The Tatua Digital Resilience Centre participated in a workshop on “Strengthening Cyber Resilience” organised by the Communications Authority of Kenya in partnership with the UK’s Foreign, Commonwealth & Development Office (FCDO). The event delved into the critical issues shaping Kenya’s cybersecurity environment amidst its rapid digital transformation. As one of East Africa’s leading technological hubs, Kenya has witnessed tremendous growth in digital adoption. As of June 2024, 66.1 million devices were connected to mobile phone networks, indicating a 128.3 % penetration rate. Additionally, the smartphone penetration rate stood at 68.3 %, reflecting a growing preference for devices with advanced functionalities like social media, gaming, videoconferencing, etc. However, this progress has exposed Kenyans to a surge in cyber threats that pose significant risks to Kenya’s economic stability and national security. Below are the key issues, threats, and recommendations for strengthening Kenya’s cybersecurity framework:
Cybersecurity Challenges in Kenya
The discussions highlighted the following pressing challenges facing Kenya’s cybersecurity landscape:
- Rise in Cybercrime: Mobile banking fraud, ransomware, business email compromise (BEC), and social engineering are among the most prevalent cybercrimes. Mobile platforms, widely used by Kenyans for financial transactions, are particularly vulnerable.
- Critical Infrastructure Vulnerabilities: Attacks on critical national infrastructure (CNI), including IT/OT systems, have escalated. Key concerns include Denial-of-Service (DDoS) attacks and ransomware targeting essential services.
- Digital Forensics Gaps: Limited expertise in areas like mobile phone forensics, live data analysis during arrests, and solid-state drive (SSD) forensics is a significant investigative challenge.
- Dark Web and Cryptocurrency Risks: The dark web has become a hub for selling compromised credentials and laundering funds through privacy-focused cryptocurrencies.
- Insider Threats and Third-Party Risks: Internal parties with access to sensitive systems and third-party vendors often introduce vulnerabilities, either through negligence or malicious intent.
During the workshop, stakeholders recommended the following strategies to strengthen Kenya’s resilience to existing and emerging cyber threats:
- Public-Private Partnerships (PPP): Encouraging collaboration between government entities like the National KE-CIRT/CC and private enterprises can foster resilience against cyber threats.
- Policy Enhancements: Updating legal frameworks to mandate cybersecurity compliance across industries is crucial. Specifically, frameworks must create avenues for effective threat intelligence sharing amongst collaborating parties while balancing data protection needs.
- Technological Investments: It is important to invest in advanced threat detection systems and forensic tools to enhance Kenya’s investigative capabilities.
- Threat Intelligence Sharing: Kenya must improve existing collaboration frameworks to encourage secure information exchange and develop new ones to address emerging barriers like data protection concerns.
- Capacity Building: Training programs should focus on advanced digital forensics skills, such as live data analysis and advanced Open Source Intelligence capabilities for tracking cybercriminals and their activities.
- Incident Response Frameworks: We must develop robust response plans for common cybersecurity incidents and critical infrastructure breaches. Remember no one can afford to say that they will never fall victim to a cyberattack, and as a digital nation, the potential costs of poor incident management are dire.
Conclusion
The workshop underscored that while Kenya’s digital transformation offers immense opportunities, it also necessitates a robust cybersecurity framework to safeguard its digital economy. By addressing capacity gaps, fostering collaboration, and investing in advanced technologies, Kenya can mitigate cyber risks while building trust in its rapidly evolving ICT ecosystem. Tatua’s participation in this event reflects a commitment to advancing cybersecurity awareness and resilience solutions in Kenya’s dynamic digital landscape. We encourage more CSOs to actively contribute to Kenya’s cyber resilience conversations to ensure their social justice work is adequately protected against current and emerging cybersecurity threats.