Challenges and Successes in the Zambian ICT Security Sector ITU Workshop on “ICT Security Standardization for Developing Countries” (Geneva, Switzerland, 15-16 September 2014) Challenges and Successes in the Zambian ICT Security Sector Mainza Siamubayi Handongwe, Student Research Fellow, Information and Communications University Email: msh12600@gmail.com Geneva, Switzerland, 15-16 September 2014 1 1

Zambia has made so much progress in the ICT sector Introduction Zambia has made so much progress in the ICT sector Over the past past decade, we have seen the following major developments; Three mobile telecommunication companies Online services (e-commerce, e- learning, etc) Web hosting Internet Service Provision Geneva, Switzerland, 15-16 September 2014 2 2 2

Introduction cont' This has lead to exposure to several information security risks including; Website defacement Debit card stealing and cloning Financial losses due to debit card cloning Phishing Internet bundle and mobile credit stealing Denial of Service Wireless network hacking Geneva, Switzerland, 15-16 September 2014 3 3 3

Introduction cont' This in most cases has adversely affected socio-economic activities especially where cyber security preparedness is lacking Geneva, Switzerland, 15-16 September 2014 4 4 4

Challenges Zambia, like many developing countries, is faced with several challenges in the ICT sector These include; Inadequate policies to curb cyber crime Inadequate qualified personnel to fight cyber crime Inadequate ICT infrastructure to prevent and investigate cyber crime Lack of sensitization on cyber crime Geneva, Switzerland, 15-16 September 2014 5 5 5

Inadequate policies to curb cyber crime Zambia has had no piece of legislation towards fight cyber crime for many years Computer Crime and Misuse Act number 13 of 2004 enacted following defacement of State House website Though it criminalizes some cyber crimes, the act still does not prohibit other major cyber crimes Act imposes lighter sentences for crimes that would require hefty ones Geneva, Switzerland, 15-16 September 2014 6 6 6

Inadequate policies to curb cyber crime cont' Act imposes lighter sentences for crimes would require hefty ones The National ICT Policy of 2007 indicates government's commitment to promote safety in the electronic frontier However, the policy does not give mandate to relevant government departments and private sector to combat cyber crime Geneva, Switzerland, 15-16 September 2014 7 7 7

Inadequate qualified personnel to fight cyber crime Most personnel that are employed to manage and monitor networks and IT systems lack cyber security skills No defined ICT Staff structure at departmental and lower levels, especially in rural areas This could be attributed to limited number of training institutions within Zambia that offer cyber security training Geneva, Switzerland, 15-16 September 2014 8 8 8

Inadequate qualified personnel to fight cyber crime cont' The cost of training and certification is also limiting This makes networks/systems that are managed by such personnel vulnerable to attacks Investigation of such incidences becomes difficult due to lack of computer forensic skills Geneva, Switzerland, 15-16 September 2014 9 9 9

ICT Staff Per Institution Cyber Security Skilled CBU 7 1 UNZA NRDC 2 ZCA-Monze ZCA-Mpika ICU 5 3 Nkhrumah College Rusangu Univeristy 4 Cooperative College Evelyn Hone College Geneva, Switzerland, 15-16 September 2014 10 10 10

ICT Staff Per Institution ICT staff per institution and those with cyber security skills Geneva, Switzerland, 15-16 September 2014 11 11 11

Inadequate ICT infrastructure to prevent and investigate cyber crime Prevention and investigation of cyber crime requires specialized hardware and software These include firewalls, intrusion detection systems, forensic software etc These usually call for huge investments Geneva, Switzerland, 15-16 September 2014 12 12 12

Inadequate ICT infrastructure to prevent and investigate cyber crime cont' This tends to be the limiting factor for most government and private institutions Geneva, Switzerland, 15-16 September 2014 13 13 13

Lack of sensitization on cyber crime The fight against cyber crime would be fruitless without involvement of ICT end users Information sharing with citizens on cyber crime and counter measures was not done in the past, hence the ‘information gap' Geneva, Switzerland, 15-16 September 2014 14 14 14

Successes-Govt and Private Sector Establishment of the Zambia Information Communication Authority (ZICTA) to regulate ICT in Zambia Government has set up the first ever Computer Forensic Laboratory based at the Zambia Police Headquarters Several police officers have been trained in Information Security and Computer Forensics The Zambian government has partnered with several local and international organizations (including ITU) in the fight against cyber crime Geneva, Switzerland, 15-16 September 2014 15 15 15

Conclusions and Recommendations Formulate policies that will mandate relevant departments to prevent and investigate cyber crime, and prosecute perpetrators of such crimes Invest more in systems that prevent and help investigate cyber crime Ensure that private institutions invest in systems that guarantee security to users or clients Train and/or recruit more personnel in cyber security Establish Computer Incidence Response Teams at all levels in government structures Sensitize citizens on cyber crime and counter measures Geneva, Switzerland, 15-16 September 2014 16 16 16