Welcome to the Corporate Machine.

Winning the Chevening scholarship to study an MSc in Cyber security at the University of Glasgow, Scotland was a dream come true and I quickly indulged in the day to day work of shuffling from classes for lectures, Library for research, labs for practical assignments and student socials by the faculty and the Chevening scholarships where I would meet students from across the globe. Among the units learnt included; Cyber Forensics, Safety critical systems which expounded on the security of critical infrastructure systems like Power lines, Air traffic controls, cryptography for data security and safe coding practices for software development among others. While in Glasgow, I participated in several student hacking competitions like the Annual Scottish Universities hackathons, volunteered at a local academy to mentor kids in Sciences and played in the University soccer teams where I met team mates who captained their national soccer teams such as Slovenia and Georgia. All this while I was trying to figure out how I would fit my skills into the industry to create value.

I noticed the buzz around AI, Data protection and cloud and did some research on it where I realised it had the potential for so many cutting edge application. I however had not much background or foundational technical knowledge in any of them fields so to force myself to learn them, I decided to take up a research project that put together all three for my dissertation. I decided to do my thesis on the Application of AI in the detection, prevention and remediation of Data loss in the Cloud through forensic methods.

In under three months I was able to learn the technologies and develop an AI model that detects select personal information on cloud traffic and perform defined forensic control measures to prevent loss. The project was excellently executed that It earned me a distinction grade and an induction into the University of Glasgow school of computing sciences hall of fame that honours excellent student projects way back to its foundation in 1890s.

After graduation and despite advise from my Nigerian classmate, I was determined to share my new found skill in the development of my country through advisory work and hoped that finally I would “ make it” and enjoy some level of comfort having been in a chase and catch race with ‘lack’ where I have had to continually balance comfort and need.

Two days after landing back to Kenya, the whole world shut down all travel due to the COVID pandemic and for the next 6 months we all were locked up at home. I took advantage of this period to do lots of free Cyber security certifications in Data protection, Digital forensics, Cyber security audits. I also took up a fellowship at my Alma mater, the Strathmore University Law school to research on ” The use of Social media by state actors to control public sentiments through information operations akin to what Cambridge Alalytica did with the Brexit vote and US elections 2016“.

I also presented virtually to several conferences, workshops and wrote several opinion articles on Data protection and Cyber security. From one of these articles I was referred to an open role at one of the big 4 audit firms where I interviewed and got a role as a Cyber security and Data protection Consultant and led a team of about 11 analysts and other consultants. Before taking up the role I had a sit down with the gentleman who was leaving the role and he advised me not to make known my Masters qualification as this would expose me to unnecessary envy and mistreatment as most of the managers did not have similar qualifications at the firm.

I did not heed the advice as I felt that was all I had to offer and I quickly learnt what he meant. I would be put in the most challenging assignments with the most difficult customers but somehow I would always turn it around my strength is talking to people to find middle grounds and focus on smaller tasks to achieve the bigger tasks. In most tasks I did the customers would call back very happy and even give us new jobs most of which were never accepted by the manager claiming we did not have extra capacity. I was also put in tasks that exposed my blind spots especially on offensive security which had never really practised. I continued to score very highly in the quarterly reviews earning over 85% in each of the first 3 quarters. As we approached the end of the year I got offers from several firms including those abroad and I shared these with one of my managers to seek his counsel. I did not get any of the roles and was informed it was due to unfavourable references from my manager.

Little did I know what was to follow. For the last quarter I was graded the worst possible despite successfully executing all projects assigned with excellent client and team members’ reviews. Consequently I was forced into the Performance improvement program (PIP) for the next quarter. I was not included in the departmental bonus rewards for the previous year where every member including new interns were awarded bonuses some over 150 % of their pay.

I continued turning up to work as if nothing happened in my very well made suits only thing I noticed was that my team mates started avoiding me when around management. I was later informed that once put into the PIP it amounted to a hit list and therefore anybody seen associated with you would also be hit in other ways. There would be meetings of the team members whereas the senior most in the team I would not be invited and the members would be asked how they were enjoying their bonuses and would also be told that only me did not receive the bonus.

I focused on getting the tasks assigned in the PIP done even though they were some of the most humiliating. For over 4 weeks I would be tasked to do a report which would be checked and I be told to change the font which would be checked the following week and another correction like adding a comma would be proposed to be checked the next week. Meanwhile the rest of the team were away on annual holiday after the busy season and would share with me their pictures from Norway, Cape town or Dubai. I was made to report to an analyst I had trained only a few months ago and she made sure I felt her superiority. I would sit down by myself late in the night and wonder what sin me or my parents must have committed that God would not forgive to warrant such a humiliation at a job I considered my dream job when I joined.

At this time we were allowed to work from home a few days in a week many of which I had no active assignment even though the rest of team were really busy and I took advantage of these times to look for jobs online and reach out to my networks as I already felt like I wanted a change. A policy was then passed that those not in active assignment had to be present in the office always and most times I found myself the only one from my team at office. I continued turning up daily always the first to arrive and last to leave. Most team mates including new joins were assigned to regional customers and they would travel and leave me in the office and I would help do their reports when they returned.

At last in one of the projects an intern did not have the requisite travel documents yet the client had paid for two engineers so I was Co-opted to travel for the project at a major capital in the region. The project involved the cyber risk assessment of an industrial manufacturing system and after a two week assignment two days of which I was seriously ill, our performance on the project was graded excellent and me and my colleague were nominated for an award continentally. I was hopeful that this among my other assignments would prove my ability and be off the PIP so I can resume my normal assignments.

On return I was informed by a team mate that they had attended a work drink out and been informed by my boss when he was drunk that they had decided to dismiss me anyway and the PIP was only to regularize the process. The boss I was informed told my team all of whom had been my subordinates that nothing I would do would get me out of the PIP even if I brought a year’s worth of projects. Around this time I got the review from our latest project and It was brutal. The very performance that got me nominated for a continental award was too bad for my boss that he recommended my dismissal. All this time I was just yearning for a chance to go back to doing technical Cyber assessments and handling customers but here I was bogged down with unending, non-objective corporate politics.

