Inadequate "cyber security hygiene" and awareness leave citizens vulnerable to attack.
Cyber criminals made 114 attempts to attack key critical government information infrastructure between January and August 2024, according to a report tabled in Parliament.
The report said the increasing digitisation and migration of many public services to the cyber domain has led to a growing reliance on web-based services, exposing institutions and individuals to cyber threats such as malware, cyberbullying, social engineering and online fraudsters, resulting in subversion, espionage, disruption of services and financial losses.
President William Ruto last month celebrated the success of e-Citizen, which has seen a 1,300 percent growth in daily revenue from Sh60 million last year to Sh900 million now, with a target of Sh1 billion daily.
Already, 22,515 services have been on-boarded, with 13 million active users, and with a renewed order for 34 agencies, including Kenya Power and Kenya Ports Authority, to on-board onto the platform in a week.
The Annual Report on the State of National Security for the period September 1, 2023 to August 31, 2024 shows that the cyberspace landscape remains volatile, and has changed significantly in recent years due to rapid technological advancements and increased global connectivity.
The report, which was presented by President Ruto during the annual State of the Nation Address, says cyber space encompasses the full spectrum of known and potential cybersecurity risks that could affect national critical information infrastructure (CII), user groups and organisations.
“For instance, between January and August 2024, government agencies recorded 114 cyber-attacks targeting key critical information infrastructure,” Dr Ruto said in the report.
“Additionally, the rapid advancement of Artificial Intelligence (AI) technologies has introduced both opportunities and challenges in the cybersecurity landscape.”
The Annual Report on the State of National Security is presented to Parliament as a requirement of Article 240(7) of the Constitution of Kenya and the National Security Council (NSC) Act, Section 16.
The Constitution requires the President, who chairs the National Security Council, to report annually to Parliament on the state of security in Kenya.
Dr Ruto said that while AI enhances capabilities in various areas, its evolving nature also brings new risks and complexities that can be exploited by malicious actors to compromise security.
“Similarly, the dynamism in the cyber security domain continues to pose challenges, including the lag in adopting appropriate cyber security tools and technologies,” he said in the report.
“This has resulted in greater anonymity of offenders, limited monitoring capabilities, and inadequate detection and response.”
Dr Ruto said inadequate "cyber security hygiene" and awareness among the general population leave citizens vulnerable to a range of cyber security risks, such as those targeting mobile devices and banking fraud.
To address the challenges, Dr Ruto said the government has put in place various measures, including the formulation of the Computer Misuse and Cybercrime Management Regulations (2024) to enhance information sharing and coordinate incident response and management.
He said the government has also adopted a multi-agency approach and partnerships to counter the threats.
The President said the government has established the National Kenya Computer Incident Response Team (KE[1]CIRT) under the Communications Authority to monitor cyber threats.
“Further, the government will continue to safeguard our cyberspace by partnering with other national, multi-lateral and related organisations; acquiring modern tools and expertise for law enforcement agencies and cybercrime units; and instituting policy and legislative reforms,” Dr Ruto said.
In October 2024, the Communications Authority (CA) raised the alarm over what it described as the increasing prevalence of artificial intelligence (AI)-powered cyberattacks.
An AI-powered cyber-attack uses algorithms to carry out malicious activity. This type of attack uses AI to enhance the capabilities of traditional cyber-attacks, making them more sophisticated and harder to detect.
In its cybersecurity report, the communications sector regulator said the National Kenya Computer Incident Response Team – Coordination Centre (National KE-CIRT/CC) detected 657.8 million cyber threats in the three months to September 2024, down from the 1.1 billion incidents detected in the quarter to June.
The CA said the majority of detected attacks exploited system vulnerabilities, adding that the trend was driven by the continued use of AI-enabled attacks, attacks targeting system misconfigurations, and the continued use of botnets and distributed denial of service (DDoS) attack techniques.
“Cybercriminals are increasingly using AI-enabled attacks to enhance the efficiency and magnitude of their operations. They leverage AI and machine learning to automate the creation of phishing emails and other types of social engineering,” said David Mugonyi, the director-general of the CA.
A system attack is an attempt to disable computers, steal data, or use a compromised computer system to launch further attacks.
