The Nigerian Cybersecurity Space-How Regulated Are We?
- 1. The Nigerian Cybersecurity Space – How Regulated? Who Regulates? Starring: Chinatu Uzuegbu CCISO, CISSP, CISM, CISA, CEH, …… CyberSecurity Consultant RoseTech THE SENATE, FEDERAL REPUBLIC OF NIGERIA, Committee on ICT and Cybercrime event Theme: The Digital Theatre and the Future of Nigeria
- 2. Chinatu Uzuegbu ❖ Managing Cyber Security Consultant, RoseTech. ❖ Founding Past President, (ISC)2 Nigeria Chapter. ❖ Member, Global (ISC)2 Chapter Advisory Committee(CAC). ❖ Member, VigiTrust Advisory Board, Ireland. ❖ Mentor, Open Cyber Security Mentorship Program(OCMP), AfrHackton and Cyber in Africa Initiative. ❖ Global Ambassador, WomenTech Network ❖ Finalist, Top 50 Women in Cybersecurity, Africa, 2020 ❖ Alumni, London Graduate School in Collaboration with CommonWealth University- Dubai Leadership Summit. 2020 ❖ Alumni, University of Liverpool- MSc. Information Systems Management ❖ Alumni, University of Port Harcourt-BSc. Computer science & Maths. ❖ Over 15 years Wealth of experience in IT and 10 years in Information Security with FIs, Manufacturing and Computer Firms. ❖ Professionally:CCISO, CISSP, CISM, CISA, CEH and other related IT Certifications. ❖ Professional Membership: (ISC)2, ISACA, EC-COUNCIL, CSEAN. ❖ Participated and Attended both International and Local Conferences. ❖ Aside Profession, inclined to Learning New Things, Reading, Cooking and Adventures. ❖ Open to Cyber Security Related Services.
- 3. Preamble Cyber Cyber Security CyberSpace The Communication and Interoperable Handshakes of The Cybernetics with Pictorial illustration. Concept of the CIA Triad, the approach to securing The CyberSpace. Concept of The Cybernetics The CyberSpace of a Nation The Global National Security Alliance Perspective The Conceptual and Contextual Approach You can’t go wrong with GAP Analysis/Checklist Laws, Regulations, Frameworks and Governance International Regulations and Frameworks How Regulated is Nigeria across All Sectors and Industries? Seamless alignment with The Standards/Best Practices is the way to go! The SMART principle approach would help. Importance of Regulations and Frameworks Who Regulates in Nigeria? Key Players of the various Industries overseen by ONSA. Conclusion
- 4. Cyber The Concept of The Cybernetics ❖ Coined out from the word Cybernetics. ❖ Cybernetics is the study of Medical Science, Biological Science, Applied Science, Natural Science, Engineering, Electronic devices, Data, Information, Artificial Intelligence, Machine Learning , Infrastructures, Computers, Laptops, Technology, Communications, and other related systems with the aim of promoting good governance and Control around the inter-connectivity and interoperability of these elements- The Cybernetic Elements. ❖ Cybernetics is derived from the Greek word Kybernetes meaning a Person in Control, more like a Man on the Steering for a long drive.
- 5. CyberSpace
- 6. The CyberSpace of a Nation ONSA Parliament Commissioning Bodies Regulatory Bodies Contratual and standards •The Forces •Law Enforcement •All Public Sectors: •Education •Transportation •Health •Trades and Commerce •Immigration •National Population •National Communications •National Identity •Revenues •Postal Services •NITDA •ICT • Others EFCC NFIU CBN Others Governance of any firm outside the government Private Sector
- 7. Cyber Security The Concept of The CIA Triad ❖ The Process or act of protecting your Cybernetic Elements from Undue Disclosure, Modification and Destruction. ❖ The Process or act of protecting our Cybernetic Elements based on the acceptable level of Confidentiality, Integrity and Availability-The CIA Triad. ❖ The CIA Triad is generally seen as the philosophy of Cyber Security: ➢ Confidentiality- The act of protecting the Cybernetic elements from unauthorised Disclosure ➢ Integrity- The act of protecting the Cybernetic elements from unauthorised Modification. ➢ Availability- The act of protecting the Cybernetic Elements from unauthorised Destruction. The other side of the coin Modification
- 8. The Philosophy of Cyber Security The philosophy of Cyber Security can be categorised into three Layers: 1. The Focused or Objective Layer- Achieving an Acceptable level of: Confidentiality, Integrity and Availability(CIA Triad). 2. The Three Control Types: Administrative, Technical and Physical. 3. The Seven Security Measures, Safeguards or Countermeasures: Preventive, Detective, Deterrent, Corrective, Recovery, Compensative and Directive. CIA Triad Admin Tech Physical Prevent, Detect, Deter, Correct, Recover, Compensate, Direct
- 9. Regulations, Governance and Frameworks ● Regulation is the overarching concept that drives Governance and Frameworks for necessary compliance and enforcements. ● Governance is the framework of authority and accountability that defines and controls the outputs, outcomes and benefits from projects, programmes and portfolios. The mechanism whereby the investing organisation exerts financial and technical control over the deployment of the work and the realisation of value. ● A framework is a conceptual structure defined by the governance of an organisation to set out policies within the company.
