Jimi Falaiye is Sophos’ Manager in West Africa. He has been in the IT and security industry for the past 15 years. Based on Sophos’ 4th annual “State of Ransomware Report,” ransomware remains a persistent cyber threat to organizations. 66 percent of the organizations surveyed globally reported they were a victim of ransomware. This volume of attacks is similar in Nigeria. In this interview, Jimi Falaiye speaks to BusinessDay’s Frank Eleanya on the best security approach to prevent ransomware and how Sophos helps organizations be a step ahead of cyber attackers. Excerpt:
What are the major issues organisations are facing regarding cybersecurity?
Today, cybersecurity is so complex and difficult and moving so fast that the vast majority of organizations shouldn’t even try to manage it themselves anymore. It’s just too hard. Our view is that they should turn to experts who can help provide cybersecurity-as-a-service for them.
With the advances in technologies like cloud computing, cloud management, AI, big data, APIs and interoperability—we now have the ability to deliver cybersecurity-as-a-service. We believe cybersecurity-as-a-service is going to be the predominant way that organizations consume cybersecurity within the next several years.
We found out that a lot of organisations don’t have the right tools or staffing needed to stop or curb cyberattacks. Many in-house security teams simply can’t keep up with the fast pace of changing attacks, and this issue is not just in Nigeria. And, it is not just in West Africa. It is a global issue whereby organizations need updated security tools along with an additional layer of detection and response services from experts who are trained to handle attacks at every step of the attack chain. Because attacks are a 24/7 operation, organizations need a team of trained analysts constantly monitoring and responding to their environment.
Now you are advocating that organisations should outsource their cybersecurity needs to compete with globally renowned firms like Sophos. Is the dearth in skills mostly a Nigerian thing or is it a global issue? Sophos has also released reports that often showcase scary figures, what are the yardsticks you use in measuring cybersecurity incidents?
Yes, outsourcing gives organisations the opportunity to focus their staff on other sets of responsibilities and their core business We have a Managed Detection and Response (MDR) service that fuses machine learning with human analysis for an evolved, innovative approach to proactive security protection and combines Sophos’ top-rated endpoint protection and data-driven XDR with a world-class team of experts to counteract and prevent threats.
Sophos MDR is available to businesses of all sizes, including small and mid-sized organizations that have struggled in accessing traditional services designed for enterprises.
Sophos Intercept X with XDR combines anti-ransomware technology, deep learning artificial intelligence, exploit prevention, and active adversary mitigations to stop attacks.
As I mentioned earlier, 66 per cent of organizations we surveyed globally for our 2023 annual report were hit by ransomware. Our global survey also shows that when organizations paid a ransom to get their data decrypted, they ended up additionally doubling their recovery costs ($750,000 in recovery costs versus $375,000 for organizations that used backups to get data back). Moreover, paying the ransom usually meant longer recovery times, with 45 percent of those organizations that used backups recovering within a week, compared to 39 percent of those that paid the ransom.
Nigeria is an emerging country with a dynamic economy. New enterprises are created every day. These organizations need to be supported against more and more sophisticated attacks using AI for instance. They don’t have the necessary experts internally. A skilled managed service team would be able to handle the situation and deploy the adapted tools in case of attacks.
Read also: Naira firms by 0.39% as demand for dollars slows
In light of these reports, what do you foresee as the future of IT firms in Africa?
In our recent Active Adversary Report for Business Leaders, published in April, we analyzed data from more than 150 Sophos Incident Response (IR) cases. We found that the most common causes of attacks were unpatched vulnerabilities and compromised credentials. The threat environment has grown exponentially in volume and complexity. For most organizations, the days of going at it alone are well behind them. However, there are tools and services available to businesses that can alleviate some of the defensive burdens, allowing them to focus on their core business priorities.
Sophos has over time created awareness, statistics and warnings concerning cyber security, but emerging markets seem not to be catching up yet. Could it be that trust is lacking among these organisations? Can they trust Sophos?
In Nigeria, we operate within the policies and regulations that guide cybersecurity solution provisioning in accordance with international standards. So, in terms of transparency, there are standardized compliances by third parties that providers must abide by. We comply with the ISO – International Standard Organisation’s guidelines. We are also GDPR compliant, and in Nigeria, it’s called NDPR – which regulates the amount of user data we are allowed to interface with and to keep. You mentioned a critical factor: trust. Trust is built over time. These compliance and enforcement regulations have helped to build trust.
How much investment has Sophos made in this regard? And what is the level of partnership you have with the regulators to ensure sensitization for understanding developments in cyber security?
We have done critical partnerships with some of the government agencies and we are still in talks with some of them. We are working to form strategic alliances to standardize frameworks that will impact, not just businesses, but whole vertical markets. In some cases, we choose a blanket framework approach and in others, we’ll have a strategic framework. We are investing in these different kinds of partnerships because they help us to enhance industry compliance. For instance, we have a customer who is developing a cybersecurity framework for the financial sector to better secure customers and the institutions themselves. We expect to have similar frameworks for the manufacturing and education sectors, or for any sector that is IT driven.
Can you tell us some of your solutions for the Nigerian market?
We have several solutions: Sophos endpoint security stops ransomware, phishing and advanced malware attacks in their tracks. Sophos combines the industry’s leading malware detection and exploit protection with extended detection and response (XDR) to secure customers. Powerful AI using deep learning along with managed threat detection services will protect against both new and old threats. Sophos Endpoint has been named a Leader in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP) for the 13th consecutive year.
In addition, Sophos MDR provides advanced cybersecurity services from a team of Sophos experts 24/7. Sophos has 550,000 customers globally in different sectors: government, financial, education, manufacturing, services, and more.
How affordable are your solutions? Can SMBs afford them?
We provide advanced cybersecurity solutions to organizations of all sizes, including cybersecurity-as-a-service to organizations needing fully-managed, turnkey security solutions. Customers can also manage their cybersecurity directly with Sophos’ security operations platform or use a hybrid approach by supplementing their in-house teams with Sophos’ services, including threat hunting and remediation.
