Cyber security is everyone’s responsibility

As increased digitalisation brings more aspects of daily life into cyberspace, the information people share online can leave them increasingly vulnerable to unauthorised access, loss, disclosure and misuse.

The Namibia Cyber Security Incident Response Team (NAM-CSIRT), housed at the Communications Regulatory Authority of Namibia (CRAN), says cyber security and data protection are a shared responsibility.

Individual users have an important role to play, both in protecting their own information and in avoiding actions that could deepen the harm when someone else’s information is leaked.

“Cyber security and data protection must be treated as an ongoing responsibility, not merely as a response after an incident has occurred,” said Mufaro Nesongano, CRAN’s executive for communication and consumer relations.

For the public, that responsibility begins with simple everyday digital habits. CRAN advises individuals to think carefully before sharing personal information online, be cautious when opening unfamiliar links or attachments, use strong and unique passwords, and enable multi-factor authentication where it is available.

Suspicious activity should also be reported promptly to the relevant service provider, institution or authority.

These precautions matter because cyber threats do not affect systems alone. They can also expose the people whose information is stored within those systems.

A data breach can leave individuals vulnerable to unwanted contact, intimidation, distress, reputational harm and other adverse consequences.

A second wave of harm

NAM-CSIRT has also raised concern about what happens after personal information has been stolen or leaked.

The team has noted an emerging trend of people accessing, studying and analysing leaked data, sometimes for publication and sometimes in ways that could improperly target or intimidate those whose information has been exposed.

The fact that information has appeared online following a cyber attack does not make it appropriate to circulate or scrutinise, Nesongano said.

For people whose details have been leaked, every additional share, repost, analysis or publication can intensify the damage caused by the original breach. What began as a single cyber incident can become a prolonged experience of vulnerability.

“Cyber incidents should not create a second wave of victimisation,” Nesongano said.

NAM-CSIRT has urged members of the public, media practitioners and digital publishers to approach leaked, allegedly leaked or unlawfully obtained information with care.

Reporting on cyber incidents and matters of legitimate public interest remains important. However, actively using, exploiting or further disseminating personal information can raise serious ethical, privacy and legal concerns, particularly where it causes additional harm to those affected.

Think before you share

Responsible handling of exposed information means resisting the temptation to click, download, investigate or share material simply because it has become available online.

Where leaked or allegedly leaked information is encountered, care should be taken to verify its authenticity, limit further disclosure and redact personal or sensitive details.

Personal identifiers, credentials, contact details and internal documents should not be published. Where appropriate, information should instead be referred to the relevant authorities or affected institutions.

The approach recognises that people whose information has been exposed are victims of a cyber incident. They should not face a further loss of dignity, security or privacy because others choose to circulate or exploit data that was unlawfully obtained.