Security Confidential S5 E5 Laura Tich

Manoj Tandon:
Hello everyone, and welcome to another episode of Dark Rhino Security Confidential.

Today we have Laura Tich joining us. Laura comes to us all the way from Kenya. She has been gracious enough to take time out of her day to come onto this podcast. I think we’re like 6 to 12 hours apart, something like that. It’s a very long distance.

Laura has a great background and a lot of experience in cyber. Laura has been nominated as Cybersecurity Woman of the Year. She is one of the nominees. She is the founder of SheHacks KE, and she’s an ethical hacker.

She has been driving the subject of not just cybersecurity, but computation and using digital media in her native land and bringing a lot of issues to light. She’s a wonderful person. We’re honored to have you, Laura. Thank you for joining the show.

Laura Tich:
Thank you so much, Manoj, for inviting me to join the podcast.

Manoj Tandon:
I’m glad you could make it. Laura, I know you’re one of the nominees for Cybersecurity Woman of the Year, and what an honor. What can you share with us regarding what led to that nomination?

Laura Tich:
Yeah, so I think what led to the nomination is the work I’ve been doing in Kenya.

We founded SheHacks Kenya alongside myself and Evelyn Kilel in 2016. What we saw was there was a lack of women’s representation in the information security industry in Kenya. So we created a platform for women to interact, learn, and grow skills together.

I think that is what has led us to this point, because we’ve managed to grow tremendously. It’s going to be five years in August, so we’ve managed to have close to 400 women in Kenya joining the information security industry. I think that’s very impressive, not just for SheHacks, but also for the women.

And for me to be nominated, I think we’ve been recognized for the work we’ve done in Kenya. Currently, we also have a sister chapter in Zimbabwe called SheHacks Zimbabwe. So I think we’re growing; we’re going global in a way.

Manoj Tandon:
That is fantastic. It lives up to the motto that’s behind you: “Don’t be average, be awesome.”

You are enabling women in Kenya, Zimbabwe, and as you grow to other African nations, to really participate in this information security world. So why information security? What drove you into that subject?

Laura Tich:
Initially, I think when I was younger, I would watch movies, and any movie that had technology in it, especially hackers, really thrilled me.

So when I joined college, I decided to pursue a bachelor’s degree in applied computer science, and that was the beginning of my interest in cybersecurity. I didn’t know where to start when it came to information security, so we had a boot camp at school, and that’s when I got to learn the basics of Kali Linux. That just inspired me to go with it.

Initially it was the thrill of it, but eventually, as time went by, I started seeing the impact that my work does for society.

I’ve worked in the digital security space, which is providing skills and solutions for at-risk people all across Africa, mostly journalists and civil societies. I think the impact we make personally in information security, the impact I make in the community and our society today, is what motivates me to keep going.

The other thing is that we are embracing new technologies, and with these new technologies come new threats which require new solutions. So just the fact that I would sit down every day and try to come up with solutions for problems that are facing either people around me or technology users, that really inspires me and motivates me to keep doing what I’m doing.

Manoj Tandon:
That is fantastic. When we think of Kenya, a lot of people are not going to think about high technology. They’re not going to think about a group of people that is making a big difference in the digital space, unfortunately. But you’re changing that, and I’m glad you’re here to tell us a little bit about it.

What do you see, as a nation-state, Kenya doing to incubate high tech or to foster an environment where women can succeed and others in high tech can succeed?

Laura Tich:
Well, Manoj, you’ve just said it. When people think about Kenya, they don’t think of high-end technologies or cutting-edge technologies.

For sure, we don’t have autonomous cars or rockets that can ferry our billionaires into space. But I think we will come up with them soon.

I think in the early 2000s, there was the advent of M-Pesa technology, which is our mobile banking platform, and that opened the way for more technologies to be embraced in Kenya today.

