NCSA Rwanda: MTN, Airtel Partner on Cybersecurity Training

• The National Cyber Security Authority (NCSA) partnered with MTN Rwanda and Airtel Rwanda to enhance cybersecurity skills and career opportunities for CyberHub students.
• The agreements, signed in Kigali, aim to prepare professionals against threats like network intrusions and mobile money scams.
• RURA emphasized that protecting telecom infrastructure is a national priority, urging companies to move from cybersecurity assessments to proactive implementation.
• Telecom operators are advised to invest in network redundancy, alternative fiber routes, backup power, and disaster recovery for enhanced reliability.
• Industry leaders and experts stressed the importance of interconnected defense, faster information sharing, and integrating security into product development, alongside focusing on recovery strategies.

He stressed that cybersecurity must transcend being solely an IT responsibility, instead becoming a priority at the management, economic, and financial levels.

The National Cyber Security Authority (NCSA) in Rwanda has formalized partnerships with major telecommunications providers, MTN Rwanda and Airtel Rwanda, through the signing of Memoranda of Understanding (MoUs). These agreements, executed in Kigali on October 22, are designed to bolster the nation's cybersecurity capabilities by offering training, internships, and career pathways for students and graduates from the CyberHub program. The initiative specifically targets the growing need for skilled professionals to combat prevalent threats such as network intrusions, SIM-swap fraud, and mobile money scams within the telecommunications sector.

The signing ceremony concluded a significant workshop focused on enhancing the security of Rwanda's telecommunications and internet infrastructure. David Kanamugire, CEO of the NCSA, commended the commitment demonstrated by telecom companies and internet service providers (ISPs) toward cultivating cyber resilience. He emphasized that embedding cybersecurity into the organizational culture is crucial for achieving a state of normalized resilience.

Evariste Rugigana, Director General of the Rwanda Utilities Regulatory Authority (RURA), underscored the critical role of telecom networks in supporting essential national services, including banking, education, healthcare, and government operations. He asserted that safeguarding this connectivity infrastructure is not merely an option but a national imperative. RURA, in collaboration with the NCSA, has conducted comprehensive cybersecurity audits of telecom companies and ISPs, subsequently sharing the findings with the respective entities.

Rugigana clarified that RURA's role is advisory, placing the onus on companies to actively implement necessary security measures. He stressed that cybersecurity must transcend being solely an IT responsibility, instead becoming a priority at the management, economic, and financial levels. Furthermore, he urged operators to transition from merely assessing risks to actively implementing robust solutions, advocating for investments in network redundancy, alternative fiber routes, backup power systems, and disaster recovery plans to ensure network reliability during disruptions.

The workshop also featured a panel discussion that brought together representatives from RURA, Broadband Systems Corporation, MTN Rwanda, and Airtel Rwanda to deliberate on strengthening cyber resilience across the telecommunications and ISP sectors. Panelists highlighted the increasing sophistication of cyber threats and the imperative for faster information sharing among operators, regulators, and the NCSA when security incidents occur.

Sujay Chakrabarti, CEO of Airtel Rwanda, noted the interconnected nature of fraud and cyber threats, necessitating enhanced cooperation among operators. He advocated for a unified defense strategy, urging companies to share threat intelligence, emerging fraud patterns, and security alerts, and to involve regulators promptly when new threats surface. Monzer Ali, CEO of MTN Rwanda, detailed his company's strategic shift from integrating security as an afterthought to embedding it directly into product development and operational processes. He affirmed that security is a fundamental requirement, given the profound trust customers place in telecom companies with their financial data, personal information, and communications.

Guest speaker Sarah Zheng from University College London's Dawes Centre for Future Crime presented research indicating that employee training alone cannot fully mitigate cybersecurity risks. She cited studies suggesting that between five and twenty percent of employees might still click on phishing links despite receiving training. An early study involving 144 staff and students showed that while approximately two-thirds received conventional training, 15 of them clicked a simulated phishing link. In contrast, a group trained to adopt an attacker's mindset saw only two clicks. Zheng emphasized the need for further research and highlighted the critical importance of focusing equally on recovery strategies, advising organizations against blaming employees who inadvertently fall victim to phishing attempts.

Compliance officers and legal counsel for telecommunications companies and ISPs in Rwanda should note the increased regulatory focus from NCSA and RURA on proactive cybersecurity implementation, not just assessments. This partnership signals an expectation for greater investment in network redundancy, disaster recovery, and information sharing, necessitating a review of current compliance frameworks and operational resilience strategies to avoid potential regulatory scrutiny or liabilities.

Source: Original reporting via The New Times