customers and opening accounts, however, presented another hurdle. Customers had to present a valid national ID to be registered, which was a hindrance to the registration process for many.26 Registrations had to be a scheduled event rather than a service that could be undertaken immediately once a customer expressed interest in the service.27 Despite this, some factors made mobile money accounts preferable to traditional bank accounts for the unbanked. They had lesser know-your-customer (KYC) requirements and were less expensive to use.28 Merchants were also more accessible to the unbanked, reaching some rural areas. By October 2009, MTN had about 20,000 registered mobile money subscribers.29 However, MTN could not operate mobile money at the scale and in the manner it wanted because a majority of the operational decisions were made by the partner banks.30

Upon reviewing the Branchless Banking Guidelines, the Bank of Ghana issued the Guidelines for E-Money Issuers and Agent Guidelines in 2015. These guidelines replaced the Branchless Banking Guidelines and set out new protocols for mobile money operations.31 According to the Bank of Ghana, the guidelines were issued as part of its broader strategy to create an enabling regulatory environment for efficient and safe digital payment and funds transfer mechanisms and to promote the availability and acceptance of electronic money as a retail payment medium with the potential to increase financial inclusion.32 The E-Money Issuer Guidelines introduced the status of Dedicated Electronic Money Issuer (DEMI), which an institution could obtain by getting a license to issue e-money alongside licensed financial institutions.33 This gave telcos an opportunity to gain the capacity to issue money to customers for transactions without linking each mobile money account to a bank account. The E-Money Issuer Guidelines set out standards of systems and controls as well as technology and security requirements DEMIs should use. It also set out general operational provisions for DEMIs, including types of mobile money accounts, transaction limits, permissible transactions, KYC requirements, capital and liquid fund requirements, and consumer protection principles, among others.34 Many of these requirements and operational rules have been incorporated into the Payment Systems Act 2019 (Act 987), which currently regulates digital financial service providers.

The Agent Guidelines essentially changed the meaning of agent from the meaning outlined in the Branchless Banking Guidelines and provided new operational guidelines to complement the new e-money guidelines and payment systems structure the Bank of Ghana was putting into place. The practical effect of the 2015 guidelines released the telcos from the position of agents and gave them the option to be principals in the relationship. Although telcos are no longer required to be agents of banks, beneficial partnerships still exist between telcos and some banks to facilitate transactions between mobile money accounts and bank accounts and payments for services.

MTNs success in venturing into mobile money services and the enabling regulatory environment inspired the other mobile networks operators in Ghana to follow suit. Tigo Cash was launched in October 2010, Airtel Money in 2011, and Vodafone Cash in 2015.35 In 2017, Airtel and Tigo merged to create AirtelTigo, which also resulted in .36 By 2019, mobile phones officially became the most-used medium of payment in Ghana due to mobile money and mobile banking.37 Mobile money dominated the landscape with 32.5 million registered accounts (from 23.9 million in 2018) and 13 million active users at the end of 2018 (see figure 1).38

MTN Ghana has made the largest contribution to DFI in Ghana,not only by introducing mobile money but also by providing the largest amount of coverage. MTN Ghana also set up MobileMoney Limited, a subsidiary responsible for mobile financial services. With a market share of over 80 percent since 2017, MTN continues to dominate the mobile money market to date.39 The Ministry of Communications and Digitalisation (MOCD) revealed in 2020 that MTN controlled 75 percent of the telecom market, labeling it a significant market power (SMP).40 The MOCD also revealed that MTN controlled about 94 percent of the mobile money market share, because the other telcos pay interconnect fees to MTN.41 MTNs SMP designation enables the National Communications Authority (NCA) to enforce the provisions of the Electronic Communications Act 2008, such as setting a price floor or ceiling for associated mobile money costs so as to maintain a competitive market and level the playing field for all telcos.

AirtelTigo, on the other hand, was the result of a merger to create a stronger telecommunications network. However, in 2020, the parent companies of the entity opted to sell their shares to the government.42 Since the sale was completed in November 2021, it remains to be seen whether operating under the governments management will be to AirtelTigos detriment or success. The governments previous failure to successfully manage the first government-owned telco, Ghana Telecom, resulted in the privatization of Ghana Telecom, which is now Vodafone Ghana. Vodafone Ghana has also made efforts to increase financial inclusion by allowing Vodafone Cash users to send and deposit money without any charges since 2020.43 This initiative was made possible due to mobile money interoperability.44 Vodafone became the first player in the industry to introduce a free peer-to-peer service to enhance commercial advantage and allow for more financial inclusion.

The Bank of Ghana has supervisory and regulatory authority over banks and all other financial institutions, and it oversees their licensing and operation through the various acts of parliament that relate to financial services. The Banking Supervision Department of the Bank of Ghana oversees banks while the Other Financial Institutions Supervision Department oversees financial institutions that are not banks. The Payments Systems Department oversees the financial activities and in particular the mobile money operations of telcos. That department also undertakes licensing, monitoring, and onboarding for telcos involved in payment systems.45 The Fintech and Innovations Office oversees payment and financial technology service providers. On the other hand, rather than being overseen by the Bank of Ghana, the telecommunication services provided by telcos are supervised and regulated by the NCA. The NCA regulates telcos by granting licenses for operation, ensuring fair competition among licensees, monitoring the quality of service, setting equipment standards, and mandating safeguard mechanisms.