I wondered what I had gotten wrong despite diligently doing all the assignments I led with excellent reviews from both clients and team members. I continually fasted and prayed asking God for wisdom on how to handle the situation I found myself in. I reached out to a few senior executives in other verticals for counsel and they advised that I keep doing any work diligently and document everything happening so I could raise Complaints to HR who answered to the same manager I would be complaining to so I knew It was a dead end.

I could see my career in Cyber security ending in the most humiliating way and despite all the effort i had put to get here I felt helpless. A month before the end of the 3 month PIP and on which my boss had informed my team would be my last at the firm, I received an offer from an International firm to lead their Information security practice globally and I resigned on a Saturday via my gmail account because I realized my work email was already disabled.

To be continued…

Introduction

With the advent of digitization where most services both government and commercial go online, work from home schedules due to the Covid pandemic and the ever increasing use of social media, The threat landscape for cyber threat actors has only grown wider. This has led to ever increasing and complicated cyber-attacks that target financial systems, Key National cyber physical infrastructure, government services, individual social media accounts etc. These attacks range from trans-national Cyber-attacks by nation states and other organized crime groups, to cyber bullying on social media to individual accounts’ takeover. A recent reported DDOS attacks on critical Kenyan digital infrastructure like the E-citizen system that processes key government processes like identity issuance, Mpesa peripheral services like Paybill, bank to mobile money transfers has brought to the fore the increasingly insecure digital sphere.

Effects

These cyber-attacks interfere with the normal operations of Digital systems compromising their Confidentiality, integrity and availability (CIA) triad. These are through; Loss of access to digital services (DDOS):- This involves sending extremely large amount of traffic to a particular service or system causing overloading of its memory and processing resources therefore making it non-responsive. Identity theft & Scamming:- For successful attacks on the identity management infrastructure of systems, attackers are able to take over the identity of a victim and use this to cause further damage like scamming, financial compromises Phishing to further piggy back into other systems. Private Data loss: — Increasing many cyber-attacks target sensitive personal information or Intellectual property and either encrypt them and demand for a ransom or expose them for sale in the dark web for financial gain. This may cause severe damage to victims if such data include financial records or medical records. Loss of confidence in digital services:- The cyber-attacks on critical national infrastructure like utility service companies, Digital services Applications like E-citizen may erode the public trust in government services. Cyberbullying:-The advent of digital social media has availed easily accessible but very destructive tools to threat actors like bots who have used them to carry out cyberbullying, doxing and manipulations to carry out their nefarious targets.

Interventions

To protect from these risks, governments including that of Kenya has taken various strategic policy and tactical steps to manage the cyber space that include; Kenya computer misuse & Cyber Crimes Act 2016, Data privacy Act 2019, Cyber security strategy 2022 and the National ICT policy. Tactically, the Government of Kenya has established the National Cyber security response centre, Cyber Crimes unit within the Police service and the Forensics lab at the national police service among other infrastructural interventions. Regionally; The Protection of personal information Act (POPIA) in South Africa, Data protection Act Uganda and Nigeria provide a framework for managing the Cyber risks and privacy rights within the respective jurisdictions. Africa wide, the AU convention on Cyber security and Data privacy protection 2000 provides an over-arching framework for managing Cyber security within the African continent. Internationally; UK Cyber security strategy 2022- 20230 sets very high standards of cyber hygiene within the UK cyber space, EU GDPR Act represents an internationally acclaimed data protection standard. The US executive orders 13636 & 13757, 13800 were issued by the president of the United States on the security critical national infrastructure,

Controls

To protect from these risks, the following controls are advised; Secure networks and application security controls; ensure secure networks’ architecture whether on-prem or on cloud and perform security assessment frequently to ensure confidentiality, integrity and availability. Proper usage of social media; only share necessary information and do not share personally identifiable information to protect from threat actors weaponizing personal information for fraud or impersonation. Secure password management; If possible implement MFA and password managers that will ensure you don’t recycle passwords for key systems that make them easily compromised. Training staff and carrying out table top exercises frequently to create awareness and test preparedness to respond to cyber incidents. Secure devices management; for all mobile devices issued by enterprises, its advisable o implement Mobile device management solutions and mobile Applications management solutions to remotely secure devices ensuring full encryption and remote wiping in case of loss. Secure digital supply chain; for all services and applications provided on behalf of an enterprise by third party vendors, ensure that minimum security standards of compliance are met with demonstrable documentation to ensure that no component can be used to piggy-back onto the enterprise systems. Backup key data and applications; Always backup all sensitive and critical information and systems to ensure the business continuity in case of fault occurrences or compromises.

Education

I studied a Bachelor of Business Information & Technology at Strathmore University specializing in computer networks in Nairobi during which I was also the President of the Strathmore University IT club (SUITSA). Through this I had access to Industry leaders who always came to the University for various IT themed events and I identified Industry leaders who became my mentors to date. I participated in & won various IT student competitions like the Google developer challenge, The Microsoft Imagine Cup competition, The GSCV business plan competition which yielded my first ever overseas trip to the Indian school of business to present our technology business idea in Hyderabad, India and a fellowship to the MIT-AITI fellowship 2010.

Through these competitions I met many students in other Universities and formed friendships that have transcended our student days. In the many instances when my team did not win we were exposed to new methods of solving IT challenges through technology and we later would go and research on them outside class hours. I also led the team that organized 4 major ICT conferences with the faculty that included government, academia, research, private sector and students for which I was awarded every year as the most valuable student leader of the IT students. This also brought free food, branded t-shirts and a bit of local celebrity status in school which helped in other ways J.

Because of my close tie to the Industry, I was able to get a job at a leading technology integrator immediately I finished school before graduation as a graduate management trainee and worked in the Network security department as a pre-sales engineer where I would go to customers to scope their network technology requirements and later assist the senior engineers in designing and later deployment of the same. Also as partners to major technology firms we underwent lots of training on various technologies like Firewalls, Load balancers, web application firewalls, Data Centre technologies, Wireless access technologies, mobile security among others. As management trainees we were also required to go round the whole organization to better understand the operations from sales to procurement, HR, Accounting & finance, Innovation management and operations which included spending weeks in the warehouses helping in receiving and dispatching supplies.

