Chris Kubecka on Africa’s Cybersecurity Future | BSides Kano Conference 2025.

alarming >> about uh cyber security infrastructure in Africa and what the government needs to be doing to um improve uh improve the system. So, thank you very much. Uh welcome to Bside Ko conference. >> Oh, thank you so much. I'm so excited. This is such an honor. Thank you. Thank you. >> So, um as I mentioned, uh the our session will focus more on uh the government investment. First of all, what's your view on the current uh stage that we are when it comes to cyber security in Africa? Uh how can you give us like a highlight of uh what is happening or based on your knowledge on that? >> Well, I would say that there are uh

quite a few challenges and those challenges are similar in many ways to other parts of the world. uh for example privacy. Now there's uh a general lack of privacy laws and the private data of citizens is worth a lot of money. Uh but also very valuable to the citizens themselves. Um also because of lack of privacy laws or enforcement uh that also um affects businesses and how they keep intellectual property private and those types of things that also ends up rolling into cyber security. So uh bad organized cyber criminals can use some of this information to get through cyber security if there is enough that is actually implemented um for private individuals and for businesses. So those two things are are

kind of kind of a big challenge and Africa as a continent it's not unique. Um it's just that right now uh there really really needs to be a bit of a bigger push. Um at the same time when it comes to critical infrastructure trying to keep the modern world and and the lights on and so forth there also has to be resiliency when it comes to keeping data around. So if for example one area loses power or uh gets affected by a cyber attack or whatever the data is still accessible. Now a week or so ago uh South Korean government found out because of a fire one of their big uh government data systems something like hundreds of

terabytes or what have you were lost most likely forever. And that's citizen data, government data, all sorts of stuff. and that's going to be impossible to replace. So, uh resiliency in that respect is extremely important. So, I would look at those areas personally and you know for my expert opinion. >> Okay. Okay. I think that's amazing. That's great because um one of the reasons why um I think this topic is very important or there is a need for government to hear from you is um we have um critical infrastructures that we rely on and um based on what you've heard maybe I can say that maybe the attacks are not investigated here. So we are not even paying attention to what is

happening. we just think of it as maybe it's not happening which I believe maybe you can tell us more about that. Uh what and what um kind of threats do you think are facing our critical infrastructure when it comes to maybe um we have for example Ko state is the title of Ko state is center of commerce because we have so many companies that have big industrial uh control systems. So there is a like an area here in Cano is called Shada. That area have a lot of companies that use IC systems. So I was just thinking maybe if for example um there is a country that wants to take down Nigerian economy or will affect us

in any way or if there is any cyber war between Nigeria and any other country. Are those systems ready to be safe or are they protected or do we have the right uh protection? As we all know, ICS systems are one of the most difficult to deal with when it comes to security because of their nature of maybe uh some of them uh last for like the last 30 or 50 years and there's no upgrade or anything. So um what do you think uh we are doing wrong or do you think um there is a threat to those systems? >> Well I think uh step number one is recognizing that there's a problem. Now, um, when you,

excuse me, first contacted me, I took a little look see, uh, critical infrastructure. >> Oh, >> and sorry, getting over a cold using a uh, two tools, Showdan and Census, and just comparing the two results. >> Yeah. >> A bit more accuracy. And these are not hacking tools, right? Uh but it gave me a general sense that uh there's a lot of outdated yet internet connected um operational technology and a way that is not very secure and when we're dealing with uh potential competitors because I've seen competitors pay criminal hackers to attack other um competitors. That can happen. Uh but business can be very naughty. Um then of course nation state stuff or uh any sort of pressure groups

uh that may be involved who want to extort money uh so criminal gangs who uh start picking up cyber capabilities and so forth or cyber terrorist groups or what have you. Now it's very important to you know first we see step one there there's a problem there's a potential of risk. We see that geopolitics around the world, no place has been left untouched. All right. Um then [clears throat] what are the business impacts and then what are going to be the human impacts if they're affected then we need to look at hey wait a second this is going to affect the money in our pocket the money for shareholders and uh etc etc. So I would then look at uh writing a