To maintain control over the fast-developing financial sector, new and improved legislation has been passed to replace legislation that was determined unsuitable to the current financial services industry. For instance, the Payment Systems Act 2003 (Act 662) was replaced with the Payment Systems and Services Act 2019 (Act 987). These acts, along with the Non-Bank Financial Institution Act 2008 (Act 774), have vested the Bank of Ghana with powers to license, regulate, and supervise financial sector developments. Telcos that operate mobile money services are regarded as payment system providers under the Payment Systems Act (Act 987), meaning that their licensing and regulation fall to the Bank of Ghana.46 The Payment Systems Act is the legislation applicable to DFS or payment system services in Ghana. It consolidates the laws relating to payment systems and payment services and regulates institutions which operate payment services and electronic money business. Under the Payment Systems Act, it is a criminal offense to operate a payment service business without a payment service license from the Bank of Ghana.47

In 2016, Ghana also introduced the Banks and Specialised Deposit-Taking Institutions Act 2016 (Act 930), which regulates institutions that engage in deposit-taking business and consolidates laws relating to deposits. While banks and nonbank institutions engaged in deposit-taking business licensed under Act 930 are not required to obtain a license to operate a payment system, they must apply for and receive authorization from the Bank of Ghana to offer services.48

Besides Act 987, payment service providers (PSPs) are regulated by other legislation, such as the Data Protection Act 2012 (Act 843). Registering with the Data Protection Commission and obtaining a data protection certificate are prerequisites to applying for a PSP license (which in turn is a requirement for businesses to acquire licenses or registration to operate in Ghana). Applicants for a PSP license are additionally required to submit an antimoney laundering policy as part of their application, in accordance with the Anti-Money Laundering Act 2020 (Act 1044). The policy should outline their KYC processes, internal reporting procedures, and measures to ensure compliance with the act.

PSPs also submit a cybersecurity policy as part of their license application to the Bank of Ghana that must comply with the Cybersecurity Act 2020 (Act 1038). The submitted cybersecurity policy must detail key performance indicators or strategies that highlight cybersecurity consciousness. The Cybersecurity Act 2020 also established the Cyber Security Authority to regulate cybersecurity activities in Ghana. The board of the authority is constituted by the ministers of communication, defense, national security, and the interior. For good coordination in cybersecurity incidents, the authority is required to establish sectoral computer emergency response teams (CERTs), including for the banking and finance sector. Based on conversations with sector practitioners, one salient issue is a question of coordination among the sectoral CERTs and the main Cybersecurity Authority; however, the Ghana National Computer Emergency Response Team (CERT-GH), which was formed by the MOCD in August 2014 principally to respond to cyber infractions on government networks, also serves the private sector.49

Most of the legislation highlighted above were passed recently. The DFS sector in Ghanadespite being quite younghas immense potential and is developing quickly; hence, the Bank of Ghana and the government are updating legislation to match developments and ensure secure DFI. Importantly, the acts of parliament that regulate the various financial institutions provide consumer and individual-user protections; the enforcement of these protections is one of the many powers of the Bank of Ghana. Ultimately, the onus falls on the Bank of Ghana and other regulators and enforcement bodies like the Data Commission and the Cybersecurity Authority to ensure that PSPs are compliant with all relevant legislation and regulation.

In 2017, the financial sector in Ghana underwent massive overhaul as banks and other financial institutions that were unlicensed or noncompliant were shut down by the Bank of Ghana.50 Many depositors of the collapsed institutions were heavily affected and were unable to recover their deposits and investments because of the institutions mismanagement.51 However, mobile money operations continued. As mobile money grew, fraud began to emerge in the sector. The Ghana Chamber of Telecommunications reported 278 mobile moneyrelated fraud cases in 2015 and 388 cases in 2016.52 In April 2021, the chamber mentioned that over 4,000 cases of mobile money fraud were under investigation.53

Table 1 shows some types of mobile money fraud identified in Ghana.54

By 2017, fraud was not an uncommon occurrence among MTN subscribers.55 It was reported that some MTN agents and staff were themselves accomplices to the fraud.56 Some of the few fraud cases police successfully solved involved the arrest of telco employees.57 Telcos in Ghana have been meticulous in ensuring employees or ex-employees who were caught defrauding or stealing from customers are not associated with them. Names of telecommunication companies are not typically disclosed in articles reporting mobile money fraud because financial institutions fear that they will lose customers when they expose their vulnerabilities.58 This also means that there is a culture of limited information-sharing; lack of reporting in turn causes lack of evidence to aid law enforcement in ensuring mitigation of further attacks. However, fraud cases are acknowledged publicly by the Ghana Chamber of Telecommunication, which is the umbrella association to which all mobile network operators belong.59

While many financial institutions are investing in their cyber defenses, unsecure, low-cost mobile and internet devices are still a major source of cyber threats to financial institutions.60 DFS providers are still undertaking diverse individualistic digital security efforts. For example, to curb fraud, MTN has made it mandatory for customers to display a national ID before transacting with any of its agents or merchants. This policy took effect in 2021 amid arguments that it could derail DFI because access to national IDs remains a challenge and that use of IDs for transactions would not help to curb fraud.61

The success of mobile money and other financial products offered by Zeepay, Express Pay, and Bitsika represents welcome progress in Ghanas concerted effort toward DFI. In May 2020, the Ministry of Finance launched the worlds first Digital Financial Services Policy. The policy outlines a vision of DFI.62 Below are features the government aims to see in the Ghanaian digital finance space by 2023:

To accomplish this, the government will work in six areas that it refers to as policy pillars. They are governance, enabling legislation, capacity building, market infrastructure, digital payment use cases, and supporting fintech. Notably, the cybersecurity of DFI is not mentioned either as an aim or a pillar. While it can be argued that cybersecurity in relation to DFI services is implied in the above pillars, the obvious noninclusion can also be interpreted as an omission or a nonprioritization.

A new development that raises the question of digital financial exclusion is the recent move by the government of Ghana in November 2021 to include in the reading of its 2022 budget a new tax: the e-levy.63 This tax applies a 1.75 percent levy on electronic transactions, which include inward remittances, bank transfers, merchant payments, and mobile money payments above GH100 (approximately $13) commencing February 1, 2022.64 This levy is separate from the fees that telcos already charge customers for transactions. Despite concerns that the e-levy will weaken Ghanas financial system and slow down the development of e-commerce, the government argued that the e-levy was necessitated by a drive to widen the tax net, which would increase the countrys tax to GDP proportion from about 11.3 percent to over 16 percent and serve as a driving force for Ghanas economy.65

News of the e-levy was immediately met with great outcry from the public, with panic withdrawals occurring a day after the announcement.66 To warm the public to the idea of the levy, a number of town hall meetings were held in different parts of the country.67 Initially, the Electronic Levy Bill 2021 did not pass Parliament,68 and public protests against it continued.69 Notwithstanding the protests and opposition, Ghanas parliament approved the e-levy after members of parliament reintroduced the bill.70 The president thereafter signed the e-levy bill into law, effective May 1, 2022. An application for an injunction against the e-levy was dismissed by the Supreme Court of Ghana on May 4, 2022, meaning that the controversial e-levy is now in force. While the e-levy is not exclusive to mobile money, mobile money is the biggest and most clearly affected enterprise in the electronic transactions space. For every transaction from one mobile money wallet to any other recipient source, the sender pays an additional 1.75 percent in transaction fees as e-levy. Mobile money is also the reason the e-levy has gained so much media attention, since many Ghanaians increasingly rely on mobile money transactions as a primary means for conducting digital finance.