We were also required to generate new project ideas on how to make the Company better and present to the Board and again I was declared the management trainee of the year. At this time I came across an idea that after several iterations with my friends that I met at the same Company we decided It was too good an idea and we resigned to form a technology company specializing in Location based advertising in public service vehicles in Nairobi and I was tasked as the Business lead. This gave me the chance to be involved in every part of the Company from Business plan development, product development & hiring of staff, to financial negotiations with funding partners, to forming partnerships with the major partners like IBM research Africa and advertising firms that would be our upstream partners and the public service vehicles’ SACCOS who would be our downstream partners.

The start-up did not go as planned and within a year it was apparent that we needed a change in strategy and we all needed jobs to get by as we figured that out. Because I had been a volunteer at my local church as a leader in the youth service I was recommended for an internship at a partner religious Organization as an Information systems auditor to help secure the rapidly expanding missions and help define a digital strategy.

At this time I was paid a gross salary of 20,000 Kshs (Approx 130 USD) per month which reduced to 17,000 Kshs after tax. For the interview I met a co-interviewee lady who mentioned that she held an MBA which made me almost sure I wasn’t getting the job. 5 minutes into her interview she came out crying and never went back. I was later informed that she broke down when asked why she needed an internship paying a meager 20k with an MBA. That’s how I got the job.

For the next 2 years I worked tirelessly trying to secure the mission, carrying out audits, meeting service providers to assess the systems they were providing, did presentations on the technology risks faced by the Mission and through my guidance were able to define the organization-wide Information security policy. Throughout this period I would often meet my friends from campus and would ask to understand the types of work that they did especially those in the big 4 firms of which we all dreamt of joining. After each of these meeting I often felt like an imposter in my field.

I did not have many current certifications in Information security, my experiences were limited to my current tasks and from my then salary I had limited ability to make the necessary career investments for progress. I began to apply for new jobs which I barely made the interviews and realized that whatever my dream jobs were asking in the JDs I could honestly not do. I stared at the bleak future ahead with no hope and was ready to settle in and just take whatever life decided to offer me.

I became serious with my faith as my refuge and kept meeting my group of friends often to level up at least by association and kept reaching out for opportunities that I felt I needed. I later was offered a two year masters scholarship at a local University but I felt I needed something else to be able to carry out the jobs I really wanted. Then Chevening scholarships came by to study an MSc IT Cyber security at the University of Glasgow.

TO BE CONTINUED IN PART TWO!

From these experiences the following would be lessons for a budding Cyber security engineer;

1) Studying a full time 4 year degree gives one time to figure out what you’re interested in and also offers several test beds of the various student led projects that help personalize technology and hence develop understanding of fundamental concepts like networking, programming beyond the units taught in class through student led projects.

2) Networking is the key to future success as these will be the sources of job, business opportunities. Network as school, at church, in the mall, at the stadium.

3) Get a mentor as this exposes you to the industry early enough and also opens other doors like references for work and guidance on what to focus on.

4) Lead projects early; Through organizing the different ICT events as the student lead of the ICT club and the start-up, I was exposed to sample real life ICT projects and the different moving parts that made me realize that any business requirement is first a people’s issue then a process issue before it’s a technical issue.

5) Challenge yourself through taking on challenging projects; Through participation in the various student technology competitions I was able to level up my skills by identifying what other students were good at which I wasn’t and joined their develop groups that helped me understand technology concepts not taught in class.

Just recently, Kenya launched its AI strategy which should guide its path to being a powerhouse in the technology sectors. This strategy aims to position Kenya “As the leading AI hub for model innovation, driving sustainable development, economic growth, and social inclusion while positioning itself as an AI research and application leader in Africa”.

This is a strategic step following on the footsteps of the EU launching their AI Act and the US presidential executive orders (EO) on AI the latest was EO 14110 all of which seek to maintain the US leadership in AI as a strategic economic and national security technology. In the accompanying budget of 152 Billion Kshs (Approx. 1.1 Billion USD) over half of is expected to go towards developing the accompanying infrastructure and the rest in training and capacity development to ensure that Kenya has enough expertise to meet its AI technology needs.

Having looked at the EU AI Act and the several US EOs in AI, the following areas should be priority to ensure we maintain our standing as the Silicon Savannah;

1) Training, Research & Scholarship: I propose that the Government of Kenya through the relevant ministries prioritize capacity development through empowering young people in Kenya by Incorporating technology training in basic & intermediary trainings(STEM), provision of AI & technology related scholarships for students to specialize in AI related training both locally and abroad to help expose them to what other countries have done and how to leverage the same to ensure the AI strategy is actualized. Finally, It’s important that the local universities are supported to develop local staff capacity through support of research in AI and publication of industry leading papers that area unique to the local Kenyan context.

2) Support for AI based Innovations:- Kenya has indeed been the Silicon Savannah because of the myriad technology based innovations that have revolutionized digital services among them mobile money, digital government among others. There have also been other innovations using AI to improve Supply chain efficiencies, distribute academic content to learners and improve financial access for communities. Similar innovations need support to ensure that as the country transitions to a AI based economy, we leverage the same to meet our specific and local use cases.

3) Infrastructure: Kenya needs to invest in AI specific data centres to handle the high volumes of data needed to develop high powered AI models to drive modern commerce. This also means the supporting infrastructure like Power needs to be reliable and not affect the national domestic & industrial capacity. The internet connectivity also needs upgrade to handle the high capacities and low latency needed for efficient AI models development.

4) Strategic partnerships: To effectively navigate the journey of digital transformation like adoption of AI, It’s important to cultivate valuable partnerships with other Countries who are leaders in the sector as well as multi-national technology Companies who in many cases are always ahead of governments in research of emerging technologies due to their agility ability for competitive advantage. Kenya needs to continue to cultivate these as a source of valuable know-how, standards and guide in its journey of digital transformation with AI as the focus areas.

