Issam El Haddioui: Head of Security Engineering, EMEA – Africa | Security Evangelist with the Office of the CTO.

Issam El Haddioui has held multiple technical leadership and management roles with major cyber security vendors in different countries. He has 20+ years’ experience in worldwide consulting, designing, and implementing security architectures across verticals. He holds two masters degrees and various technical certifications.

In this engaging and informative interview, Issam El Haddioui presents perspectives, provides trend information, offers thoughtful analyses, shares best practices, and empowers organizations to continue on the quest to achieve the best cyber security posture possible. Discover how to align security for emerging markets with the realities of the cyber world.

The Check Point Mid-Year trends report discusses top attack types. As a cyber security professional based in Morocco, could you speak to trends across the African continent?

It may seem surprising, but the number of cyber threats targeting organizations in Africa is higher than the rest of the globe. According to our Check Point Research, we have seen an average of 1,848 attacks per week targeting an organization in Africa compared to 1,164 globally.

In terms of trends, in the first half of the year, we have observed that cyber attacks have intensified. Ransomware attacks continue to be at the top of the list. For example:

  • TransUnion South Africa has been victim of a breach in which the hacker group named N4aughtysecTU stole 4TB of data. Attackers who claim to be based in Brazil are demanding a $15 million ransom for sensitive data, which includes credit scores, banking details and ID numbers.
  • The RansomHouse extortion group has claimed responsibility for an attack against Shoprite Holdings, Africa's largest supermarket chain. The company disclosed that customers' personal information might have been compromised. On their extortion site, RansomHouse posted samples of what they claim to be 600GB worth of stolen data from the retailer.

Also, very serious zero day vulnerabilities such Log4j or, recently Spring4Shell, together with the emergence of multi-purpose malware families, have introduced major risks to organizations across the continent.

For international firms with offices throughout Africa, what should security leaders pay special attention to?

With email as the most prevalent attack vector, CISO/CIOs of global organizations with operations in Africa would need to pay special attention to users' education and security awareness programs. This will help reduce the number of phishing attacks that may target their organizations.

In addition, as their perimeters have expanded, they need to implement Zero Trust strategies and programs across their organization, preventing threats at all levels; whether their assets are inside their data centers, on their users' devices or accessible in the cloud.

Finally, in order to provide contextual and timely responses for any potential incident, it is highly recommended to have or partner with skilled cyber security teams.

For the attack types that you have just described, what has the real-world impact looked like?

The frontier between the cyber world and our everyday lives has become vanishingly small and the impact of a cyber threat can have multiple faces. Impact ranges from financial implications caused by ransomware attacks, to the disruption of organizational profit flow, to the inability to bring goods and services to citizens.

Are there specific industries/sectors in Africa that are particularly vulnerable to cyber threats?

While Education and Research is the most targeted sector globally, in Africa we have seen most attacks targeting the ISP/Communication sector, with 5,617 attacks per week. Also, government institutions have seen 2,861 attacks per week in the last 6 months.

In most of these cases, threat actors were targeting communication infrastructures to sabotage, gather and steal personally identifiable information about citizens for fraud purposes.

What should these sectors prioritize in addressing cyber security vulnerabilities and gaps?

First and foremost, they need to take cyber threats very seriously, keeping in mind the potential impact that they can have on organizations and users. According to a recent Interpol report, 90% of business in Africa are operating without security protocols.

The priorities will be to gain visibility of their environment and assets, and to assess the risks around them. Once this done, using a cyber security framework and methodology such as NIST or CIS, security professionals will need to assess and address the immediate potential security gaps.

How are African countries strengthening commitments to cyber security? What are you seeing in terms of collaboration and security development?

In recent years, across the continent, we have seen the emergence of multiple cyber security laws and regulations bodies in countries committed to standardization and raising the awareness of its institutions and citizens. Examples include: Cybercrime and Cybersecurity Act 2021 in South Africa, National Information Technology Development Agency (NITDA) in Nigeria, Ghana’s Cybersecurity Act 2020 or La Direction Générale de la Sécurité des Systèmes d’Information Loi 05.20 in Morocco.

Industry groups have also taken measures and initiatives to strength and standardize, such as the central banks of many countries across the continent.

However, a cross-Africa collaboration and a potential continental cyber security body could be beneficial to all member states and organizations both in terms of common laws and regulations, but also in terms of offering a unified response to emerging threats.

Are there ‘model countries’ that both African and non-African nations can look to as examples of strong regional cyber security leaders?

It is very hard to compare between countries across the continent and their different cyber security initiatives. I believe every nation is aware of the risks it encounters and the need to put in place the necessary measures to prevent any incident.

Mauritius stands out and scores as a top performer and an example to learn from as a regional cyber security leader. We see this through its continued investment in skills, awareness programs and technology with a prevention-first approach.

What are you seeing in terms of expanded educational opportunities for InfoSec, if any?

With the shortage of cyber security professional across the continent, public and private sector organizations are partnering with universities in cyber security education programs to create a whole educational ecosystem. We, at Check Point, contribute to this effort with our Secure Academy.

How will attention to cyber security ultimately make African nations (and Africa as a whole) stronger and more prosperous?

In Africa, in last decade, we lived through an accelerated technology adoption and businesses-level digital transformations across different economic sectors. Taking cyber security and cyber risks seriously will allow:

  • Organizations to protect their investments, safeguard their data assets and their reputations; giving them a competitive edge globally.
  • Nations to protect their citizens' digital lives and their critical infrastructures.

All of this will permit us to benefit from the technological advancement in a safe manner, leading to more advances in the future.

Is there anything else that you would like to share with the CyberTalk.org audience?

In conclusion, the cyber threat landscape is an evolving environment and therefore cyber security posture enhancement needs to be a continuous journey, with measures that need to be evaluated and adapted to new realities.

I encourage our audience to read the mid-year report and uncover how this threat landscape has evolved on the back of the war in Ukraine. Or to see how threat actors have changed their game; moving from targeting a specific organization to attacking an entire country, as was the case in Costa Rica or Peru. Get the mid-year report here.

To receive more timely cyber security news, top-tier reports and cutting-edge analyses, please sign up for the cybertalk.org newsletter. Lastly, you can join peers for a rich discussion of this article here.

You may also like