Objectively, the e-levy can hinder DFI. It has already created the unintended effect of generating not only panic but also user distrust and insecurity, as evidenced by the withdrawals and concerns that fraudsters running social engineering schemes will begin initiating a reversal of the e-levy on mobile money transactions.71 In rural areas especially, many peoples mobile money wallet is the closest thing they have to a bank account. It is the primary means by which they send and receive money. The e-levy will certainly discourage such people from sending taxable amounts and will reduce mobile money transactions and encourage people to use cash if there is no viable alternative.

Another reason for the pushback on the e-levy is the double taxation it will inadvertently introduce. For example, many employees are paid their salary via mobile money. Paying an additional levy for transactions with money that has been already taxed is burdensome to the average Ghanaian worker. Businesses use merchant mobile money accounts since transactions may involve large sums of money. For enterprises to pay a levy of 1.75 percentin addition to the usual charges each time a payment above GH100 is mademay cause them to reduce transactions and seek a more cost-effective option, which may well be cash. However, the government has assured citizens that it is in talks with the telcos to ensure the combination of the levy and the transaction fees are not burdensome to the public. Regardless, doubts and worries about the levy are far from settled and will inadvertently impact financial inclusion in Ghana.

Another curiosity stems from the reporting of fraud incidents. There is a general underreporting of fraud incidents and a dearth of statistics, as highlighted above, as companies typically fear the loss of customers in the wake of disclosing such incidents. It is very common to leave customers to their fate when they report incidences of fraud, thereby passing the burden of security on to consumers and complicating the goal of DFI. Addressing the challenges of fraud was one of the reasons the NCA recently directed all Ghanaians to reregister their SIM cards by presenting their national IDs or Ghana Card to telcos.72 It remains to be seen if the SIM reregistration process will enhance the governments strategy to police fraud in the financial services sector through filtering SIM cards used for fraudulent purposes.

Digital identification systems present a challenge for DFI in Ghana.73 Many services in Ghana are dependent on forms of identification that can be digitally verified or authenticated; however, this leaves many Ghanaians, especially those in the rural areas, financially excluded and unable to participate in available digital financial services. The government of Ghana introduced the Ghana Card to document national identity and mandated that from July 1, 2022, it would serve as the only ID document required for all financial transactions with institutions under the authority of the Bank of Ghana. To bolster digital identification, the government also required that all telcos use Ghana Cards to reregister all SIM cards; however, not all Ghanaians have registered for and acquired the Ghana Card.74 Public opinion suggests that the time allotted for the SIM reregistration exercise (October 2021 to March 2022) was overly short and that adequate measures were not put in place to facilitate mass registration while observing appropriate COVID-19 protocols. The National Identification Authority and the NCA have acknowledged that the backlog of unprinted cards, uncollected cards, and duplicate applications warrants a deadline extension.75 At the time of writing, no SIM cards have been deactivated and registration has not been officially ended.

New telco policies also direct that mobile money transactions require proof of identity for conducting transactions.76 Valid forms of ID include a drivers license, voter ID, passport, Social Security and National Insurance Trust ID, National Health Insurance card, or Ghana Card (national ID). According to research, Ghanaians without formal ID tend to be the poor and those living in rural areas, where mobile money is their only access to financial services.77 Obtaining and replacing IDs in Ghana is also hampered by bureaucratic processes, which means that new digital ID policies could discourage customers from using mobile money. Linking SIM reregistration to the Ghana Card means that people will be unable to use mobile money services if SIM cards are indeed deactivated for failure to reregister. For enhanced ID policies to advance financial inclusion rather than retard or diminish it, the government must ensure that all Ghanaians are registered for and receive the Ghana Card. There can be no DFI without adequate and efficient identification systems. This will further facilitate interoperability, enabling people to make different payments in a secure manner through single transactions.

Four challenges continue to hamper digital financial inclusion in Ghana: capacity, skills, trust, and security. To ensure DFI benefits everyone, there is a need to provide more than just access; it is important to equip citizens with the capacity, skills, and trust to go online. Outlined below are areas for improvement within Ghanas digital financial ecosystem.

The growth of financial inclusion in Ghana has been mainly due to the development of DFS. Ghanas DFS and DFI space continues to evolve with the entry of other players like fintech services, as well as the new DFS policy, which signaled that the government is focused on an agenda that will continue to ensure DFI. However, Ghanas approach to ensuring DFI must leverage cross-sectoral partnerships and whole-of-government collaborations to improve security for DFS as Ghana continues to lead in the West African region by number of mobile money transactionswhich represent 82 percent of the countrys GDPand remains the fastest-growing mobile money market in Africa over the past five years.82

Dr. Nnenna Ifeanyi-Ajufo is an associate professor of law and the head of law at Buckinghamshire New University (United Kingdom). She was previously a law lecturer at Lancaster University (Ghana), where she taught cyber crime. She serves as the vice-chairperson of the African Union Cyber Security Experts Group and has been effectively involved in promoting the cybersecurity efforts of the African Union Commission and African member states. She is also a Technology and Human Rights Fellow at the Carr Center for Human Rights Policy at Harvard University (United States) for the 20222023 academic year and a member of the International Law Association Working Group on Digital Challenges for International Law. In March 2022, she was nominated by the United States Mission to the African Union to participate in the U.S. Department of State International Visitors Leadership Program on Promoting Cybersecurity. She was also appointed a mentor on the International Telecommunications Unions Women in Cybersecurity Mentorship Programme 2022. She has written for a vast range of research projects, journals, and media publications and is also a contributing editor to Directions, an initiative of the EU Cyber Direct project of the European Union Institute for Security Studies.