I have quietly followed the discussions on the development of Artificial intelligence especially in generative AI that has found a wide use in common operations like art, academia and been surprised at the direction the discussions are taking. The discussions are mainly driven by professionals from fields like Law, academia, journalism, governance and technology policy experts to a some extent engineers. It’s worth noting that these fields are mainly adoptive of technologies and not creative and therefore objectively biased in their use of technology including AI. The discussions border on the apocalyptic as shown in the movies on one end and fiction on the other end. They always talk about an AI army someday taking over the world and holding humans hostage and therefore we should be careful of the AI development and train ethics into AI so that should they take over at least they make the world better J.

This sounds very scary assuming it’s even possible and therefore am always asked in many Technology panels and workshops whether AI is an actual risk to and can replace humanity. To begin with, AI like any other technology has no mind of its own but an efficient means of understanding how we live based on collected data. AI models are trained on tonnes of data collected digitally though different sensors embedded to object like engines or humans like pulse rate sensors. These sensors are defined to capture particular aspects of objects like location at a particular point as the case of GPS or speed as in the case of Speedometer. With such data it’s possible to train models to say detect bad road conditions based on vibrations from a gyroscope sensor embedded on a car against a reduction in speed of the same car as measured by the speedometer.

The human being as created has known 5 basic senses of site, smell, touch, hearing and taste most of which can be captured through sensors to train models like machine vision for sight, Natural language processing for sight & hearing. Holograms are a creation of these models that try to mimic a real human behaviour based on captured historical data like voice, video and body shapes. However, a human is increasingly believed to have more than 22 senses beyond the mentioned 5. How would you for example model affection, anger, jealousy or love?. How would you model human forgetfulness or a sudden “light bulb moment” for creativity? Both of these have defined humanity for thousands of generations and made humanity what it is today. What make a human is these unique abilities that cannot be measured that interact with those that can be measured to make human life possible. SO yes, AI will definitely replace /automate the measurable quantitative aspects of humanity but to fully replace a human being It will also have to replace the qualitative aspects of humanity.

For AI to replace a human the following conditions will have to be met;

1) All human senses including the emotions need to be fully understood and documented

2) Sensors to detect human emotions need to be developed to capture all the nuances of human ability like emotions and understanding.

3) All human senses need to be represented digitally and provide enough training data to train AI models aimed at replicating human capability.

4) Enough compute power need to be availed to process all incremental human knowledge from the beginning of humanity as we are a result of continual progression of human race

Because these are not possible with the current technologies. My safe answer is that AI is definitely making life more liveable for humanity by making efficient our decision making due to the numerous amounts of data we can process through super computing capabilities but this cannot replace the full range of human capability.

Data security Compliance in Cloud environments

With enterprises moving to the cloud due to the advantages offered like cost efficiency, flexibility, and ease of management, there arises the need to meet all data security compliance requirements in the cloud just like on-prem. With regulations like GDPR, HIPAA, PSC-DSS and standards like ISO27001 and NIST 800–53 that set minimum security and privacy standards for data still applicable in the cloud.

However unlike on prem setups whereby an enterprise has well defined physical and logical boundaries, in the cloud environment an enterprise has no physical access to network, storage and compute devices. Furthermore the cloud environment resources are shared with other external enterprises making the need for a well-defined, controlled and compliant environment very important. To ensure data security compliance in the cloud, the following considerations are recommended

Shared responsibility model

The Cloud shared responsibility model assigns compliance and data security roles to either the Cloud service provider or the customer depending on the model of consumption in use. For Infrastructure as a service (IaaS) and Platform as a service (PaaS), the service provider is in charge of the network and computer resource management while the customer is responsible for the configurations of their instance including the logical networks configuration, resource management and data security. These are however not the case in the Software as a service (SaaS) where the service provider is in charge of all Infrastructure & data security compliance requirements. Irrespective of the model chosen, the customer should clearly define their requirements in terms of privacy, confidentiality, integrity and availability which should be the basis of the SLA with the service provider.

a) Customer responsibilities

For Iaas & PaaS, the client needs to carefully select the relevant licensing features that allow them to architect their workloads with all the relevant requirements for data security and privacy requirements. Through cloud solutions like MS Purview users can classify data according to the different sensitivity levels and determine the sharing policies for their sensitive data. In AWS macie, users are able to discover sensitive data from their workload and assign relevant access policies on them to ensure that for instances no un-authorised user has access to health information. GCP has the Google DLP that helps customers identify, classify and protect sensitive data in the cloud.

The Cloud customers also need to configure security controls like logging and monitoring capability into their workloads following standard cloud security architectures like the CSA secure configuration framework. This can be implemented using tools like AWS trusted adviser to help identify potential security vulnerabilities in a cloud workload, Azure sentinel and defender for the cloud to detect potential attacks on the cloud depending on the CSP in use.

These can act as the source documents for incident response and compliance in terms of log retention. Cloud customers should also configure their cloud workloads to enable Compliance automation/ orchestration like automatic detection of sensitive data leakage from attached end points or file storage resources. Cloud service customers should also carry out frequent vulnerability assessment of their workloads to enable them detect misconfigurations, excessive privileges assigned and irregular access to resources.

b) Cloud Service provider responsibilities

All the three major CSPs provide different points of presence and availability zones that help with disaster recoveries and geographical data security and compliance requirements. For instance, If there is a limitation to the transfer of personal data from the EU region as required by the GDPR, there are several availability regions within the EU established by the CSPs to ensure that there is sufficient disaster recovery capability but also that the data remains within the EU. This therefore makes the customer compliance inbuilt into the design at engagement point. Further, All service providers should carry out an independent assessment both internal and external to their infrastructure to ensure compliance with the relevant cyber security, data security & privacy requirements and this report should be provided as system & organizational controls (SOC 2) to the cloud customers to provide an assurance that their sensitive data is securely processed in the cloud.

Defence in depth / Compliance by design

The concept of defence in depth is more relevant in the cloud environment due to the fact that the clients have no physical control of both their data and compute instances and therefore have to enforce all controls logically.

1. Proper resource provisioning

This begins with the correct provisioning of the instances with the right capacities provisioned and appropriately secured through logical access control lists on the firewall configuration. This includes the logical security controls like Firewalls e.g. Azure sentinel, Defender for the cloud, Implementation of VPN access from external users.

