Keeping information systems secure is a complex calculus in today’s fast-changing landscape. Malicious attacks aren’t just perpetrated by disgruntled employees or random hackers. State-sponsored or supported attacks are a constant threat to many countries, companies and individuals.
Cybercrime is difficult to contain, partly because cryptocurrencies — as opposed to normal currencies — are used to pay for ransomware and other attack tools. To protect against these modern-day threats, small and large organisations must always remain vigilant.
Vigilance requires a regular audit of information systems, the ecosystem in which they operate and a periodic review of potential threats and vulnerabilities that attackers could exploit.
Cybercrime
Threats like these are not hypothetical or imagined; they are real. Cybercrime costs Africa $4 billion a year, according to conservative estimates. Losing $4 billion to cybercrime is a significant loss for a continent with an estimated GDP of $3 trillion.
There are more costs to cybercrime than just financial ones. An organisation’s reputation can be damaged, stolen data may be too costly to recover, and so is compromised intellectual property. Additionally, when critical systems, such as national election systems, are infiltrated or manipulated, or when healthcare systems are laced with malware that causes havoc for health workers, it can pose a national crisis.
The surest way to know what lies under the hood of information systems is by carrying out regular cybersecurity audits. Cybersecurity audits test compliance with an organisation’s security policies, security safeguards and standards that an organisation has put in place.
The audit exercise is comprehensive, reviewing an organisation’s IT infrastructure. Audits ascertain that appropriate policies and procedures have been implemented and are working effectively. It helps the management to understand the security and confidentiality of the information within the system, and whether the data is accurate, reliable and timely.
Malicious actors
This process informs the management of any weaknesses that could open the doors for malicious actors to gain access to sensitive information. It highlights poor internal practices that might result in employees accidentally or negligently breaching sensitive information; and can point out how an information system and allied processes are compromised to aid fraud.
Armed with audit findings, the management can embark on an exercise to seal any loopholes and build a moat around its critical IT systems.
It’s good practice that, with increased reliance on information technology, organisations conduct cybersecurity audits annually. More frequent audits may be necessary depending on the organisation’s size, the criticality of its functions and available resources.
Organisations should also conduct a cybersecurity audit whenever they make significant operational changes, such as migrating to a new system or when different systems are integrated after organisations merge.
Notably, every organisation needs a competent, relevant and effective information systems audit function to verify, report and offer guidance about the efficient functioning of the cybersecurity function.
Share this news
This Year’s Most Read News Stories
Tanzania central bank tells hotels to obtain foreign currency exchange license
BoT governor, Emmanuel Tutuba, urges tourist hotel owners and operators to obtain foreign currency exchange licences to combat the black market.Continue Reading
Juma Haji Duni: A legacy of resilience and leadership in Zanzibar politics
The recurring inefficiency among some contractors could lead the government to favour foreign firms, sparking criticism from stakeholders advocating for local participationContinue Reading
Rare megamouth shark found in Zanzibar for the first time – why so little is known about it
The recent sighting was only the sixth time a megamouth had ever been found off the coast of Africa.Continue Reading