1 Digital Financial Inclusion, World Bank, accessed October 4, 2021, https://www.worldbank.org/en/topic/financialinclusion/publication/digital-financial-inclusion.

2 Selin Ozyurt, Ghana Is Now Fastest Growing Mobile Money Market in Africa, Quartz Africa, last updated July 20, 2022, https://qz.com/africa/1662059/ghana-is-africas-fastest-growing-mobile-money-market.

3 Max Mattern, How Ghana Became One of Africas Top Mobile Money Markets, 2017 Global Findex: What You Need to Know (blog series), Consultative Group to Assist the Poor, June 21, 2018, https://www.cgap.org/blog/how-ghana-became-one-africas-top-mobile-money-markets.

4 Summary of Economic and Financial Data September 2021, Bank of Ghana, September 27, 2021, 11, https://www.bog.gov.gh/wp-content/uploads/2021/09/Summary-of-Economic-Financial-Data-September-2021-1.pdf.

5 What Is Mobile Money? A Guide About Mobile Money from Worldremit, WorldRemit, accessed October 21, 2021, https://www.worldremit.com/en/how-it-works-mobile-money.

6 Michael Tobias Geiger, Kwabena Gyan Kwakye, Carlos Leonardo Vicente, Barbara Monica Wiafe, and Nana Yaa Boakye Adjei, Fourth Ghana Economic Update: Enhancing Financial Inclusion Africa Region, World Bank, June 1, 2019, http://documents.worldbank.org/curated/en/395721560318628665/Fourth-Ghana-Economic-Update-Enhancing-Financial-Inclusion-Africa-Region.

7 Who We Are, Ghana Interbank Payment and Settlement Systems Limited, accessed October 6, 2021, https://ghipss.net/index.php/about/who-we-are.

8 Ibid.

9 E-Zwich Biometric Card, Ghana Interbank Payment and Settlement Systems Limited, accessed September 14, 2021, https://ghipss.net/index.php/services/e-Zwich-biometric-card.

10 Ibid.

11 Kwadwo Boateng, Ghanas Progress on Reaching Out to the Unbanked Through Financial Inclusion, International Journal of Management Studies 5, no. 2 (August 2018).

12 James T. Arthur, Ghanas E-Zwich System and the Characteristics of Innovation (masters thesis, Eastern Illinois University, 2015), 8386, https://thekeep.eiu.edu/cgi/viewcontent.cgi?article=3356&context=theses.

13 Ibid.

14 Ghanas First Mobile Money Interoperability System Deepens Financial Inclusion and Promotes Cashless Agenda, Alliance for Financial Inclusion, accessed November 13, 2021, https://www.afi-global.org/newsroom/news/ghanas-first-mobile-money-interoperability-system-deepens-financial-inclusion-and-promotes-cashless-agenda.

15 Notice to Banks and Savings and Loans Companies: Guidelines to Branchless Banking, Bank of Ghana, accessed August 10, 2022, https://dfsobservatory.com/sites/default/files/Bank%20of%20Ghana%20-%20Notice%20No%20BG-GOV-SEC-2008-21%20-%20Regulatory%20Framework%20for%20Branchless%20Banking.pdf.

16 Ibid., 18.

17 Ibid., 2.

18 Ibid., 18.

19 Ibid., 3.

20 About Us, Zeepay, accessed January 6, 2022, https://www.myzeepay.com/about-us; Bank of Ghana, Bank of Ghana Licenses First Fintech, news release, April 30, 2020, https://www.bog.gov.gh/wp-content/uploads/2020/04/Press-Release-Bank-of-Ghana-licenses-First-Fintech.pdf.

21 Ibid.

22 Who We Are - Take A Look, ExpressPay, accessed January 10, 2022, https://expresspaygh.com/aboutus.php.

23 Jeffrey Gogo, Ghanaian Startup Bitsika Africa Processed $40 Million in Crypto Remittances in 2020, Up 3,900% Year-on-Year, Bitcoin.com, January 4, 2021,https://news.bitcoin.com/ghanaian-startup-bitsika-africa-processed-40-million-in-crypto-remittances-in-2020-up-3900-year-on-year.

24 MTN Mobile Money Spotlight on Ghana, GSMA, October 21, 2009, https://www.gsma.com/mobilefordevelopment/country/ghana/mtn-mobile-money-spotlight-on-ghana; Jason Nicco-Annan, Thats Momo Like It: Everything You Need To Know About Mobile Money In Ghana, WorldRemit, accessed October 8, 2021, https://www.worldremit.com/en/blog/money-transfer/mobile-money-ghana.

25 MTN MoMo Pay Merchant Payments: Expanding Womens Mobile Money Use in Ghana, GSMA, accessed June 12, 2022, https://www.gsma.com/mobilefordevelopment/wp-content/uploads/2020/05/MTN-MoMo-Pay-Merchant-Payments-Expanding-Female-Mobile-Money-Usage-in-Ghana.pdf.

26 GSMA, MTN Mobile Money Spotlight on Ghana.

27 Ibid.

28 Ibid.

29 Ibid.

30 Archie Hesse, Bruno Akpaka, and Kwami Williams, A History of Mobile Money in Ghana, February 2, 2021, in Decode Fintech, podcast, MP3 audio, 33:20, https://decodefintech.simplecast.com/episodes/mobile-money-in-ghana-CLoEOtNl.

31 Notice to E-Money Issuers and The General Public: Guidelines for E-Money Issuers in Ghana and Agent Guidelines, Bank of Ghana, accessed August 10, 2022, https://www.bog.gov.gh/wp-content/uploads/2019/08/NOTICE-Guidelines-for-E-Money-Issues-in-Ghana.pdf.

32 Ibid.

33Ibid., rule 5.

34 Ibid., rules 9, 8, 12, 11, 15, 20, 17, and 26.

35 International Finance Corporation,IFC, The MasterCard Foundation and Tigo Ghana to Expand Mobile Financial Services in Ghana, news release, May 27, 2014, https://pressroom.ifc.org/all/pages/PressDetail.aspx?ID=17891; William Yaw Owusu, Zap Changes to Airtel Money, Modern Ghana, December 16, 2011, https://www.modernghana.com/news/367341/zap-changes-to-airtel-money.html; Vodafone, Vodafone Launches M-Pesa in Ghana, news release, accessed November 15, 2021, https://www.african-markets.com/en/news/west-africa/ghana/m-pesa-hits-280-000-users-in-ghana#:~:text=In%20December%202015%2C%20Vodafone%20launchedSeptember%2C%20according%20to%20Vodafone%20Ghana.