2. Identity & Access management

The identity & access management (IAM) is the next most important requirement of the defence in depth that ensures only permitted users have access to the cloud instance. Through access packages in the case of Azure, users can set very fine grained access to cloud resources to ensure that only those with the required permissions have access to resources. Other IAM controls include MFA, authenticator applications for added security of the access management as well as just in time access through privileged access control.

3. User training

Lastly, the users of any system continually are the weakest links in any Cyber security program and the users need constant task oriented training to ensure they continually understand the data security risks they are exposed to and how to protect themselves from threat actors.

Introduction

AI has brought tremendous changes on how we consume technology my making machines exhibit human-like tendencies like autonomous vehicles, UAVs, conversational AI and even machine assisted medical operations clinical surgeries. These have been made possible by the enormous amounts of data generated from our digital activities like social media interactions, IoT sensor data and other big data sources like Cloud computing systems. With an increased computing landscape from mobile devices, cloud computing applications supporting e-commerce & e-government, IoT devices an increased rate of cyber-attacks has inevitably followed with data privacy compromise being a major risk.

In AI, Data privacy is a central issue in training and testing AI models, in developing inferences based on historical training data. To infer a potential strain of a disease from historical medical data for example, an ML model needs training in a large set of similar to production data in order to accurately infer a disease strain from an unseen set of data. This means the model should ‘ideally’ be trained in live data that contains very sensitive personal & medical data that may contain personally identifiable information, a practice that is would be ‘suicidal’ and very irresponsible in data security governance. Furthermore even after training these sets assuming you are able to mask the sensitive personal information contained therein it’s been proven that it’s possible to reverse-engineer models to be able to retrieve a representive set of training data that essentially compromises the privacy of the subjects whose data was used in the training of the model.

Privacy risks of AI

Among the long standing risks of AI has been that the training data contains human biases as it tries to accurately represent human behaviour which often contains biases. An artificial intelligence model trained on this data will therefore replicate, reinforce or amplify these biases. This can have serious consequences, such as in employment where certain demographics would be at a disadvantage due to AI bias. AI/ML algorithms have been proven to be vulnerable to Cyber-attacks that are cable of compromising the privacy of the training data and potentially be further weaponized to carry out more sophisticated privacy compromising cyber-attacks commonly referred to as “adversarial machine learning”.

According to ISACA, some of the challenges faced in Data engineering for AI models include; Data persistence ; defined as data existing longer than the human subjects that created it, driven by low data storage costs, Data repurposing ;data being used beyond their originally imagined purpose and Data spill overs ; data collected on people who are not the target of data collection. These characteristics of data engineering have been proven to be susceptible to compromise to reveal features of the training data sets leading to potential privacy compromise in cases of sensitive training data used.

Tab attacks: Tab attacks can occur when an attacker has access to top-1 predictions of a language model, leading to leakage of the model features through pre-set controls like tab clicks. Poisoning attacks: This occurs when attackers manipulate an ML/AI model to act in a way that exposes sensitive training data or make predictions that potentially expose sensitive information on new data sets. Evasion attacks: This occurs when a model is forced to act in un-intended way that may include either wrongly classifying an output or exposing sensitive features of a model that may include sensitive information like personally identifiable information (PII) or protected health information (PHI).

Privacy preserving AI/ML

In an effort to secure ML/AI models from such adversarial machine learning that aim to compromise the privacy and data security of the training and /or the prediction data, Microsoft research proposed a tiered engineering approach to ensure that models are protected through implementation of privacy preserving techniques at each stage of the life cycle. This involves securing every stage of the development of the model as described below;

Training Data Privacy: The guarantee that a malicious actor will not be able to reverse-engineer the training data. Input Privacy: The guarantee that a user’s input data cannot be observed by other parties across the whole life cycle of model development. Output Privacy: The guarantee that the output of a model cannot be reversed by a threat actor to be able to guess the predictive methodology of the model. Model Privacy: The guarantee that the model cannot be taken over by a threat actor to compromise its design and therefore its predictive features.

The following designs considerations have been tested as potential solutions for privacy preserving technologies;

1. Using synthetic data (SD) or anonymised/de-identified data, this helps in avoiding the use of sensitive data to train models hence preserving their privacies. However this compromises the quality of the models as they cannot effectively represent the characteristics of real production data.

2. Federated Learning: Instead of training models on centralised large data repos, federated learning is basically on-device machine learning whereby the training is at end points/edge devices and the models come together as parts already trained to achieve particular collective objectives. This makes it harder for an attacker to reverse the models individually from a collective prediction.

3. Differential Privacy: A technique that adds randomized “noise” to the training data that cannot be reverse engineered to understand the original inputs. The noise inherently interferes with the quality of the predictions and is computed out as inversely proportional to the accuracy and certainty/reliability of that data.

4. Homomorphic Encryption: homomorphic makes it impossible to reverse encrypted data either at rest or in motion to decipher the methods of the model under training. This ensures that an attacker cannot use the encrypted data characteristics to infer the model characteristics. Some forms of Homomorphic encryption involve the encryption of data while in use to ensure the preservation of its privacy.

5. Secure Multiparty Computation (MPC): This involves two or more parties’ who do not trust each other who generate their own separate inputs and transform the inputs into “nonsense” which gets sent into a function whose output is only sensical when the correct number of inputs is used ensuring that any attacker must access all the separate inputs to try reverse the collective output.

Other controls

Apart from the technical privacy controls illustrated above, it’s important that ML/AI developers implement proper data security governance in the process of designing, training and testing their models to ensure that at no stage of the ML development lifecycle is a privacy risk introduced. ML developers should keep in mind the following good practices;

1. Data minimization

ML/AI developers should only collect essential data to meet the objectives of the model under development. For instance for the development of a digital identity management model for a government institution do not need to collect DNA data.

2. Secure data storage and transmission

The first rule of any data governance program is to always encrypt data at rest and in motion using secure algorithms and secure the encryption keys. Ensure that all data elements are encrypted and the keys securely stored to prevent compromise.

3. Anonymization and pseudonymization

In instances where its important to have representative sensitive training data fed to a model, use techniques like tokenization and hashing to blur out such sensitive information for example, a medical research institution can use hashed patient IDs instead of actual names in a clinical trial database. Use of hash functions such as HMAC for irreversible pseudonymization help in having representative models without using actual sensitive information for training models.

