Regulatory perspective in dealing with Cyber crime

ICT WEEK, 17ICT WEEK, 17THTH MAY 2016 MAY 2016Regulatory perspective in dealing Regulatory perspective in dealing with the cybercrime challenges with the cybercrime challenges

Joseph NzanoJoseph NzanoAg. Assistant Manager, Cyber Security & E-Ag. Assistant Manager, Cyber Security & E-

CommerceCommerce

Aligning Business to ICT Aligning Business to ICT

2

Nature of the InternetNature of the InternetThe Borderless Nature of the Internet

Source: GoogleSource: Google

Anonymity on the Internet drives the tendency towards abuse.

“On the Internet, nobody knows who really is on the other end”Source: GoogleSource: Google

Nature of the InternetNature of the Internet……

Uses of the InternetUses of the Internet



Uses of the InternetUses of the Internet……

The Internet of Things (IoT)


Uses of the InternetUses of the Internet……

What is Cybersecurity?What is Cybersecurity?

• Cybersecurity = Information and Communications Technology (ICT) Security.

• The protection of computers, programs and data (Critical Internet Infrastructure) against unauthorized access and criminal use.

Types of Cyber CrimeTypes of Cyber Crime• Hate messages propagated through the Internet,

computers, mobile phones, tablet PCs


Types of Cyber CrimeTypes of Cyber Crime......• Distributed Denial of Service (DDoS)


• Phishing Scams

Types of Cyber CrimeTypes of Cyber Crime......


• Website Defacement



• Espionage



• Spam emailTypes of Cyber CrimeTypes of Cyber Crime......


• Malware Types of Cyber CrimeTypes of Cyber Crime......


• Brute force attacksTypes of Cyber CrimeTypes of Cyber Crime......


19

38341Total Abuses Reported

47% of Total Abuse 52.3% of Total Abuse 0.7% of Total Abuse

B

Overview of KenyaOverview of Kenya’’s National Cybersecurity s National Cybersecurity - Legal Instruments- Legal Instruments

Kenya Information and Communications Kenya Information and Communications Act of 1998 (KICA)Act of 1998 (KICA)

Section 83C of KICA: E-Transactions & Cybersecurity:•To promote and facilitate the efficient management of critical Internet Resources; and•Develop a framework for facilitating the investigation and prosecution of cybercrime offences•Facilitate electronic commerce and eliminate barriers to electronic commerce •Develop regulations with respect to Cybersecurity, E-Transactions, Electronic Certification and Domain Name Administration

Kenya’s Cybersecurity Governance Structure

Establishment of the National KE-CIRT/CC

Mandate: To offer advice on Cybersecurity matters nationally and to coordinate response to cyber incidents in collaboration with relevant stakeholders.

The National KE-CIRT/CC is also Kenya’s national trusted cybercrime management point of contact.

Functions of the National KE-CIRT/CCFunctions of the National KE-CIRT/CC

Implementation of the National KE-CIRT/CCImplementation of the National KE-CIRT/CC

The Authority adopted a phased approach in the implementation of the National KE-CIRT/CC as follows:•Phase 1: Completed in October 2012 and officially launched by H. E. the President in June 2014. Involved provision of reactive National CIRT services. The reactive services include coordination and responses to Cybersecurity incidents, capacity building and awareness creation on Cybersecurity.

•Phase 2: Involves both reactive services and proactive services. The proactive services include ability to detect cyber attacks before they happen. This is achieved through collaboration.

Implementation of the National KE-CIRT/CCImplementation of the National KE-CIRT/CC

• Phase 3: Involves the ability to secure and analyze evidence as well as conduct research and development. Implementation was finalized in January 2016 with the deployment of a Digital Forensics Centre (DFC) and undertook training for the technical and law enforcement officers from the various government agencies on digital forensic techniques. The DFC will enable the National KE-CIRT/CC conduct Cybersecurity research and development including vulnerability analysis and malware reverse engineering, among others.