36 Jason Nicco-Annan, Thats Momo Like It: Everything You Need To Know About Mobile Money In Ghana.

37 Mobile Phone Cements Position as Most Used Payment Medium, Ghana Web, August 31, 2019, https://www.ghanaweb.com/GhanaHomePage/NewsArchive/Mobile-phone-cements-position-as-most-used-payment-medium-777091.

38 Ibid.

39 Mobile Money Deposits Hit GH2.3 Billion In 2017, Ghana Chamber of Telecommunications, November 30, 2018, https://telecomschamber.com/news-media/industry-news/4823-2; IMARC, Ghana Mobile Money Market: Industry Trends, Share, Size, Growth, Opportunity and Forecast 2022-2027, news release, accessed December 7, 2021, https://www.imarcgroup.com/ghana-mobile-money-market?msclkid=2cb526abcf0c11ec9aff50b67a181cfd.

40 Samuel Dowuona, MTN Ghana Named Significant Market Power to Correct Imbalance in Telecoms Market, TechGh24, June 10, 2020, https://www.techgh24.com/mtn-ghana-named-significant-market-power-to-correct-imbalance-in-telecoms-market.

41 Ibid.

42 Henry Lancaster, Ghana Telecoms Market Report: Telcoms, Mobile and Broadband Statistics and Analyses, Budde Comm, last updated May 25, 2022, https://www.budde.com.au/Research/Ghana-Telecoms-Mobile-and-Broadband-Statistics-and-Analyses.

43 Sending Money to All Networks Is Free on Vodafone Cash, B&FT Online, August 10, 2020, https://thebftonline.com/2020/08/10/sending-money-to-all-networks-is-free-on-vodafone-cash.

44 Mobile Money Interoperability, Vodafone Ghana, accessed 20 January 2022, https://vodafone.com.gh/personal/vodafone-cash/products/mobile-money-interoperability.

45 Payment Systems Strategy (2019-2024), Bank of Ghana, accessed August 10, 2022, https://www.bog.gov.gh/wp-content/uploads/2022/01/National-Payment-Systems-Strategic-Plan-2019-to-2024-2.pdf.

46 Payment Systems and Services Act 2019 (Act 987), Bank of Ghana, accessed August 11, 2022, https://www.bog.gov.gh/wp-content/uploads/2019/08/Payment-Systems-and-Services-Act-2019-Act-987-.pdf See generally section 7 of the act.

47 Ibid., section 9(1).

48 Ibid., section7(1) and section 10.

49 Overview of CERT-GH, Cyber Security Authority of Ghana, accessed August 10, 2022, https://csa.gov.gh/cert-gh.php.

50 Honor Banda, Ghanas Banking Bust, Africa Report, November 22, 2018, https://www.theafricareport.com/445/ghana-finance-banking-bust.

51 Ibid.

52 Isaac Akomea-Frimpong, Charles Andoh, Agnes Akomea-Frimpong, and Yvonne Dwomoh-Okudzeto, Control of Fraud On Mobile Money Services In Ghana: An Exploratory Study, Journal of Money Laundering Control 22, no. 2 (2019): 301.

53 Nicholas Brown, Over 4,000 Cyber Fraud Cases Currently Under Investigation, Joy Online, April 23, 2021, https://www.myjoyonline.com/over-4000-cyber-fraud-cases-currently-under-investigation/?param=.

54 Stephen Annan, Avoiding Fraud Due to Mobile Money, Ghana Web, October 7, 2017, https://www.ghanaweb.com/GhanaHomePage/features/Avoiding-fraud-due-to-Mobile-Money-588682.

55 Veronica Owusu Ansah, MTN Mobile Money Fraud, An Inside Job? Ghana Web, October 23, 2017, https://www.ghanaweb.com/GhanaHomePage/NewsArchive/MTN-Mobile-Money-fraud-an-inside-job-593205.

56 Suleiman Mustapha, MTN Sanctions 3,000 Agents for Mobile Money Fraud, Graphic Online, October 27, 2017, https://www.graphic.com.gh/news/general-news/mtn-sanctions-3-000-agents-for-mobile-money-fraud.html.

57 Staff of Telcos Accomplices in Mobile Money Fraud Police, Ghana Web, October 23, 2017, https://www.ghanaweb.com/GhanaHomePage/NewsArchive/Staff-of-telcos-accomplices-in-mobile-money-fraud-Police-593227.

58 3 Mobile Money Fraudsters Busted, Ghana Web, September 9, 2017, https://www.ghanaweb.com/GhanaHomePage/NewsArchive/3-mobile-money-fraudsters-busted-579138; Judith Frickenstein, How IT-Security Affects Africas Financial System, Africa Finance Forum Blog (blog), Making Finance Work for Africa, May 8, 2019, https://www.mfw4a.org/blog/how-it-security-affects-africas-financial-system#:~:text=A%20further%20trend%20is%20an%20increase%20in%20attackssystems%20and%20their%20customers%20leading%20to%20cross-border%20challenges.?msclkid=5792f33ccf0e11ec9716779e58bdf70f.

59 Dominic Ayamga, Telecommunication Fraud Prevention Policies and Implementation Challenges (masters thesis, Lule University of Technology, 2018), https://www.diva-portal.org/smash/get/diva2:1222014/FULLTEXT01.pdf.

60 William Carter, Forces Shaping the Cyber Threat Landscape for Financial Institutions, Swift Institute, October 2, 2017, https://www.swiftinstitute.org/wp-content/uploads/2017/10/SIWP-2016-004-Cyber-Threat-Landscape-Carter-Final.pdf.

61 PK Senyo, Ghanas New Mobile Money Rule Could Derail Financial Inclusion. But There Are Answers, The Conversation, April 18, 2021, https://theconversation.com/ghanas-new-mobile-money-rule-could-derail-financial-inclusion-but-there-are-answers-158770.