4. Secure Deployment

To ensure that the process of development of an IA model is free from compromise developers should implement secure development practices like DevOps/DevSecOps and code version control ensuring that each phase is securely managed and approved. AI model versions and dependencies should be isolated using container technologies like Docker and Kubernetes and if the model is hosted in cloud workloads use the relevant cloud security technologies to secure the workloads.

5. Identity & access control

Role based access control (RBAC) including MFA authentication should be implemented to ensure that threat actors do not inject adversarial machine learning into an ML/AI model life cycle.

6. Supply chain cyber risk management

Any ML/AI life cycle that involves the acquisition, preparation/cleaning and processing of large amounts of data from various sources introduces a risk that any part of that is a candidate for compromise by threat actors to inject nefarious training data set that makes the model develop particular characteristics that can be later compromised to leak sensitive information. This should therefore be secured at all stages of the life cycle. Any API interfaces should be secured as they represent an added threat landscape.

7. Employee Training and Awareness

The human elements remain the most vulnerable part of any model as they can always be compromised to reveal key training data characteristics. Train all knowledge workers and engineers involved in the development of a model to protect the sensitive training data elements used in the development of ML/AI models.

Introduction

As a security professional I often get requests from users who have lost their accounts to hackers through phishing or other threat gateways. A lot of these are because they either used very weak passwords after forgetting their previously strong passwords or re-used a standard, easy to remember password for all their digital accounts ranging from social media, emails and even financial accounts systems. Others lose their accounts by being tempted by phishing emails claiming to be from their service providers changing their terms of use and therefore need to click a link to update their accounts and change their passwords. I have to admit that I too have fallen for this much to the amusement of my friends & family who wonder why I fall for these yet am the ‘expert’. I honestly have no explanation for this J.

To begin with, an average 250 member Company has about 48,000 passwords, Ping identity 2022. These range from servers, workstations, subscriptions to internal systems. An average individual digital nomad has over 40 digital accounts ranging from emails, to social media, to academic accounts, financial services accounts, e-commerce accounts and government services accounts. To set a strong password as recommended by the InfoSec teams for each of these accounts will always be a real challenge to users. For instance a sample password policy requires that; all passwords should be a minimum of 16 characters, a combination of upper case and lower case letters, contain a mix of numbers and special characters and should be changed often e.g. every 60–90 days. Further, users are encouraged not to save their passwords on browsers as a common Cyber security control to prevent account takeovers. In enterprise settings, it’s a serious negligence offense for a user to write down their passwords for memory as these can easily be lost to cyber attackers.

How on earth therefore can normal users who just want to do their work and access their accounts meet these very ‘strict’ conditions by InfoSec and still enjoy the utility of their accounts? It’s no wonder accounts’ phishing & takeover is always among the leading Cyber threat vectors in the OWASP top 10 every year of publication. To try offsetting this balance, controls like multi factor authentication (MFA), Single Sign On (SSO) and federation services try to make usability & security an even match. However, these are limited in utility and adoption and therefore a method to centrally and securely manage user passwords is needed. Enter the world of password management solutions.

Password managers

These are applications solutions that allow the user to centrally manage their access to digital assets through secure, single point of access and unique passwords therefore limiting the chance of compromise. Some password managers also enter your passwords into websites and apps automatically, so you don’t even have to type them in every time you log in. This frees the users of the burden of having to remember their passwords every so often and hence at risk of loss.

Conclusion

It should be noted however that just like all technology solutions password managers are not fool proof and in fact password managers create the risk of a single point of failure whereby should an attacker gain access to the master password for the password manager then they have access to the whole real estate of sensitive digital assets. These can be mitigated through further compensating controls like MFA and token based authentication.

In the balance of risks and potential impact, I therefore recommend password managers for users both corporate and individuals.

Examples of password managers

1. NordPass available at https://nordpass.com/

2. 1PassWord available at https://1password.com

3. BitWarden available at https://bitwarden.com/

4. ZohoVault available at https://www.zoho.com

5. One Identity available at https://www.oneidentity.com/products/password-manager/

I get this question too often in the wake of AI models like ChatGPT that seem to have human-like tendencies and intellect and my answer to this is normally a very firm NO. Yes many professions that carry out activities that can be easily automated like Accounting,design, copy writing can be easily replaced by AI but at no point will the planet witness a robotic apocalypse with all humans under the mercy of AI agents with unlimited abilities to cause unimaginable damage to human life as we know it.

This is not to downplay the great strides made by ‘emerging’ technologies like IoT, AI, Blockchain etc as inconsequential but to recognize that the boundaries within which they operate are human defined and before AI for instance can create its own environment and thrive in it within the human environment without human guidance , the models will have to learn to exist like humans both kinetically and otherwise. AI enabled machines can recreate human voices and images but cannot replicate the adoring smiles of a mother for instance to a toddler or the warm embrace of a loved one.

For a beginning, AI has made strides in Sciences in ways humans would struggle to due to time & resource constraints. In medicine, human genome sequencing, diagnosis of seemingly miniature cancerous cells that would otherwise be very difficult to quickly detect by human scientists and predictive medicine are a real example of the power of AI in making human life more comfortable. In human sciences, activities like advertising, human-centered design, generative algorithms like ChatGPT have taken generative content to new levels. However in my opinion AI is not and will not be a threat to human existence for a long time because of the following reasons;

Limited training data

Most of the data represented in these algorithms are sourced from social media and other digital platforms. These data have been proven not sufficiently representative of the human world because of many reasons such as; a very small percentage of the world population is active on social media, those that are active majorly do not to give the correct information about their life experiences often choosing to edit their representations to fit into an ‘socially acceptable’ narrative such as using colour filters to look more beautiful or more toned or only sharing pictures demonstrating particular lifestyles successes which is not fully representative of the human experience which has many challenging times in between.

Also the presence of artificial bots and active information operations on social media platforms ensure that users are grouped into information Eco-chambers that only display biased content curated by an algorithmic model of what is thought they would like. Further, almost half the traffic and data generated on digital media especially social media like twitter has been proven to be from non-human actors like bots and therefore cannot be used to accurately model human behaviour and experience.