I read a report that stated that technology in Kenya has been growing by 23 percent annually since the beginning of the millennium, and you can actually see that because Nairobi has been termed the Silicon Savannah. That is because a lot of startups are finding their way into Nairobi, and these startups try to come up with solutions to problems that we specifically in Kenya, and countries like ours, face.

One example I would give is a startup called BRCK that is providing solar-powered routers. That’s important because we don’t have electricity everywhere in the country. There are some areas in the rural parts of the country that have no access to power supply. So when you give them solar-powered routers, it gives them an opportunity to access the internet just like the rest of us.

So I think with time we are going to get to a point where we have many more technologies that are solving problems specific to Kenya, or problems that a lot of Kenyans face, especially in marginalized communities.

Manoj Tandon:
That’s fantastic. I had not heard of solar-powered routers, but it makes complete sense. I would imagine that in those disadvantaged communities, it could potentially be life-changing because it exposes them to the whole world, essentially.

In terms of exposure, when your organization, SheHacks KE, has been developing resources, are you offering boot camps, programs, or formalized training by which women can enter the information security world?

Laura Tich:
Yes, we are. That’s the main aspect of SheHacks Kenya. We provide training, and we provide resources to women or members of the community, but especially women, because they’ve been marginalized for the longest time.

Initially, before COVID, we used to try and hold monthly physical boot camps. But since the pandemic began and people started working remotely, then we moved to virtual platforms, which makes it easier because of the logistics. We don’t have to look for a space or food for people.

So now we hold our boot camps twice a week: one for college students and another one for the general public. So yes, we have provided training and resources to women and other community members for free. We don’t charge for any of our trainings or any of our resources.

Manoj Tandon:
Fantastic. Are you able to offer certifications as well as part of SheHacks?

Laura Tich:
Not our own, but what we do is partner with organizations such as Microsoft, and they give us discounts or even free certifications for some of our women. With that, we are able to provide certifications for the women.

There’s also where I am right now, called I-Hub Innovation Hub, which is the first cybersecurity innovation hub in the country—in East Africa, actually.

What they do is they have a program called the National Cybersecurity Training Program (NCSTP), and they invite people who want to learn cybersecurity. They do six months of thorough training, and at the end, they try and get people into the job market as well.

Manoj Tandon:
One question that came to mind was: in Kenya, on the cybersecurity threat side, what kind of threats are you seeing? What are you seeing businesses face there from a cybersecurity risk perspective?

Laura Tich:
The one thing that is common in Kenya, and I think across the globe, is Layer 8 errors. That’s where social engineering comes in.

I think also because 80 percent of the adult population use M-Pesa, which is the mobile money platform, we get a lot of phishing and smishing attacks. A lot of people try to get unsuspecting users to send them money. So that’s one of the most common cyber threats that we have today.

And also when it comes to social engineering, this is also a big threat in Africa because I am very sure that people have heard of the Sakawa boys, the Yahoo boys from West Africa, mostly in Nigeria and Ghana, or the Nigerian Prince scam. So that is very common. It’s common all across Africa.

The other thing that I think came about as a result of moving to virtual platforms or working remotely due to COVID is people moving towards cloud technology. There are a lot of threats when it comes to misconfiguration of these platforms, so you will find that a lot of data breaches happen and other threats like that.

When people are moving towards a virtual platform, organizations tend to overlook proper configurations, and they end up putting their sensitive data stored in their cloud platforms at risk.

Other threats also include banking, especially banks that still use legacy systems. That leaves them open to attacks, and that leaves personal accounts and their employees at risk.

So there are a lot of threats that come with old technologies and new technologies as well.

Manoj Tandon:
Hearing you describe it, it seems like vulnerability management is just as much an issue in Kenya as it is here in the United States. A lot of what you’ve said applies here as well, so it’s a common problem.

Do you think there is growing awareness on the part of businesses and executives in Kenya to address these problems head-on?

Laura Tich:
I think there is. But there’s still the challenge of lack of resources and lack of budget to cater for cybersecurity needs, especially for small and medium enterprises.