62 Digital Financial Services Policy, Government of Ghana Ministry of Finance, accessed August 11, 2022, 1213, https://mofep.gov.gh/sites/default/files/acts/Ghana_DFS_Policy.pdf.

63 PK Senyo, There Will Be No Escaping Ghanas New Levy on Electronic Transactions, Quartz Africa, November 19, 2021, https://qz.com/africa/2092221/ghana-introduces-a-1-75-percent-levy-on-electronic-transactions.

Read more from the original source:
Digital Financial Inclusion and Security: The Regulation of Mobile Money in Ghana - Carnegie Endowment for International Peace

Read More..
Posted in Internet Security | Leave a Comment

Byos Releases Free Assessment Tool to Provide Companies With Tailored Network Security Recommendations – DARKReading

September 21, 2022 | Author: admin

HALIFAX, NOVA SCOTIA September 20, 2022 Byos (www.byos.io), the edge microsegmentation company dedicated to helping organizations protect themselves from the risk of ubiquitous remote, guest, and internet of things (IoT) network connectivity, announced today the release of the Byos Network Security Maturity Assessment: a free tool that details actions and technologies to improve an organization's security posture. Developed by a team of network security industry veterans and consultants, the tool scores a company's current network security maturity via a 15-minute survey and provides a tailored set of recommendations that can be used to develop priorities, action plans, long-term budgets, and more. The Assessment tool can be found at: https://www.byos.io/network-security-maturity-assessment-welcome.

We saw a real need for a way to get a baseline set of recommendations without having to bring in outside consultants, said Matias Katz, founder and chief executive officer at Byos. That process can be long, expensive, and difficult to justify. We wanted our tool to give companies access to actionable advice without all the costs and distractions of the traditional way of doing it. Because that meant that it almost never got done.

The Byos Network Security Maturity Assessment uses a 29-question survey covering general network security, managing access, lateral movement, and risk/threat assessment. Respondents rate their agreement with each question on a five-point scale, and the tool uses this data to calculate their network security maturity level across each category. The Byos Network Security Maturity Assessment then leverages its extensive recommendation database built on NIST and CISrecommendations and insight from the network security veterans who developed the tool to generate a report tailored to the company's strengths and weaknesses and suggest actionable next steps.

Byos was committed to building a high-quality tool from the very start, said Caston Thomas, lead consultant on the Assessment and chief executive officer at InterWorks, LLC. I am amazed a vendor could be so confident in its technology that it would release a free tool without any bias toward its products. We developed the assessment to help any size organization gain perspective to improve their network security without having to hire expensive consultants.

The launch of the Byos Network Security Maturity Assessment continues this legacy, using technology to allow companies to rapidly evaluate the strength of their cybersecurity strategy.

To learn more about Byos Network Security Maturity Assessment or to start using the tool today visit https://www.byos.io/network-security-maturity-assessment-welcome.

About Byos

IoT, mobile devices, the cloud, working-from-home, and video streaming have all radically changed how the internet works. That growth and complexity is accelerating. Yet there is little difference in how internet security operates from the time when it was originally built almost 50 years ago.

Byos is stepping up the challenge to create a new way of securing the net, and in doing so, is proving that network security can be simpler and, at the same time, fundamentally more secure. Simply stated, Byos makes all devices, and the network itself, invisible. Byos communicates ON the network without being connected TO the network by isolating each device on its own network of one. Even if a device is compromised by some other means, like malware from an email, Byos limits the spread.

Byos is backed by Silicon Valley investors and advisors and based in Nova Scotia. We serve customers across all industries and governmental institutions. For more information, visit http://www.byos.io.

Continue reading here:
Byos Releases Free Assessment Tool to Provide Companies With Tailored Network Security Recommendations - DARKReading

Read More..
Posted in Internet Security | Leave a Comment

Internet restricted in Iran as crackdown grows on spreading protests – Reuters

September 21, 2022 | Author: admin

Register now for FREE unlimited access to Reuters.comRegister

DUBAI, Sept 21 (Reuters) - Iranian authorities said three people had been killed on Tuesday as anger at the death of a woman detained by the morality police fuelled protests for a fifth day and fresh restrictions were placed on social media.

Official sources now say a total of seven people have been killed since protests erupted on Saturday over the death of Mahsa Amini, a 22-year-old from Iranian Kurdistan who died last week after being arrested in Tehran for "unsuitable attire".

Reports from Kurdish rights group Hengaw said seven protesters had been killed by security forces, three of them on Tuesday, in or near the Kurdish areas in the northwest where unrest has been particularly intense. Officials have denied that security forces have killed protesters.

Register now for FREE unlimited access to Reuters.comRegister

With the protests spreading to over 50 cities and towns, authorities restricted access to the internet, according to accounts from Hengaw, residents, and internet shutdown observatory NetBlocks.

NetBlocks and residents said access had been restricted to Instagram - the only major social media platform that Iran usually allows and which has millions of users. read more

WhatsApp users said they could only send text, not pictures, while Hengaw said access to the internet had been cut in Kurdistan province - a move that would hinder videos being shared from a region where the authorities have previously suppressed unrest by the Kurdish minority. read more

Meta Platforms (META.O), the owner of Instagram and WhatsApp, did not immediately respond to a request for comment.

Amini's death has unleashed anger over issues including freedoms in the Islamic Republic and an economy reeling from sanctions. Women have waved and burnt their veils during protests, with some cutting their hair in public.

After beginning on Saturday at Amini's funeral in the Kurdish region, protests have engulfed much of the country, prompting confrontations as security forces have sought to suppress them.

A top aide to Supreme Leader Ayatollah Ali Khamenei paid condolences to Amini's family this week, promising to follow up on the case and saying Khamenei was pained by her death.

The official IRNA news agency said a "police assistant" died from injuries on Tuesday in the southern city of Shiraz after "some people clashed with police officers". An official quoted by IRNA said 15 protesters were arrested in Shiraz.

In Kermanshah, the city prosecutor said two people had been killed on Tuesday in riots, blaming armed dissidents because the victims were "killed by weapons not used by the security apparatus," the semi-official Fars news agency cited prosecutor Shahram Karami as saying.

