The Communications Authority of Kenya (CA) has, through the National Computer Incident Response Team Coordination Centre (National KE-CIRT/CC), issued a warning to Internet users on supply chain risks in third-party software. This follows a global trend where cybercriminals exploit the vulnerability within the supply chains to hit their targets.
Although Kenya has not been adversely affected by such attacks, the trend depicts a serious concern in cybercrime management and thus internet users are advised to take precaution when dealing with outsourced products and personnel. Internet users are advised to make informed and risk-free decision on the choices of their products by engaging Cybersecurity experts.
The trend is said to be gaining momentum with the increased offers of free anti-malware products by vendors. The free anti-malware are used as a bait to lure the unsuspecting users, while the real intention is to have the anti-malware installed into a system, then use it to capture personal and confidential data. Such vendors later monetise the data collected or use it to their political or business advantage. This trend applies not only to anti-malware solutions but also any other third party software.
According to the authority, cybercriminals are now using third-party software to deliver threats to unsuspecting users in an attempt to compromise and steal their personal data. The authority further advised users to treat free or low-cost cybersecurity software as potential threats and where possible refrain from the usage. Users should strive to determine their monetization methods and their policies they should endeavour to read the terms and conditions of their usage however lengthy they are.
Government institutions and organisations are warned to properly vet software vendors in order to ascertain any concealed motive that might work against their interests especially with products interacting with organisation’s critical infrastructure. Products or vendors with tainted history should be dealt with as a risk, and constant reviews carried out.
The authority says that Kenyan ICT consumers should be concerned about the safety of their data more than ever before. Consumers should thus avoid “they will do it” approach but should rather collaborate with the service providers in securing the services.
It is estimated that a majority of cyber-attacks originate from the supply chain or from the external parties exploiting security vulnerabilities within the supply chain. Supply chain attacks are now moving into the mainstream of cybercrime, and with a number of successful attacks in 2016 and 2017, cybercriminals will focus on this method in 2018 and beyond.
Edited by Fundisiwe Maseko
Follow Fundisiwe Maseko on Twitter
Follow IT News Africa on Twitter