There is still a ways to go, especially for these big organizations that have only started to embrace the need for cybersecurity experts within their organizations.

One company that has been able to achieve a little bit of cybersecurity within the workplace is Safaricom, and they started a bug bounty program that supports local talent in terms of supporting ethical hackers in Kenya to find bugs in Safaricom systems, and then they get paid for it.

But there’s still a ways to go because a lot of organizations, as much as there’s awareness, there’s a lack of proper budgeting to cater for cybersecurity within the organizations.

Manoj Tandon:
Now, Laura, do you face a personal risk because you are promoting women and their movement and their career success in Kenya?

I only say that because we get a lot of news over here, and a lot of it is not positive, but that’s the case all over the world. At a personal level, do you face any security challenges because of SheHacks KE?

Laura Tich:
Not at all. I do not face any, not yet. As of today, I do not face any challenges because of the work I do with SheHacks.

But the one thing that I would say is true is that I face the same challenges or the same risks that other technology users face. I can still be a target of malware. I still have to take care of my passwords just as everybody else does. I can still be a victim of phishing scams.

Those are the personal threats that I face, but nothing specific or nothing that is inspired or motivated by my work at SheHacks.

Manoj Tandon:
That is so good to hear because I know a lot of our listeners—the news that we get here in the United States is often skewed and, I’m sure, very negative in many ways. It’s good to have somebody come on and dispel some of these myths.

Laura Tich:
I think the people who are at risk—the people I work with and the other people I have worked with in the past, such as journalists and civil society organizations, human rights organizations—they can be targets of attack.

But for me, I haven’t faced any threats because of my work as an ethical hacker or the work I do with SheHacks.

Manoj Tandon:
Fantastic. By the way, I’m curious in terms of statistics or numbers. Do you have anything that you can share with our audience on the number of women SheHacks KE has helped get into cybersecurity? How many people have gone through the programs that you folks are doing?

Laura Tich:
Yes. So currently we have close to 700 members, and these are mostly women, but we also have men in the team.

The reason for this is because cybersecurity is a very young field, and only a few institutions in the country offer cybersecurity in colleges and classes. So we are trying to get women into the space, but we’re also trying to get students.

Our goal is to build a younger generation of women in cybersecurity, but also a skilled generation of cybersecurity practitioners regardless of gender. But of course, we do have a bias for women, and currently we are close to 400 women engaged through the community.

Manoj Tandon:
That’s fantastic, and growing. And you’ve grown to other nations, so yeah, that’s absolutely fantastic.

Let’s talk a little bit about ransomware, changing topics. I’m sure you illuminated us a little bit about the vulnerabilities that are present and things that you face, but from a ransomware perspective, do you see any potential changes in the way Kenyan society is addressing that, or is it not as big a deal with Kenyan companies right now?

Laura Tich:
Well, the problem we have is organizations fear, or there’s this culture where you see a cyber attack as something that shouldn’t happen to you. There’s a taboo when it comes to talking about the threats that these organizations face.

I remember a few years ago when WannaCry was big and global, we had a number of organizations that were victims of the ransomware, but they were trying to keep it swept under the rug. They didn’t want people to know that they had been targets of such attacks.

You find that this is also true for current organizations whereby they might be victims of ransomware attacks, but they’ll try and keep it under wraps and keep that information from the public because they see it as though, if they reveal this information, then they’re going to lose customers and business.

This is why we are trying to start conversations with organizations about the need for cybersecurity and the need to disclose when something like that happens. Talk to people like us, people in the industry, and we’re going to try and look for solutions for you.

But yes, as you mentioned, there is going to be a lot of ransomware attacks, specifically on organizations, mostly targeting small and medium enterprises as well in the country. So we are on the lookout for that, and we are trying to start conversations around that as well.