People light a fire during a protest over the death of Mahsa Amini, a woman who died after being arrested by the Islamic republic's "morality police", in Tehran, Iran September 21, 2022. WANA (West Asia News Agency) via REUTERS

The Kurdistan police chief, in comments to the semi-official Tasnim news agency, confirmed four deaths earlier this week in the province. He said they were shot with a type of bullet not used by the security forces, saying "gangs" wanted to blame police and security officials.

Hengaw said 450 people had been injured in addition to the seven Kurdish protesters it said had died as a result of "direct fire" from government forces in the last four days. Reuters could not independently confirm the casualty reports.

Amini fell into a coma and died while waiting with other women held by the morality police, who enforce strict rules in Iran requiring women to cover their hair and wear loose-fitting clothes in public. read more

Her father said she had no health problems and that she suffered bruises to her legs in custody. He holds the police responsible for her death. The police have denied harming her.

The U.N. Commissioner for Human Rights has called for an impartial investigation into her death and allegations of torture and ill-treatment. read more

A senior security official told Reuters that security forces have been ordered to curb the protests. An activist in Iran's Kurdistan province said "we are getting warnings from the security organisations to end the protests or face jail."

Videos shared on social media have shown demonstrators damaging symbols of the Islamic Republic and confronting security forces.

One showed a man scaling the facade of the town hall in the northern city of Sari and tearing down an image of Ayatollah Ruhollah Khomeini, who founded the Islamic Republic after the 1979 revolution.

On Wednesday in Tehran, hundreds shouted "death to the dictator" at Tehran University, a video shared by 1500tasvir showed.

Reuters could not verify the authenticity of the videos.

State media and officials have depicted the unrest as riots by "anti-revolutionary elements".

Members of the Basij, a militia under the umbrella of Iran's Revolutionary Guards, held their own rallies in Tehran on Wednesday. "The morality police is just an excuse, what they target is the regime itself," they chanted in a video posted on 1500tasvir.

Register now for FREE unlimited access to Reuters.comRegister

Reporting by Dubai Newsroom; Writing by Tom Perry and Dominic EvansEditing by David Gregorio and Rosalba O'Brien

Our Standards: The Thomson Reuters Trust Principles.

Go here to see the original:
Internet restricted in Iran as crackdown grows on spreading protests - Reuters

Read More..
Posted in Internet Security | Leave a Comment

Over 39K unauthenticated Redis services on the internet targeted in cryptocurrency campaign – Security Affairs

September 21, 2022 | Author: admin

Redis, is a popular open source data structure tool that can be used as an in-memory distributed database, message broker or cache. The tool is not designed to be exposed on the Internet, however, researchers spotted tens thousands Redis instance publicly accessible without authentication.

The researcher Victor Zhu detailed a Redis unauthorized access vulnerability that could be exploited to compromise Redis instances exposed online.

Under certain conditions, if Redis runs with the root account (or not even), attackers can write an SSH public key file to the root account, directly logging on to the victim server through SSH. This may allow hackers to gain server privileges, delete or steal data, or even lead to an encryption extortion, critically endangering normal business services. reads the post published by Zhu on September 11, 2022.

Now researchers from Censys are warning of tens of thousands of unauthenticated Redis servers exposed on the internet that are under attack.

Threat actors are targeting these instances toinstall a cryptocurrency miner.

There are 39,405 unauthenticated Redis services out of 350,675 total Redis services on the public internet. warns Censys. Almost 50% of unauthenticated Redis services on the internet show signs of anattemptedcompromise.

The general idea behind this exploitation technique is to configure Redis to write its file-based database to a directory containing some method to authorize a user (like adding a key to .ssh/authorized_keys), or start a process (like adding a script to /etc/cron.d), Censysadds.

The experts found evidence that demonstrates the ongoing hacking campaign, threat actors attempted to store maliciouscrontab entriesinto the file /var/spool/cron/root using several Redis keys prefixed with the string backup. The crontab entries allowed the attackers to execute a shell script hosted on a remote server.

The shell script was designed to perform the following malicious actions:

The researchers used a recent list of unauthenticated Redis services running on TCP port 6379 to run a one-time scan that looked for the existence of the key backup1 on every host. Censys found thatout of the 31,239 unauthenticated Redis servers in this list, 15,526 hosts had this key set.These instance were targeted by threat actors with the technique described above.

Most of the Internet-exposed Redis servers are located in Chine (15.29%) followed by Germany (14.11%), and Singapore (12.43%).

Still, this does not mean that there are over 15k compromised hosts. It is improbable that the conditions needed for this vulnerability to be successful are in place for every one of these hosts. The primary reason many of these attempts will fail is that the Redis service needs to be running as a user with the proper permissions to write to the directory /var/spool/cron (i.e., root). concludes the report. Although, this can be the case when running Redis inside a container (like docker), where the process might see itself running as root and allow the attacker to write these files. But in this case, only the container is affected, not the physical host.

The report also includes a list of mitigation for these attacks.

Follow me on Twitter: @securityaffairs and Facebook

PierluigiPaganini

(SecurityAffairs hacking, mining)

Link:
Over 39K unauthenticated Redis services on the internet targeted in cryptocurrency campaign - Security Affairs

Read More..
Posted in Internet Security | Leave a Comment

Elon Law to host global webinar on election security – Today at Elon

September 21, 2022 | Author: admin

Professor David S. Levine has convened several of the nation's leading experts on election law and voting technology for an October 19 online program that is free and open to the public with advanced registration.

Elon University School of Law is hosting an October conversation with legal experts who will explore the debate over voting machine technology and, more broadly, challenges to democratic systems of governance.

Moderated by Professor David S. LevineWednesday, October 19, 202212:30-1:45 p.m. ET via Zoom

Advanced registration required by clicking this link. There is no cost to attend.

Since Bush v. Gore, the US has been debating elections and their reliability. Voting machines have been on the front lines of the debate, along with technology more broadly. How can policy makers foster trust in election outcomes? How will technology impact that trust?

Elon Law is hosting the conversation with input from Smartmatic, a multinational electronic voting technology firm. The aim: Encourage open discussion of election challenges and how technology, including voting machines but also social media and the internet more generally, influences public perceptions.

