Current Situation of IT Security Awareness and Education in Afghanistan

1. Current Situation IT Security Awareness
and Education in Afghanistan
Zohra Zekeria
19 December 2016

2. “Any technical defense measure would be useless if the en>re
staff is not cyber-aware”
Steve Durbin(Managing director of Informa>on Security Forum ISF)
16-12-19 2

3. Agenda
• Introduc)on
• Why IT Security is important?
• Vulnerabili)es
• What to do?
• What security awareness and educa)on is?
• Situa)on in Afghanistan
• Solu)on and Conclusion
16-12-19 3

4. Introduction
• Advances in informa>on and communica>ons
technologies have revolu>onised government ,
educa>onal and commercial infrastructures
(Afghanistan Payment System AFPay).
• The opera>onal stability and security of cri>cal
informa>on infrastructure is vital for economic security
of the country.
• Personal files, bank account details, client informa>on,
and payment informa>on can be hard to replace and
poten>ally dangerous if it falls into the wrong hands. To
mi>gate against risks resul>ng from data leakage, it is of
paramount importance to have an IT security system.
16-12-19 4

5. Why IT Security is Important?
16-12-19 5

6. 16-12-19 6

7. Attacks in last two months around the world [1]
16-12-19 7

8. Leak of Azerbaijani Banking and Military Data
• Monte Melkonian Cyber Army (MMCA)
• Personal data of 1200 Azerbaijani officers including names, ID
numbers, phone numbers residence addresses and other details
• Hacked several Azeri embassies and government websites: Azeri
embassy in Bulgaria, Netherlands and Qatar, Ministry of Foreign
Affairs AIDA.
16-12-19 8

9. 16-12-19 9

10. 16-12-19 10

11. Vulnerabili)es
Technical
Vulnerabili>es
Web applica>on:
Injec>on, Broken
authen>ca>on …etc.
Organiza>onal
Vulnerabili>es
Human
Behavior ,Social
Engineering
16-12-19 11

12. Human Behavior
16-12-19 12

13. Human Behavior
16-12-19 13

14. Social Engineering
“Amateurs hack systems, professionals hack people”
Bruce Schneier
16-12-19 14

15. What to do?[3]
16-12-19 15
Security
Policies
Security
Awareness
Security
Technologies

16. 16-12-19 16

17. Security Awareness
• Awareness is not training
• The purpose of awareness presenta>ons is simply to focus aben>on
on security
• Awareness presenta>ons are intended to allow individuals to
recognize IT security concerns and respond accordingly [4]
16-12-19 17

18. 16-12-19 18

19. Situation In Afghanistan
• Afghanistan as developing na>on have par>ally implemented IT
services.
• Either technical and non technical staffs do not have informa>on
about security.
• Just some organiza>on have security professionals but the other
staff are not aware of security
16-12-19 19

20. Common Mistakes Creates big Problems
16-12-19 20
Foreign Rela>on Affairs System
Managers
Teachers
Unauthorized Applica>ons
Culture

21. Solution
• Security Awareness
• Not just for the geeks!
• Security Training at all levels
• Con>nuing educa>on and awareness – not a one->me shot!
• Make it part of the culture
16-12-19 21

22. Contd …
• Iden>fy in which domain you have to rise the Awareness
• Know your audience
• Address the audience in the best way
• Test the effec>vity of the awareness rising campaign
16-12-19 22

23. Conclusion
• The only way to mi>gate the threats are to combine the
policies ,technology and awareness.
• Informa>on Security is the responsibility of everyone
• Afghanistan needs Awareness programs
• Make it part of the culture
16-12-19 23

24. Informa>on security is as simple as A B C:
Always Be Careful!
Thank You
J
16-12-19 24

25. References
[1] Morgan, L. (2016, September 27). List of data breaches and cyber
abacks in September 2016. Retrieved November 30, 2016, from
hbp://www.itgovernance.co.uk/blog/list-of-data-breaches-and-cyber-
abacks-in-september-2016/
[2] Armenian Hackers Leak Azerbaijani Banking and Military Data.
(2016, September 25). Retrieved from hbps://www.hackread.com/
armenian-hackers-leak-azeri-banking-military-data/
[3] R. Von Solms and J. Van Niekerk, “From informa>on security to
cyber security,” computers & security, vol. 38, pp. 97–102, 2013.
[4] M. Wilson and J. Hash, “SP 800-50. Building an Informa>on
Technology Security Awareness and Training Program,” 2003.
16-12-19 25

26. 16-12-19 26