Manoj Tandon:
Yeah, and you were saying they’re the most vulnerable organizations, the small and medium enterprises in Kenya. They’re probably going to need the most help because, unlike big banks, they actually don’t have the resources to address this issue.

Laura Tich:
Exactly, yes.

Manoj Tandon:
From a disclosure perspective, you mentioned there’s a hesitancy. Is there something at the national level—are there laws being implemented that require mandatory disclosures of certain data losses?

Laura Tich:
Not that I know of. We have tried to have conversations with different stakeholders in terms of coming up with policies that protect data and protect businesses, but this is still a work in progress.

We’re trying to get as many people as possible to start conversations around that so that we can reach the relevant people at the Ministry of ICT and other key players in the policy-making world. We’re trying to get them to come up with solutions that can help those businesses, especially because there’s a rising number of SMEs in the country.

Manoj Tandon:
Laura, what do you think needs to be done from your perspective to provide better defense-in-depth to organizations? What are some summary things you can mention?

Laura Tich:
Yes, so I think the very first thing would be awareness, both on a nationwide platform and also within organizations.

As I said, security most of the time is an afterthought for organizations, and so you end up having technologies, but then something happens—you have a data breach or an attack—and you do not know how to handle it.

So I think there has to be awareness in terms of training and proper written policies for organizations to use whenever they are a target of an attack. They will have a policy written down on what to do in case such a thing happens.

Also, there has to be awareness in terms of training where employees must attend mandatory digital security classes. This will eliminate problems such as attacks that come with human error, the information you share, password management, and all these other small, basic cybersecurity things that can make a lot of difference if you follow them.

Manoj Tandon:
Yeah, I think there’s a lot of similarities to the U.S. in that regard. I’m really glad you mentioned employee training. A lot of times, we’ve talked about this on the show, employees are given policy mandates, but they’re not educated. Educating them can have a major impact on them following policies.

Laura Tich:
Yes. Besides policies, I think the one thing that people should look at is having a budget for cybersecurity.

A lot of the problems organizations face come about as a result of, for example, using unlicensed software. This software, as you know, most of the time doesn’t come with patches, and so you end up getting bugs and letting this unlicensed software create vulnerabilities within your organizations where attackers can use the software to breach your data and facilitate other types of attacks.

As I mentioned, besides awareness, there also has to be a budget for cybersecurity. We’re not asking people—especially for small organizations that are struggling financially or trying to get on their feet—we’re not asking them to hire a pen tester, which can be expensive, but just to analyze their infrastructure.

They can do that for themselves: counting the number of IP addresses they have, looking at their network, and looking at their communication as well. How do they communicate? What secure platforms do they use to communicate? All these small things can mitigate losses or decide whether you are secure or not.

So we are trying to get organizations to look at security as something that is mandatory or important and not put that as an afterthought. We’re trying to get more conversation around this.

Manoj Tandon:
Fantastic. Laura, we are at the hour here. I wanted to take the last couple of minutes and give you an opportunity to talk about anything: any events that you’re doing, any links you want to share, or anything that you want us to put in the show notes. Whatever you’d like to promote, it’s your platform. Please go ahead.

Laura Tich:
Thanks, Manoj. I think the one thing I would want people to know is we still need more support in terms of training in SheHacks Kenya.

As I mentioned, we have our boot camps on a weekly basis, even twice a week. So if anyone wants to speak about anything, please do reach out to us on our Twitter: @shehacks_ke, which is SheHacks Kenya, and on LinkedIn as well: SheHacks KE.

Just come and join us. Join our training and facilitate training if you can.

Manoj Tandon:
Fantastic, and we’ll put all those links in the show notes, Laura. We’ll make sure that on our Twitter feed, we put those links as well so it reaches a much broader audience.

So Laura, again, thank you so much for taking time in your day to do this. I appreciate all the knowledge you shared and for being patient with us during this cross-continent collaboration, if you will.

Laura Tich:
Thank you so much, Manoj. It’s been fun.