Africa: A Potential Cybersecurity Asset in the Global Information Security Stage
From a global perspective, the continent of Africa has often been seen as either a valuable asset or a liability in the field of information security. Unfortunately, many individuals unfairly portray African nations solely as hubs for malicious hackers and scammers. Nigeria, in particular, bears the brunt of these accusations, with frequent mentions of Nigerian prince scams. While it is true that threat actors such as the Yahoo boys do operate in Nigeria, it is important to note that the so-called 419 scams, named after the numerical section of Nigeria’s criminal code, are not always of African origin. Nevertheless, these stereotypes continue to persist within the cybersecurity lexicon.
By perpetuating these negative stereotypes, the global information security community inadvertently contributes to the lack of engagement with African talent on the world stage, thereby making everyone less secure. It is crucial that this narrative changes, and that African nations are supported in defending against the growing misinformation, disinformation, and malinformation campaigns that have taken root on the continent, particularly those originating from China and Russia.
Foreign threat actors have found ways to infiltrate African nations, either through offering gifts or disseminating disinformation campaigns, with the aim of creating a malicious hacker army. This can be seen in the example of an infosec professional in Zimbabwe, who revealed that the local consulate of a known state sponsor of cybercrime offers free lunch and computer lessons to locals. In order to address this issue, it is essential for the infosec community to recognize the talent in Africa that wants to learn and help them become defenders rather than future threat actors.
Fortunately, there are numerous non-government organizations (NGOs) and non-profit organizations that are doing remarkable work in Africa. These organizations are not only educating students and professionals in cybersecurity, but also spreading security awareness within their communities. Some notable initiatives include:
1. Africa Cybersecurity Consortium (ACC): Based in Rwanda, the ACC is one of many groups training information security professionals through internship placement programs and training.
2. Africahackon: This security collective, operating in Kenya and other countries, is dedicated to building the next generation of African cybersecurity talent. They host capture the flag competitions and provide hands-on training for digital forensics, among other activities.
3. Cyber Security Experts Association of Nigeria (CSEAN): Led by a council of cybersecurity leaders, CSEAN holds an annual conference, seminars, training, and workshops to raise the bar for skilled infosec professionals in Nigeria.
4. Cybersafe Foundation: Based in Nigeria, the Cybersafe Foundation serves multiple countries in Africa and offers various skills training and awareness programs. Their CyberGirls program, in particular, provides job training and fellowships for women in cloud security, governance, risk, and compliance (GRC), and other roles.
5. Security BSides: Originally a grassroots security community based in the United States, Security BSides is expanding its reach in Africa, with groups in countries such as Algeria, South Africa, Uganda, Nigeria, Kenya, and Togo.
6. SheHacks Kenya: Established in 2016, SheHacks KE provides a platform for Kenyan women working in infosec to connect and offers learning opportunities for girls and students.
7. SheSecures: This West Africa-based organization focuses on building a community, fostering career development, and promoting cyber literacy.
8. Wentors: Although based in Lagos, Wentors serves the global community by pairing women in IT and information security with mentors who are professionals in their field.
It is crucial to recognize the potential of these organizations and support their efforts to train and empower African cybersecurity professionals. As geographer Dr. George H.T. Kimble once said, “The darkest thing about Africa has always been our ignorance of it.” The global information security community is now at a pivotal point where it can choose to embrace and support its African counterparts or allow history to repeat itself, with the continent being consumed by digital colonialism and used as mere props by nation-state actors. The consequences of the latter option would impact us all. Therefore, it is essential to work together to shed light on the talent and potential that Africa offers in the field of cybersecurity.