Limited Data representation

A lot of human experience remains unrepresented in the digital sphere like emotions, subtle meanings and compound meanings of words, experiences. If this is already a challenge to humans with regards to translations from one language to another how easy will it be to translate from a human language to a machine language through limited ingestion tools, routines or representations? Even though the digital media has tried to represent these through emoticons, memes, Emojis , these are not representative enough to capture the whole human experience of which majority are non-verbal, non- written and many times non-represented through cultural, education, emotional or socially imposed limits. They therefore cannot be accurately trained to model a real human experience.

Limited Algorithms designs

AI algorithms in production like ChatGPT are mainly trained on biased data mainly representing western cultural defines like race, language, mannerisms and representations while leaving out a core demographics which therefore leaves out a very large and rich data set that interact with those demographics already represented in the current models and that inform the full experience of humanity. This therefore further limits the models on core neural networks learning paths and therefore making them an example of an under-fit for a model.

It’s therefore my opinion that AI as currently conceptualized cannot sufficiently be a threat to humanity because of the structural limits in the design of the models, diversity and completeness of the data sets and the dispersion of human experiences. For this to happen maybe the following conditions should be true;

1. Convergence of the human culture and language, this will not happen anytime soon due to the different cultures across the world with different languages and nuances to their representation of realities. These have defined human civilization for as long as the human race has existed and been a basis of many human experiences as we know it.

2. Full digitization of the human experience, this will call for a complete representation of the human emotions, language,nuances and experience. Active researches are on-going on this but they are nowhere close to representing half the human experience most of which is non-verbal, non-physical representations.

3. All humanity to get online and actively & truthfully participate in social interactions to create a more representative data set of interactions for training AI models.

4. AI models will have to move from representational based on historical data to generational that would have to learn and be able to predict human experiences based on new unseen stimuli/ data points.

Introduction

The increasing integration between personal and enterprise computing through use cases like bring your own devices (BYOD), Social media, remote work on company devices, cloud computing has further blurred the boundary of data governance for enterprises & individuals. It’s no longer easy to demarcate the enterprise boundaries from individual computing boundaries as employees use the same devices to access personal digital resources and also work emails. This has led to enterprises losing control of their own data security leading to compromises through hacked personal devices accessing secured company information.

In order to get a hand on their data security governance, enterprises have made efforts to secure their technology boundaries through deployment of granular policies implemented through Cloud based data governance tools like Amazon Macie and signing service level agreements (SLAs) with respective service providers to guarantee the security and privacy of their data. Africa specifically stands at cross roads of embracing the inevitable emerging technologies like AI, blockchain and big data but also has to match the accompanying regulatory environment that ensures that these technologies do not morph out of control especially as concerns data privacy governance and protection.

1. Trends in Data governance & Security

Among the emerging data security trends in emerging economies such as Africa, the following are key technologies, processes and governance approaches of note;

a) Data warehousing through Cloud applications

For a long time Enterprises have used several distinct systems developed on different platforms to achieve the different business objectives. From human resource management (HRM) systems to manage the employee records, to financial systems for reporting business performance, enterprise networks managed by the internal IT team, and mobile applications for on-field staff to keep access to corporate resources.

This creates a very complex technology environment especially for data governance and as such there is the emergence of unified Cloud computing in an effort to house all enterprise systems under one roof for ease of governance and control. These cloud solutions provide all the major services such as networking, enterprise applications like office 365, collaboration tools like Teams, meets and even threat intelligence platforms. This efficiency brought about by the pay as you use consumption model has attracted many enterprises who need to manage their budgets but also have full access to these services.

Because most of the major cloud service providers are large international technology firms like Google, AWS and Microsoft azure, most enterprises cannot afford to develop their own cloud environments and therefore have outsourced their cloud environments to these technology firms who already have the in-house capacities to manage, secure and provision these cloud services leading to a smaller, less technical in –house technology teams for enterprises.

b) Use of Data analytics to inform operations

With the enterprise data now converged under a single cloud infrastructure, it has been easy to track specific business performance metrics through customised analytics tools and dashboards that have made businesses better understand their operations and fine tune them to meet very specific targets. Armed with this new knowledge, enterprises have been able to develop new products, processes and even systems that better reflect their target markets.

Products like Fintechs based on the banking applications’ metadata like digital loan apps, on demand gig economy like Uber, Air BnB, and even sports betting have been emergent products from this very granular data on user behaviour analytics. However, with the personalised nature of these services, there have arisen the concerns on the safety and protection of Personal & Corporate data. Concerns of access and the processing methods of personal metadata has raised concerns among data privacy practitioners and even led to the banning of some AI based products like chatGPT in Italy [1].

c) Increased cyber threats due to a wider threat landscape

Because of the popularity of these very personalised systems, threat actors have been attracted to these applications and platforms and led to the highest level of cyber-attacks to either compromise the financial systems for gain as the case on Fintechs like mobile banking, Mobile loan apps, and Mobile betting applications [2]. The centralised enterprise data through cloud infrastructures and personal data through social media applications like Facebook, Instagram, and Twitter has led to several data compromises leading to several fines imposed on these platform providers for not sufficiently securing personal information [3, 4]. To ensure the safety of these very specific personal data, many countries in the emerging economies have tried to regulate the use of these data by passing data privacy regulations like the Kenya Data privacy Act 2018 [5] ,Protection of personal Information Act (POPIA) in South Africa [6], and the Nigerian Data protection regulation 2019 [7].

2. Challenges in data governance & security

The ubiquitous nature of technologies popularly used both at enterprise level like the Cloud application services and the social media applications used for personal social interactions like Facebook, Twitter, Instagram and Tiktok blurs the boundaries of data governance in these platforms. Even though services like Google cloud platform and AWS has Data governance specific modules that enforce particular specific data governance controls, it’s impossible to effectively enforce these on enterprise level. This therefore creates a gap in data security governance that can be exploited by threat actors to compromise enterprise and individual data privacies.