report on some of these things and then doing some tabletop exercises and some introductions to the topics at various levels. Managers, executives a bit different half day, what have you down to technical level to get people some awareness and understanding with some real world cases that are relevant to the area because it doesn't really work if somebody brings in data from I don't know the Netherlands. it isn't Nigeria. Um, and then start working with trying to improve things um, especially if you can do so in collaboration uh, with other groups that have already gone through this and uh, can give you some best practices as well because in this line of work we all need to network

and collaborate together because the internet is uh, borderless. Yeah, I think I think this this is amazing because um um I'm living here and I can see what is happening around the world but I don't see like headlines here in our news organizations, new news companies talking about these topics as if they did not exist here. So um maybe if you are to tell the government or to give them advice, what would you tell them? Well, I would try to give as relevant uh advice as possible as well as looking at uh obviously uh the situation getting experts like yourselves included because you know the area and trying to meet in the middle uh somewhere. [clears throat]

uh look at uh any constraints that might come up but any uh particular areas of improvements and uh you can't fix everything instantly and while you're trying to fix things emerging technology occurs. So uh also take a look at the short, medium and long-term as a goal. Not just say oh you need XY Z this type of technology from a vendor. You shouldn't really lock into that [clears throat] but to look overall as well as the potential of collaboration. With collaboration that can also bring both educational uh opportunities but also economic opportunities uh at all levels. Uh because once you start looking at best practices and collaboration, people are like, "Hey, you know, you might want to take a look

at this because could do this. Hey, why don't we do this?" Bam, bam, bam. And you start uh increasing uh the economy. Cyber security should not, at least in my opinion, be viewed as uh just this uh empty hole that you dump money into. It should actually, in my opinion, be something that enables opportunities. >> Yeah. Yeah, definitely. Um one of the things that maybe we have a problem here is number [clears throat] one um with cyber security you know that you need to invest in tools you need to invest in building the infrastructure but the most important thing is also building the manpower which means the people that can do the job. What is your

advice or what is your take on skills development in Nigeria or in Africa? What will you tell the government or what's your um like call to action to our government to help in building the right people that can solve and protect these systems? >> So I I see a few different ways you can build that. Obviously uh looking at the availability I also am acutely aware of what we would call the brain drain problem uh in Nigeria. So you want to try to retain people. We have a similar situation in a country I visit a lot called uh Bulgaria. Um and uh by taking a look at some of your initial constraints, start uh taking a

look at who can help and making it cool. Now obviously you'd need training, but who's going to want to do this training? And sometimes, quite frankly, cyber security doesn't sound the coolest. >> Yeah. Now, in the past, uh I remember watching a series of uh funded uh we'll call them like drama, soap opera shorts, uh maybe about 15 years ago or so that was uh done about a variety of different health problems. Um but what I would love to see is something similar uh with real life stuff that just involve cyber security. Yeah. >> And I think that when we can include and show these particular impacts >> in a way that uh isn't uh you know

overarching but shows how we're all affected by these things then people start going oo but we also have to make it interesting and cool. Um because I love what I do and I don't know about you but you seem to love what you do too. >> Yeah. and by invigorating it and also showing the impact that people can have by staying in Nigeria and creating firstly we also have to create those opportunities for people to want to stay you know are there the jobs available so it's got to be multiple stakeholders but man we got to bring some entertainment into it >> um also uh one thing I would love to suggest um is working with uh some of

the police departments and trying to identify um teens and young adults before they start going towards the cyber crime area, pull them in and show them how cool it is if you can do other things too. Uh even if you're a reformed criminal hacker, >> so uh you know it's it's going to have to be, you know, multiffold, but this is our future. Emerging technology is our future and we need people. >> I think Yeah, it does. Amazing. Yesterday as you know we had our physical session and um during the Q&A uh one of the attendees asked a very important question. You were saying that what is the disadvantage of cyber security and the question you might

think of it as a negative question but the way I see it is very important to make things clear to people. Um what makes someone a bad person or a good person is their intention of what they are doing. So you might learn the skills where you might have all the tools at your uh uh tool uh kit and everything is how you use it that define who you are. And I think in this world now is more easier for you to impact the world in a positive way. is much more difficult to commit crime in the sense that you don't have a peace of mind. You cannot live uh peacefully. You are always like trying

to hide or trying to do this and that. Instead, you can do what you like because maybe you have the passion of what you are doing but you can do it while also getting benefit of um people relying on you, trusting you, uh giving you different values. So I think the point you make is very important that we need to start um paying attention to kids uh children that have this talent or that have interest in the in the area before they start using it for for other things. Um there are so many people here that are trying to get involved or trying to build a career in cyber security. Um I would like to hear your

