- skunkworks - Skunkworks Site

Flash Disks required Urgently .
by Emmanuel 22 Jul '15

22 Jul '15

Hi Send quote for below to info(a)veltext.com 1) 200 Flash disks of 16 GB ( only wholesale price please) 2) One i3 Desktop computer for a school use. CPU monitor , mouse and keyboard 3) Printer that can be used with same Machine Regards, *Emmanuel*

1 0

PC maintenace
by Emmanuel 22 Jul '15

22 Jul '15

Hi Any intern looking for some quick pocket money please call this number and go maintain their office PC 0701948722 Regards, *Emmanuel Macharia*

1 1

Request for Quotation for Server and Zimbra Mail Server
by James Kagwe 22 Jul '15

22 Jul '15

Skunks, I need someone to quickly supply a server and setup Zimbra as per the attached specifications. Kindly send me a quote directly to this address. I will revert to the competitive quote with further details. For ease of system implementation, I would prefer that both are supplied by the same vendor. Kindly pay attention to the server and Zimbra specifications including license requirements. regards, James Kagwe

3 3

Re: [Skunkworks] Equitel Thin SIMs
by Jared Koyier 21 Jul '15

21 Jul '15

There abt 30m subscribers in Kenya..so 1m is about 3.3%. I have about 1620 contacts on my phonebook.. so ideally 54 of them should be on Equitel prefix. On avarage I do about 30 calls a day..again it means at least one call shud be from an Equitel prefix...unfortunately that's not the case. I highly doubt the numbers being talked about On Jul 21, 2015 12:44 PM, "Alvin Jason Ochieng via skunkworks" < skunkworks(a)lists.my.co.ke> wrote: Airtel also have several Prefixes but are they even half full? #MarketingStartegies On Tue, Jul 21, 2015 at 12:26 PM, Tony Likhanga via skunkworks < skunkworks(a)lists.my.co.ke> wrote: > > *2015-07-21 10:05 GMT+03:00 Njiri John via skunkworks > <skunkworks(a)lists.my.co.ke <skunkworks(a)lists.my.co.ke>>:* >> >> >> >> *Equitel have unveiled a new 0764 prefix after hitting one million >> customers on the previous 0763 prefix.* >> >> >> *1,000,000 X 600= KES 600,000,000* >> *Mwangi should be a professor by now.. you are told its free to transact >> but already made 600m just from sim change over.* >> > > Hype aside, remember they've also had for a while, the *'normal SIM'* > that goes for free (or market-rates at most). That possibly forms the bulk > of their current subscribers. > > Tony. > > _______________________________________________ > skunkworks mailing list > skunkworks(a)lists.my.co.ke > ------------ > List info, subscribe/unsubscribe > http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks > ------------ > > Skunkworks Rules > http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 > ------------ > Other services @ http://my.co.ke > -- ALVIN OCHOLA 0722-313923 www.greenline.co.ke _______________________________________________ skunkworks mailing list skunkworks(a)lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------ Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke

9 15

Re: [Skunkworks] Equitel Thin SIMs
by Hosea Kandie 21 Jul '15

21 Jul '15

The convenience with it is unimaginable. The disruption of money transfer in KE, EA, Africa and world-wide is evident. The talk so far about it is securing the technology. Consider Kenyans and 'Peculiar habits'. PICNIC(T) mistakes are bound to be around for a while, even among the tech-savvy. I would also be really worried about challenges brought in by users and insider threats. -- Kind regards Hosea Kandie Mobile:0726798903 in: https://ke.linkedin.com/in/zeddarn twitter: https://twitter.com/zeddarn

2 1

Re: [Skunkworks] [Security Forum] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Grace Mutung'u (Bomu) 21 Jul '15