The National KE-CIRT/CC collaborates with: Law enforcement agencies

Central Bank of Kenya (CBK)

Financial sector industry association (KBA)

Telecommunication industry association

Academia

Public utility companies (KPLC, KPA, Nairobi Water and Sewerage Company, among others) and

Critical infrastructure service providers (SEACOM, TEAMS and EASSY), among others.

27

Collaboration in cybercrime management at the National Level

Overview of the National Public Key Infrastructure (NPKI)

Key: E-CSP: Electronic Certification Service Provider licensed by the Communications Authority of Kenya (CA) to issue Digital Certificates (Virtual IDs).

National Public Key Infrastructure (NPKI)

•The National Public Key Infrastructure (NPKI) project is coordinated by the Ministry of ICT in collaboration with the Communications Authority of Kenya (CA) and the ICT Authority (ICTA).

•A Public Key Infrastructure (PKI) refers to a system for the creation, storage and distribution of digital certificates which are used to verify that a particular public key (online identity) belongs to a certain entity.


• The NPKI comprises of a Root Certification Authority (RCA) which is managed by the Communications Authority of Kenya as a regulatory function and the Government Certification Authority (GCA), referred to as an Electronic Certification Service Provider (E-CSP) which is managed by the ICTA.

• The NPKI creates a framework for protecting communications and stored information from unauthorized access and disclosure by addressing the fundamentals of cyber security - confidentiality, integrity, authentication and non-repudiation.


• The Kenya Information and Communications Act of 1998 mandates the Authority to issue licences to persons operating an Electronic Certification Service.

• In this regard, the Authority has developed a licensing framework for Electronic Certification Service Providers (E-CSPs).

Benefits of the NPKIBenefits of the NPKI

• Operates under the Kenyan law

• Ability to digitally sign electronic data and information to ensure integrity of the data and non-repudiation.

• Ability to encrypt electronic data and information to ensure confidentiality.

Role of CA in growth of Dot KE ccTLDRole of CA in growth of Dot KE ccTLD• The Dot KE country code Top-Level Domain (ccTLD) is

Kenya’s unique and authentic identity on the Internet.• In line with government efforts to embrace e-Transaction

services, there is need to support the adoption and growth of the Dot KE ccTLD by promoting its usage as the default domain name of choice for Kenyans. This will not only ensure growth of the Dot KE name space but also:• Enhance the level of data protection given that the Dot KE name

space is under Kenyan jurisdiction. • Reduce capital flight given that the annual Dot KE domain name fees

remain local.

Dot KE Domain Name Management FrameworkDot KE Domain Name Management Framework

Kenya has developed a national framework for the administration of the Dot KE country code top-level domain (ccTLD) through the following:•KICA•Regulations•Licensing Framework

o Dot KE Domain Name Registry Service Provider Licence o Dot KE Sub-domain Name Registrar Service Provider Licence

35

Capacity building and Awareness creation

The Authority’s National KE-CIRT/CC has facilitated:

Hosting of International & Regional conferences/workshops on Cybersecurity

County Forums (Kikao Kikuu)

Child Online Protection

How to report Cyber attacks to the How to report Cyber attacks to the National KE-CIRT/CCNational KE-CIRT/CC

•Web portal: http://www.ke-cirt.go.ke;•Email: [email protected]; •Visit the Authority’s National KE-CIRT/CC located at the CA Centre along Waiyaki Way.•Telephone hotlines: +254-703-042700; +254-730-172700•Via a letter addressed to:

The Director-GeneralCommunications Authority of Kenya (CA)CA Centre, Waiyaki WayP.O. Box 14448NAIROBI 00800

http://www.ca.go.ke/

http://www.ca.go.ke/

mailto:[email protected]

37

Incident Reporting Portal

Regulatory perspective in dealing with Cyber crime

Presentations & Public Speaking

Transcript of Regulatory perspective in dealing with Cyber crime