Eric Goldman is associate dean for research, a professor of law, and co-director of the High Tech Law Institute at Santa Clara University School of Law where he also supervises the Privacy Law Certificate program. His research and teaching focuses on Internet law, and he blogs on that topic at the Technology & Marketing Law Blog.

is a professor of computer science & engineering and director of the Center for Computer Security & Society at the University of Michigan. His research spans security and privacy, with an emphasis on problems that broadly impact society and public policy, and he has twice testified before Congress and serves as co-chair of the State of Michigans Election Security Advisory Commission. In 2019, he was named an Andrew Carnegie Fellow in support of his efforts to strengthen the technological foundations of American democracy.

Irina D. Manta is a professor of law and the founding director of the Center for Intellectual Property Law at the Maurice A. Deane School of Law at Hofstra University. Mantas research spans legal issues involving intellectual property, torts, the internet, privacy, national security, and immigration. A graduate of Yale Law School and Yale University, she also co-hosts the dating podcast Strangers on the Internet.

Edwin Ed Smith is the director of global services and certification in North America for Smartmatic where he oversees service delivery as well as U.S. federal and state certification. He also serves as a subject matter expert in areas of system development, process improvement, and product enhancement as well as technical pre-sales across all product lines. Smith currently chairs the Elections Infrastructure Sector Coordinating Council organized under the federal critical infrastructure law to facilitate industry-Department of Homeland Security collaboration for the protection of elections infrastructure.

Professor David S. Levineis an affiliate scholar at Stanford Law Schools Center for Internet and Society. From 2014-2017, he was a visiting research collaborator at Princeton Universitys Center for Information Technology Policy. The founder and host of pioneering radio showHearsay Culture, Levine is the co-author of Information Law, Governance, and Cybersecurity (West 2019) (with Sharon Sandeen). His work on voting machine technology and information access has been cited and published in leading newspapers and academic journals in the United States and European Union.

Continue reading here:
Elon Law to host global webinar on election security - Today at Elon

Read More..
Posted in Internet Security | Leave a Comment

Information Environment: Opportunities and Threats to DOD’s National Security Mission – Government Accountability Office

September 21, 2022 | Author: admin

What GAO Found

Given the ubiquitous nature of the information environment, both DOD and adversaries can conduct operations and activities in the information environment from anywhere in the world. Additionally, with DOD capabilities dependent on IT and the electromagnetic spectrum (EMS), its ability to conduct operations and activities in any of the physical domains (land, maritime, air, and space) is reliant on protecting the information environment. Based on a review of DOD strategies, questionnaires, interviews, and guidance documents, GAO found:

Ubiquitous and Malign Information. The fusion of ubiquitous information and technology has granted individuals, organizations, and nation-states the ability to target the cognitive foundations of individualsbeliefs, emotions, and experiencesfor purposes either benign or malign. The proliferation of ubiquitous information, misinformation, disinformation, and malinformation has prompted defense experts to begin examining the concept of cognitive security.

Relationship between Misinformation, Disinformation, and Malinformation

DOD Missions and Functions. Technology, the EMS, and the sharing of data are integral to accomplishing DOD's missions in the information environment. DOD components consistently identified the conduct of military operations, communications, command and control decision-making, and others, as missions and functions affected by the information environment.

Threat Actors. National and DOD strategies recognize that nation-statessuch as China, Russia, Iran, and North Koreahave demonstrated that they are threat actors in the information environment, employing malicious cyber, EMS, and influence activities against DOD interests. Additionally, nonstate actorssuch as insider threats, foreign terrorists, transnational criminal organizations, and otherspose a threat to DOD personnel at home and abroad.

Threat Actions. DOD components highlighted a variety of cyberspace threats, information or intelligence collection threats, influence threats, and EMS threats that adversely affect DOD personnel and capabilities (see figure below).

Institutional Challenges. National and DOD strategies and documents identify a number of institutional challenges that DOD must address. The challenges include a lack of leadership emphasis, lack of resources, the implications of new technologies, and dated processes. DOD components identified personnel, funding, IT, organization, and training as the most important institutional challenges they face related to the information environment.

Emerging Technologies. DOD components identified a variety of technologies that may present either opportunities for or threats to DOD in the information environment: artificial intelligence and machine learning, quantum computing, social media platforms, and bots. Additionally, relevant reports and subject matter experts have identified extended reality, fifth-generation wireless telecommunications, and the Internet of Things as technologies that could have either positive benefits or negative consequences for DOD.

Past and Planned DOD Actions. Achieving and sustaining an advantage requires DOD to undertake and plan actions across multiple areas, including doctrine, organization, and training. For example, DOD elevated the concept of "information" and has been revising its doctrine publications to reflect the fundamental nature of information in joint operations.

Threat Actions in the Information Environment

Today's information environment poses new and complex challenges for national security as the world has shifted from an industrial age to an information age. Advances in information technology, wireless communications, and social media have increased the speed and range of information, diffused power over information, and shifted socio-cultural norms. The United States' competitors and adversaries are taking advantage of these advances and the subsequent effects in the information environment to offset the U.S.'s conventional warfighting advantages.

The Department of Defense (DOD) defines the information environment as the aggregate of individuals, organizations, and systems that collect, process, disseminate, or act on information consisting of physical, informational, and cognitive dimensions, as shown in the figure below.

Three Dimensions of the Information Environment

To illustrate and better inform Congress and DOD officials, this report describes DOD's use and protection of the information environment through the following six key elementsubiquitous and malign information, effects on DOD's mission, threat actors, threat actions, institutional challenges, and emerging technologies that can enable or adversely affect DOD's missions. This report also describes DOD actions taken and planned to use and protect the information environment.

To prepare this report, among other things, GAO administered questionnaires to 25 DOD organizations involved in the information environment. GAO staff also interviewed officials and subject matter experts; reviewed 35 documents on strategy, policy, doctrine, and other guidance from DOD and other federal agencies; and reviewed studies and other documents.

For more information, contact Joseph W. Kirschbaum at (202) 512-9971 or kirschbaumj@gao.gov.

See more here:
Information Environment: Opportunities and Threats to DOD's National Security Mission - Government Accountability Office

Read More..
Posted in Internet Security | Leave a Comment