thoughts. you you are like your story is one of the coolest stories that I've ever heard uh starting at a very young age um doing amazing things with your skills and everything saving the world you are not just saving companies you are saving countries so what I I want to hear from you is maybe your advice to someone who wants to succeed in this field >> so for me I see an opportunity in a digital space that I don't see in the physical space. I think that the digital world is something very different where uh we can uh achieve a near level of equalization and enable in order to do so uh we need more people like yourself and the people

watching this um who [clears throat] recognize that technology can actually be fantastic. not just you know algorithms to sell us more stuff that are made in factories from plastic that dump into the ocean and just create just more problems right uh there is you know more to that and and you know more to uh just likes on social media some of the cool things that I find with cyber security once you start getting into the field is it is such a wide arching discipline you can do so many different things you can think about I know an elevator hacker a person who then uh ethically hacks elevators and tries to set up cyber security for them. Um I know people who

do all sorts of cyber security for humanitarian reasons or to protect people who are victims of domestic violence or in the healthcare industry. Now imagine how important it is if you are relaying X-rays or other diagnostic information all over the world for doctors where they're available to come back so that hey does this person need surgery. We have to make sure that that stuff is protected um [clears throat] and available because part of cyber security is also making sure things are available as well and resiliency. Um then [clears throat] hey, how cool is it if you're into ships and you can protect maritime or uh space or trains or whatever. All of the particular industries you can think of all need

some sort of privacy, cyber security, resiliency, availability, this type of thought process. >> And it's really cool that we can do this type of stuff. We have these uh fantastic superpowers in the digital realm. And once you start learning how to use it and find your passion, bam, you can craft and create a great world with technology and also start learning how to collaborate and look at other projects which actually help out a lot more than just making money at the end of the day. >> Yeah, that's that's amazing. um you start uh at a very young age and I believe we also have children that have that kind of um uh passion and also

the talent to do it. Uh probably your your your story is very popular. We heard about your family. Yeah. Yeah. We heard about your family background, how they they um it shaped your your your who you are and what you do. Um number one, how can someone who have a child notice when their child are into cyber security and also how can they help them become successful in the sense that not to commit crime, not to get involved in anything, how can they guide their children to uh to succeed in this uh field. >> All right. So um if you recognize that a kid is turning into uh someone like us um before they start uh just breaking

into uh systems uh being overly curious and I will say that's one of the the tricks is uh a curious person a curious kid who also likes to solve puzzles um or um uh take things apart and put them together. >> Yeah. Now once you start noticing this pattern um cultivate it um because curiosity uh hopefully will evolve into critical thinking. Now, if you notice, hey, you might have done something wrong here, have them explain and go, now how would you stop um a bad person from doing the same thing? And then they have to go, oh, wait a second. It isn't just attack, attack, attack. It's also, how can I? Because um you need way more

skills to be on the defender side than you do on the offender side because you have to move around all these different pieces of the puzzle at the same time. >> Yeah. [clears throat] And by recognizing that, they're like, "Oh, all right." And then you can go, "Now, what would happen if, I don't know, this happened to one of your friends and a bad person did the same thing?" Oh, well, maybe cultivate both the curiosity, the technical skill, and then that critical thinking, and then being more on the defender side and that human aspect. Now, when I was a kid and I was busted hacking at the age of, I don't know, 10, 10, way too young. Um,

I did not have that guide. I did not understand the human effects. So, I was able to get into uh things like in FBI files and undercover agents. That was a bad thing for a kid my age, right? Imagine those human effects. But if you flip it around to how a kid can understand it, they can understand it. And please do not think that your kids are not smart enough to do this kind of stuff. They are. Kids can get into everything in the physical world. Oh, you try to hide something. [laughter] They're into it. Those little spy fingers. So imagine what they're like in the digital world putting all of that together and they learn like sponges. So

they are smart enough to do this even at a young age. So cultivate it and guide them towards the right direction. Yeah, I think that's amazing because the reason why I asked the question is you are the right person to give this advice because you have done it yourself at that time and you even you uh I can say um should we call it arrested or something like that? [laughter] Yeah. >> So you were arrested by the FBI and then from there you have the right guidance and now you are helping the world not only your country but everywhere you help in saving lives which I am very very like it it give me like a motivation to do