The difference in regulatory frameworks between jurisdictions especially in Africa makes it ineffective to enforce standard data security controls across the digital sphere thereby limiting the effectiveness of any intervention. Also, many jurisdictions especially in Africa don’t even have data privacy & security laws and therefore creating a data privacy governance gap. These are often exploited by some major technology firms that move to these less regulated environments for their research activities that would not be legal in the mature markets of the west like Facial recognition technologies and some drug research companies [8, 9, 10].

Also cyber criminals set base in these jurisdictions to commit crimes that would be difficult to prosecute due to lax regulatory controls and limited enforcement capacities. The difference in data privacy & security maturity levels make it difficult to standardise data security controls across different jurisdictions which limits commerce across boundaries thereby limiting economic integrations.

The emergence of big data due to the large volumes of social media data and the cloud hosted enterprise data that led to the development of highly sophisticated analytics and AI systems to create models for new products has created a further risk of surveillance and targeted information operations by both state and non-state actors. At best these have led to understanding the public sentiments through tracking mentions on social media and therefore inform interventions in public health pandemics like the Covid-19 response [11].

At worst these have been conduits for targeted information operations like mass miss-information and dis-information as the case of the 5G transmission technology which led to actual destruction of property in parts of Europe and the Anti-vaccine campaigns during the Covid-19 pandemic that hampered the response to the pandemic in Africa [12]. In some instances Information operations through misinformation have been used to cause civil unrest and even set the grounds for compromise of democratic elections in emerging economies [13, 14].

Some technologies emerging from the big data analytics like AI and blockchain are not yet mature enough and therefore have no clearly defined privacy & security controls. It is therefore it’s very difficult to enforce any specific data security governance standards without access to the AI research labs which are mainly ran from the west but whose adverse effects like surveillance are most felt in the emerging economies [15. 16].

3. Potential interventions to Data governance & security in Emerging economies

As potential mitigations of the identified risks especially that of fragmented data security & privacy governance in emerging economies like Africa, a starting point would be that instead of all African countries implementing their respective Data protection regulations, they should all ratify the African Union convention on cyber security and personal data protection [17] .

This would ensure a standard data governance across the whole continent and therefore making the regulatory environment more predictable and therefore ease of integration of digital services across the 54 African jurisdictions. A standardised regulatory environment ensures that major technology and pharmaceuticals do not take advantage of the sparse control to test out products that would compromise data security for the citizens of African states and that are not legal in the west.

For the international community, there is need for a legal policy framework to guide the use of AI in developing new digital products like information operations and surveillance products in order to ensure that their use does not compromise the digital privacies of civilians. This can be possible if the major technology players work hand in hand with regulatory agencies and international agencies like the UN to define a governance framework for technologies like AI to ensure that we harness it positive attributes but also protect from the adverse effects.

1. References

1. ChatGPT panned in Italy over privacy concerns, accessed on 28th April 2023, accessed from :https://www.bbc.com/news/technology-65139406

2. Mounting cyber threats mean financial firms urgently need better safeguards. Accessed on 28th April 2023, accessed from : https://www.imf.org/en/Blogs/Articles/2023/03/02/mounting-cyber-threats-mean-financial-firms-urgently-need-better-safeguards

3. LinkedIn data breach, accessed on 28th April 2023, accessed from : https://www.forbes.com/sites/quickerbettertech/2021/07/05/a-linkedin-breach-exposes-92-of-usersand-other-small-business-tech-news/?sh=cff5a695b339

4. Facebook agrees to a breach settlement. Accessed on 28th April, accessed from : https://www.dw.com/en/facebook-agrees-to-pay-725-million-settlement-for-security-breach/a-64201763#:~:text=In%202018%2C%20it%20came%20to,ended%20up%20winning%20the%20vote.

5. Kenya Data privacy Act 2019, accessed on 28th April 2023, accessed from : https://www.odpc.go.ke/dpa-act/

6. The Protection of personal Information Act. Accessed on 28th April 2023, accessed from : https://popia.co.za/

7. Nigerian data protection regulation. Accessed on 28th April 2023, accessed from : https://ndpb.gov.ng/Files/NigeriaDataProtectionRegulation.pdf

8. Chinese surveillance technology in Africa. Accessed on 28th April 2023, accessed from : https://epic.org/the-rise-of-chinese-surveillance-technology-in-africa-part-5-of-6/

9. Europe edges closer to banning facial recognition. Accessed on 28th April 2023, accessed from :https://www.politico.eu/article/europe-edges-closer-to-a-ban-on-facial-recognition/

10. How drug companies are side stepping WHO technology transfer hub in Africa. Access on 28th April 2023, accessed from : https://theconversation.com/how-drug-companies-are-sidestepping-the-whos-technology-transfer-hub-in-africa-179029.

11. Sentimental Analysis of COVID-19 Related Messages in Social Networks by Involving an N-Gram Stacked Autoencoder Integrated in an Ensemble Learning Scheme. Kandasamy, V et al, 2021. Accessed on 28th April 2023, accessed from: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC8623208/

12. Covid-19 Infodemic and Misinformation in rural Africa. Okereke, M et al, 2020. Accessed on 28th April 2023, accessed from : https://www.ajtmh.org/view/journals/tpmd/104/2/article-p453.xml

13. Social media misinformation stokes a worsening civil war in Ethiopia. Accessed on 28th April 2023, accessed from :https://www.npr.org/2021/10/15/1046106922/social-media-misinformation-stokes-a-worsening-civil-war-in-ethiopia

14. Disinformation is undermining democracy in West Africa. Accessed on 28th April 2023, accessed from: https://www.cigionline.org/articles/disinformation-is-undermining-democracy-in-west-africa/

15. AI in Africa key concerns and policy considerations for the future of the continent. Accessed on 28th April 2023, accessed from :https://afripoli.org/ai-in-africa-key-concerns-and-policy-considerations-for-the-future-of-the-continent

16. Challenges of AI, accessed on 28th April 2023, accessed from : https://www.chathamhouse.org/2022/03/challenges-ai.

17. African union convention on Cyber security and personal data protection. Accessed on 28th April 2023, accessed from : https://au.int/en/treaties/african-union-convention-cyber-security-and-personal-data-protection.