Hackers can use the much-improved speed of the Internet in South Africa and most other developing countries to extract data and information from victims within ten minutes of penetrating the cyber defences of an individual or corporate organisation, says antivirus company Kaspersky Lab cyber security expert Stephan Tanase.

Companies should proactively engage with the risks posed by cyber security threats as part of the business’s risk mitigation, but most companies only realise that they need more security when the attacks have already taken place and sensitive data has been stolen, he says.

“Companies and individuals often need to become victims before realising that they should be actively protecting themselves and their data in all online engagements and virtual pre- sences,” he notes.

Advisory firm KPMG infor- mation protection advisory director Mark Craddock says data theft occurs in companies, but they tend to be confidential about incidents to contain the potential fallout.

“KPMG’s findings, locally and globally, point to trends that businesses are keeping their heads in the sand with regard to cyber security threats and attacks. In South Africa, we find that corporations know that they may experience cyber attacks, but see the costs of mitigating the risks of cyber threats as outweighing the benefits of mitigating cyber threat risks,” he says.

KPMG is aware of a successful cyber attack on a corporation in South Africa as recently as the beginning of this month, he adds.

Tanase highlights a worst-case scenario of Netherlands certification authority Diginotar that was hacked in 2010, but did not make the attack public, aiming to contain public relations reactions. However, the hackers publicised the attack and the company subsequently went bankrupt as it lost customer trust.

“Companies’ IT infrastructure holds customers’ data and companies must be trustworthy when an incident happens because one will happen. It is important to have procedures in place and to be transparent with customers about the extent and severity of the attack. For example, cloud note company Evernote notified users when it was hacked and explained the extent of the breach to customers so that they could secure their accounts and passwords,” he says.

Meanwhile, Kaspersky Lab launched a new holistic corporate cyber security solution that covers all aspects of corporate security, including individual mobile device security, data and transmission encryption and virtual machine security. The solution also enables IT departments to see the full inventory of devices and systems connected to a company’s network.

“All the security management is done from a single console across all devices and systems and patches are broadcast to all devices. The IT department can patch devices remotely and devices that are not up to date are excluded from connecting to the company’s network. Individuals can still use their own connectivity, but will not have access to the company’s network,” says Kaspersky Lab emerging markets MD Vasily Dyagilev.

Kaspersky Lab’s corporate security solution can even be deployed to mobile devices through short-message service (SMS).

“An SMS is enough and all rules will be applied to the device. Our system is simple, user-friendly and covers the entire spectrum of the security required by companies, compared with other solutions that only cover certain aspects of corporate security, resulting in gaps that can be exploited.”

The Kaspersky Lab system can also be used to determine which workers can access which applications. For example, only marketing employees can be allowed to access Facebook during work hours. Further, the system also checks on the data that employees are sharing, even over social networks, and IT departments can put a halt to unauthorised or unintended security and information breaches across the com- pany’s network, Dyagilev concludes.