more to this world because um for those that don't know the story of what you have done for example to some Nigerians in studying in Ukraine um I was there was a Nigerian that received his name is Shimi. So I read the story I check his work um the songs that he makes now. I was like okay this person will have died if not because of what you what you did. So you saved someone and now he's impacting the world in a way with his skills with his talent and everything which is very very amazing and uh that's the the kind of footstep that we need to be following. Your your your story is very popular. We heard about your

family. Yeah. Yeah. We heard about your family background how they the um it shaped your your your who you are and what you do. Um number one, how can someone who have a child notice when their child are into cyber security and also how can they help them become successful in the sense that not to commit crime, not to get involved in anything, how can they guide their children to uh to succeed in this uh field. >> All right. So um if you recognize that a kid is turning into uh someone like us um before they start uh just breaking into systems uh being overly curious and I will say that's one of the the tricks

is uh a curious person a curious kid who also likes to solve puzzles um or um uh take things apart and put them together. >> Yeah. Now once you start noticing this pattern um cultivate it um because curiosity uh hopefully will evolve into critical thinking. Now, if you notice, hey, you might have done something wrong here. Have them explain and go, now, how would you stop um a bad person from doing the same thing? And then they have to go, oh, wait a second. It isn't just attack, attack, attack. It's also, how can I? Because um you need way more skills to be on the defender side than you do on the offender side because you

have to move around all these different pieces of the puzzle at the same time. >> Yeah. And by recognizing that, they're like, "Oh, all right." And then you can go, "Now, what would happen if, I don't know, this happened to one of your friends and a bad person did the same thing?" Oh, well, maybe cultivate both the curiosity, the technical skill, and then that critical thinking, and then being more on the defender side and that human aspect. Now, when I was a kid and I was busted hacking at the age of, I don't know, 10, 10, way too young. Um, I did not have that guide. I did not understand the human effects. So, I was

able to get into uh things like in FBI files and undercover agents. That was a bad thing for a kid my age, right? Imagine those human effects. But if you flip it around to how a kid can understand it, they can understand it. And please do not think that your kids are not smart enough to do this kind of stuff. They are. Kids can get into everything in the physical world. Oh, you try to hide something. They're into it. Those little spy fingers. So imagine what they're like in the digital world putting all of that together and they learn like sponges. So they are smart enough to do this even at a young age. So cultivate it and guide

them towards the right direction. Yeah, I think that's amazing because the reason why I asked the question is you are the right person to give this advice because you have done it yourself at that time and you even you uh I can say um should we call it arrested or something like that? So you were arrested by the FBI and then from there you have the right guidance and now you are helping the world not only your country but everywhere you help in saving lives which I am very very like it it give me like a motivation to do more to this world because um for those that don't know the story of what you

have done for example to some Nigerians in studying in Ukraine um I was There was a Nigerian that received, his name is Shimi. So I read the story, I check his work, um the songs that he makes now. I was like, okay, this person will have died if not because of what you what you did. So you saved someone and now he's impacting the world in a way with his skills, with his talent and everything which is very very amazing. And uh that's the the kind of footstep that we need to be following to use our skills and um improve the world in so many ways um not destroyed our society. So I think that's amazing. Um

another thing that I would like us to talk or I would like you to talk about um directly to parents especially parents um we talk about the skills and everything but now there is another side of uh educating children online protecting children uh when it comes to using technology. What can you say about that? Are we doing enough to protect children or there is a need for us to do more? >> I think that there is definitely a need for us to do more. Uh the reason being is uh very bad people, predators, uh see our kids, our future generation as a commodity, as something that will make them money or satisfy some need, but it's usually

money. Um, and not only nowadays do we have to worry about the um gross kind of sexy time stuff that they try to groom, but also uh cyber criminal gangs. And I should stress cyber crime uh and financial crimes associated with it are estimated in 2030 to be upwards of 25 trillion a year. uh which is more than the uh GDP of the US and they like to uh grab kids out of uh various gaming platforms or other platforms where they uh start noticing the skills that I uh described. Then there's uh depending on geopolitics or uh if it happens to be a criminal gang, terrorist group etc. um grabbing kids, grooming them in a

