Cyber threats change frequently as technology evolves. Today, four kinds of security threats are particularly prevalent at the moment. “Advanced, persistent threats can be entirely external or may involve an enemy within who works with hackers on the outside to plant certain malware within the organisation,” explains Carl Uys, Cyber Security Practitioner at Bowline Security.
“The malware will then take its time, spread laterally across the organisation, collect any sensitive data that it wants and sends that data back to the source. Another threat that we’re seeing is ‘metamorphic or polymorphic malware’— this malware is able to evolve like a chameleon. Your general IT controls would be in place for a particular version of this malware, and once it finds out that it’s been detected it has an ability to change and become some other form of malware that cannot be detected,” continues Uys.
Phishing is apparently on the increase as well.
“It is linked to a lack of awareness within organisations—where we are still prone to clicking on links that look authentic but are not authentic, and providing sensitive company information or personal data to the cyber criminals. Identity theft is one of the impacts of that,” he says.
Another form of a cyber threat that Bowline Security has been seeing in South Africa is something Uys refers to as a ‘denial of services threat’.
“The main objective is to disrupt services; we’ve seen the EFF site go down, we’ve seen the ANC site go down, we’ve seen the Department of Water site go down, we’ve seen Armscor’s site go down and we’ve seen the SABC site go down. This has, allegedly, been the work of the hacker group Anonymous. Businesses must understand that the next set of attacks will not just be a disruption of services, as this is the start of these hacker groups trying to establish at what maturity level organisations are in terms of the cyber security. When they are successful in bringing down an organisation easily, they will then launch variants of attacks, which will not only disrupt services but will actually start stealing information,” he explains.
Uys considers the lack of awareness about cyber security as both a challenge and an opportunity for Bowline. The company can trace its roots to the early years of the Millennium, when a lot of financial fraud was taking place. The Internal Audit Unit within the Treasury Department of KwaZulu-Natal mobilised an international task team lead by Mr Sbusiso Xulu, who also planted a security seed within Uys, to investigate the modus operandi relating to the fraud and conduct technology analytics within the government environment.
The success of project “Unembeza” resulted in the findings being handed over to SITA to implement. In 2011, Bowline Security was formed by three former Unembeza team members; a Canadian, an American and Uys as the South African.
Apart from a general interest in technology and cyber security, Uys is motivated by his desire to make the world a safer place. The company spends a lot of time urging businesses and public sector organisations to improve their security maturity levels when it comes to cyberspace. Bowline is able to assist organisations to evaluate their risk from a technology perspective and provides security technology that can assist in minimising these risks.
However, in accordance with what Uys considers to be international best practice, he says, “if we do the risk assessment, provide the monitoring and the analytics functions, then we can’t do the remediation because we cannot be a referee and a player in our industry”.
As a further demonstration of the company’s ethics, Uys explains: “We are definitely not saying that companies should go overboard and put in R3-million worth of security when the data they’re trying to safeguard is worth R500 000; the solution or measure of protection has to be relevant”.
Bowline works predominantly in seven key sectors in three countries but, says Uys, “we have made a benchmark in the energy sector, in petrochemicals and have also done a lot of research in the maritime and defence sectors. We are on a journey of really transforming the South African petrochemical industry, getting them from an immature stage of cyber security to the internationally preferred industry level.”
In addition to providing intelligence advisory services and international technology security solutions, Bowline is pursuing an exciting new line of work as it develops its own products. It owns a stake in Payprint, which has developed a biometric authentication system that is currently being piloted by two educational institutions in KwaZulu-Natal.
“We’ve developed a unique technology biometric authentication solution where you use your fingerprint to make payments. We have made security the foundation of the solution —we don’t need your card; we don’t need your phone, all you need is your fingerprint to make a payment. This solution safeguards you from card cloning and people obtaining your credit/debit card details,” explains Uys.
Although he isn’t able to divulge much detail on the other app in the pipeline, Uys does say that it involves online password security. The company is also trying to keep abreast of developments in artificial intelligence.
Bowline is keen to attract more young people to the field of cyber security.
“We’ve started partnering with the likes of the Cyber Security Institute and with Pearson Institute of Higher Education and technology giant, Cisco. We’re trying to map out a holistic programme where we can get students from high school into a higher institution of learning and, from there, posting them into companies like Bowline, where they will be made aware, from an early age, of the importance of cyber security,” says Uys.
Uys willingly proffers advice regarding cyber security, even for organisations that don’t have a large budget to spend. “Be careful of who you share your information with, don’t take it at face value that the services you’re using and the people you’re sharing information with will safeguard that information the same way you are safeguarding it.
“So, it’s who you’re sharing information with, what platform you’re using to share information- and the number of platforms—because if you post your information on multiple platforms then you’re creating multiple vulnerability points. If it’s business, keep it on a business platform—one space—make sure there’s a back-up but don’t have five back-ups,” he says.
Something which concerns Uys is that so many people aren’t even taking advantage of free verification services that exist.
“So many people’s Gmail accounts are being hacked but if you just take the time to go into your security settings and enable the verification, then every time you want to access your Gmail account, it will send a one-time pin to your cellphone. If you are not the user at that point in time, you don’t authorise it and, if someone has compromised your password, then they won’t gain access to your account,” he explains.
Business and government leaders shouldn’t underestimate the role people play in matters of security—it is definitely not just about technology. The processes that people follow can directly impact security. Uys is surprised that so many companies don’t even have appropriate usage policies that address use of the internet at work.
“Don’t wait to become a victim,” urges Uys. “The cost of recovery is often greater than the cost of accurately assessing your systems for vulnerabilities and addressing these,” he adds.
Having moved from the small town of Harding to Durban to study IT, Carl Uys used to repair computers and wash cars to make ends meet. Not content with his achievements to date, Uys is intending to pursue a Master of Science in Foreign Service before eventually specialising in cyber law.
With an estimated shortfall of six million cyber-security professionals worldwide, he feels there are ample career opportunities for young people with the right attitude. When asked what advice he has for his fellow youth, Uys express that: “relationships with God, family, friends and business partners inspire me to practise continuous improvement, therefore, I recommend that youth should stay grounded and focus on shaping a better future for the next generation by learning from those who are wiser than us and to shy away from a lifestyle that leads to destroying the gains our forefathers achieved.’