- 10. Importance of Regulations and Frameworks ● Promotes good Security Posture and Culture. ● Promotes Clean Hygiene in your Processes. ● Assurance that you are aligned with Best Practices. ● Accurate posture when combined with GAP Analysis. ● You cannot go wrong with Regulations……..
- 11. International Regulations and Frameworks •ECPA-Electronics Communications Privacy Act. •GLBA-Graham Leach Bliley Act •SOX-Sarbanes-Oxley Act. •HIPAA-Health Insurance Portability and Accountability Act. •FERPA-Family Educational Rights and Privacy Act. •DMCA-The Digital Millennium Copyright Act. •European Union Data Directive(Privacy Regulatory) on Personally Identifiable Information-PII. •The Privacy Shield(replacement of US Safe Harbor) for countries outside EU in need of EU Citizens data consent: Canada(PIPEDA), Australia, Argentina, EFTA(Switzerland, Iceland and Others), Asia Pacific Economic Corporations) and other Companies through Contractual bindings.
- 12. Links to Some International Frameworks ❖ https://www.iso.org/isoiec-27001-information-security.html ❖ https://csrc.nist.gov/Projects/risk-management/sp800-53- controls/ ❖ https://www.pcisecuritystandards.org/pci_security/ ❖ https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html ❖ https://www.cisa.gov/federal-information-security- modernization-act ❖ https://www.ftc.gov/tips-advice/business-center/privacy-and- security/gramm-leach-bliley-act ❖ https://www.hhs.gov/hipaa/index.html
- 13. Nigerian Cyber Security Frameworks and Initiatives 1. National CyberSecurity Policy and Strategy- NCPS. https://education.gov.ng/national- cybersecurity-policy-and-strategy-2021/#1 2. Nigeria Data Protection Regulation-NDPR. https://nitda.gov.ng/wp- content/uploads/2021/01/NDPR- Implementation-Framework.pdf 3. Other Frameworks and Regulatory ACTs from NCC, CBN and others.
- 14. How Regulated is Nigeria across All Sectors and Industries? ● Could only be ascertained and measured with Synergy and Collaborations with All Governing Bodies and Key Players of the various Industries but it has to be driven from ONSA. ● The involvement of All Key Players of the various Bodies would ensure all areas and Critical Paths are well outlined. ● Customization of the Standard and International Regulations around each Sector highly depends on the jurisdiction of the Nation. The Location and what should apply. ● Already existing Regulations should be enforced and tested globally to ensure alignment with other developed Countries especially that of NDPR. ● The publicity with fines that go with violations should be catchy and lets those in Diaspora understand the regulations that apply here too when it has to do with relative transfer and exchange of Information. ● ONSA should map out a sub-section tagged Cyber Security Alliance to drive the Regulations and enforcements
- 15. The Regulation Structure ONSA Parliament Commissioning Bodies Regulatory Bodies Contratual and standards •The Forces •Law Enforcement •All Public Sectors: •Education •Transportation •Health •Trades and Commerce •Immigration •National Population •National Communications •National Identity •Revenues •Postal Services •NITDA •ICT • Others EFCC NFIU CBN Others Governance of any firm outside the government Private Sector
- 16. Conclusion ● Running with Regulations is achievable if we could apply the concept of The National Security Alliance. ● Most Key Industries are already aligning their processes with Standard Regulations, identify them and inculcate them into the Cyber Security Alliance group to represent each industry under the various Sectors.
- 17. Thank You!