similar fashion to do physical sabotage, to do um a variety of different acts. Uh sometimes it even starts out with kids going, "Oh man, I could I could make a few hundred US dollars just by taking pictures and doing this." Uh and I could really help out my family. And then it grows. And if a kid doesn't do it or young adult doesn't do it, they blackmail them all throughout these three particular branches. >> So I think it's very very important for parents and family members um and close family friends to create a safe space because it isn't always mom and dad that they go, "Hey man, I saw something or somebody spoke to me and I

you know what? It didn't feel right." Sometimes it's big brother, uh, big sister, auntie, uncle, etc. Um, and kids, it is shocking how, uh, young, uh, people start trying to see what can happen. >> Uh, so create that safe space. Uh, even, you know, like, I don't know, once a week, twice a month at a family or or get together. Um, but if they can tell you about it, then you can start working this stuff out too. >> Yeah, [snorts] I think I think that's amazing because it's very scary. And number one, it's not only about the um as you mentioned uh them pictures um and sharing it with with adult people or some people outside. uh sometimes

even the content that they consume online uh which we know there are some uh uh application that poisons the mind of these young kids the information confuse them maybe based on their beliefs what they believe is right or wrong. So um what's your call on maybe we know censoring is not the solution or uh minimizing or controlling what can be shared is not the the solution but what do you think the let's talk about specifically Nigerian government is can do to improve the content and uh the information because we know that um there are some countries that maybe wants to do influence campaign which is they will share information that will change the mind of people to

take certain action. What can you tell the government about information campaign or influence campaign and what they should be doing and the danger of that to our society? >> Definitely. So in the past uh especially uh 3 years or so there have been a great increase in uh things like foreign interference whether it's elections or other political spheres or commercial interest because many times it's also money behind a lot of this. >> Yeah. And um what's very disturbing is it's caused a lot of strife. Uh I believe the last uh reports were something like 64 major elections had been affected just in the past year and a half and that also again affects trade um and the money in your pocket.

[clears throat] Now uh because of uh this some governments like uh Romania have been able to leverage this and go hey you know this stuff isn't quite nice and have been able to get uh more direct access into some of the social media platforms that have been used and uh what one of my friends called psychological malware and [clears throat] um uh government and uh police and province and and area police should be able to submit reports and should have the power just like Romania has been able to get for some of these social media platforms. At the same time, it doesn't apply to all the social media platforms. However, a large country like Nigeria

should be able to apply um what I would call cyber diplomacy to be able to get that because part of it is recognizing the problem uh testing out what you can do and then building a plan to do something about it. Um because the last thing you want is some of this to turn into physical violence. And that's one thing I've seen in other parts of the world and I don't like seeing that at all when it's a lot of misinformation. >> Uh and trying to avoid that as much as possible. >> Yeah. last I think last two weeks or is it 3 weeks ago I was just um I start seeing some content which is like from the US

and Canada about what is happening in Nigeria right uh the content was sharing that there is a genocide in Nigeria which is yeah there is a killing and people are dying but the framing of the content can cause physical violence. So that kind of uh I can say um information that's what we we are talking about the government needs to do better. Number one needs to make information available to people so that uh they can verify the source of the information as as you mentioned uh have cyber diplomacy to protect the the citizens. So um in few words uh maybe in conclusion I don't know if you have anything that you want to tell directly

the government of Nigeria about cyber security. >> Cyber security in my expert opinion will have a return on investment if it is applied correctly as well as uh applying investment in your own people. uh resiliency is of utmost importance for both people, government and businesses and will vastly increase your economic outcome as well as job outcomes for um I believe the world's youngest largest uh population in Africa if not the world. So thank you very very much um for taking your time and I wish to have you physically here next year attending Bside Ko conference. Uh thank you very much for the support and um you're one of the people that help in making this

happen. Without the support I think this event will not happen at all. So thank you very very much for your time for everything that you have put in to make this happen. Thank you. I can't use my words to appreciate what you have done. Thank you very much and uh I wish to have you next year as a physical speaker here in Cano. >> I would love that and thank you. It has been an honor and a pleasure and thank you to everybody that helped organize as well and to the sponsors. Thank you. Thank you and enjoy the conference and network and talk folks. >> Thank you very much. >> All right. Chow. Chiao. Bye.