21 Jul '15

Thank you everyone for the enriching contributions.Without cybersecurity, users cannot be assured when transacting online. A special mention to the security experts who have interesting and practical views to the cybersecurity issues. We may need to seek more information from those in bodies such as ICTA, from experts who helped to set up the systems as well as from private sector. Would be interesting to hear how banks achieve security, especially with Internet and mobile banking. The issue of mobile money payments will be part of our discussion tomorrow as we tackle "the Internet Economy". The discussions on all the topics remain open so please continue on. We shall pick all the recommendations and suggestions and present them to stakeholders during the IGF. Hopefully, some of them will find their way into policy and use in our institutions. Once again thank you. Regards, Grace 2015-07-21 18:11 GMT+03:00 Lesley Leposo via Security < security(a)lists.my.co.ke>: > @fredrick > Good point. > I can see why they would use open source software, other than it being > free. > But, my point of view only makes sense if the GOK, businesses and > universities also fostered/sponsored some (moderately) experienced COMODO > tinkerers/hackers. > > On Jul 21, 2015, at 5:55 PM, fredrick Wahome via Security < > security(a)lists.my.co.ke> wrote: > > This far we can say they have tried but one thing I don't understand with > government system is the implementation. Is it that hard or their is some > laxity. With PKI in place most departments are still using FREE systems > like COMODO. But again as a loyal citizen I stopped complaining and just > doing the bit I can even if its sharing information.. > On Jul 21, 2015 5:29 PM, "Mwendwa Kivuva via Security" < > security(a)lists.my.co.ke> wrote: > >> Sorry, here is the website for the Certifying Authority for Kenya's PKI >> http://www.govca.go.ke/# >> >> ______________________ >> Mwendwa Kivuva, Nairobi, Kenya >> >> "There are some men who lift the age they inhabit, till all men walk on >> higher ground in that lifetime." - Maxwell Anderson >> >> >> On 21 July 2015 at 16:56, Mwendwa Kivuva <Kivuva(a)transworldafrica.com> >> wrote: >> >>> Hosea Kandie and Fredick Wahome have raised very important points of >>> institutional frameworks. I just wanted to share the National PKI website >>> which has a tonne of information on what Kenya has done in that regard. >>> http://www.ke-cirt.go.ke/index.php/services/national-pki/ >>> >>> Here is a copy paste from the home page: >>> >>> Kenya’s National Public Key Infrastructure (NPKI) >>> >>> The National Public Key Infrastructure (NPKI) project is coordinated by >>> the Ministry of ICT in collaboration with the Communications Authority of >>> Kenya (CA) and the ICT Authority (ICTA). >>> >>> A Public Key Infrastructure (PKI) refers to a system for the creation, >>> storage and distribution of digital certificates which are used to verify >>> that a particular public key (online identity) belongs to a certain entity. >>> A PKI is a technical infrastructure that comprises of a Root Certification >>> Authority (RCA) and a Certification Authority (CA), referred to as an >>> Electronic Certification Service Provider (E-CSP) in Kenya’s legal and >>> regulatory framework. The PKI creates a framework for protecting >>> communications and stored information from unauthorized access and >>> disclosure by addressing the fundamentals of cyber security – >>> confidentiality, integrity, authentication and non-repudiation. A PKI is >>> key to the rollout of e-transaction services. >>> >>> The Kenya Information and Communications Act, 1998, mandates the >>> Communications Authority of Kenya (CA) to issue a license to a person >>> operating an Electronic Certification Service. In this regard, the >>> Communications Authority of Kenya (CA) has developed a licensing framework >>> for Electronic Certification Service Providers (E-CSPs). >>> >>> Kenya’s National PKI comprises of a Root Certification Authority (RCA), >>> which is managed by the Communication Authority of Kenya (CA) as a >>> regulatory function, and the Government Certification Authority (GCA), an >>> E-CSP which is managed by the ICTA. The NPKI is instrumental towards the >>> effectiveness of the licensing of Electronic Certification Service >>> Providers (E-CSPs) by the Communications Authority since a licensed E-CSP >>> must be accredited by the RCA for its digital certificates to be globally >>> recognized and trusted. >>> >>> The ICT Authority (ICTA), which is the body responsible for the >>> management of the mainstream government ICT services, operates the GCA. >>> Other interested stakeholders who may be issued with an E-CSP license on >>> application include the banking Sector and the Academia. >>> >>> The benefits of a National PKI include: >>> i. Locally available and cheaper digital certificates/signatures; and >>> ii. Operations and services that are within Kenyan law >>> (jurisdiction), among others. >>> >>> ______________________ >>> Mwendwa Kivuva, Nairobi, Kenya >>> >>> "There are some men who lift the age they inhabit, till all men walk on >>> higher ground in that lifetime." - Maxwell Anderson >>> >>> >>> On 21 July 2015 at 11:02, fredrick Wahome via Security < >>> security(a)lists.my.co.ke> wrote: >>> >>>> The fact that there is high internet penetration in Africa / Kenya >>>> where an average of one user for every five has access to affordable >>>> internet has created enabling environment for cyber-criminals. >>>> >>>> By the nature of cyberspace where the perpetrators of cyber-crime >>>> remain ubiquitous. This necessitated a need for legislation to control >>>> crime, and to provide confidence and security in African cyberspace, >>>> leading to the drafting of the Africa Union Convention on Cybersecurity >>>> (AUCC). But some groups like CIPIT and civil society opposed the convention >>>> on the ground that it was prepared without their inputs. Their main >>>> argument is that the convention did not make enough provisions to protect >>>> privacy and freedom of speech. >>>> >>>> Member States have to undertake necessary measures to encourage >>>> the establishment of institutions that exchange information on cyber >>>> threats and the evaluation of vulnerabilities such as Computer >>>> Emergency Response Team (CERT). Kenya has at least done something on this >>>> by establishing KE-CIRT at CA. There is also a masterplan and PKI in place >>>> thou there has been implementation challenges. We will note that most >>>> governments departments have not yet established cybersecurity departments >>>> and this leads to low / lack of budgetary allocation. >>>> >>>> In summary Government bodies, policy networks, scholars, the media, >>>> technology experts and the people need to engage in a global conversation >>>> that will help demystify Cyber-crime and define what it constitutes of and >>>> how Cyber-criminals should be dealt with. >>>> >>>> The role of the media (television, blogs, online news outlets and more) >>>> is critical in the process of educating the public and engaging in a >>>> conversation, as they will be the mediators and curators of information and >>>> discourse on the issue. Thus, a concise and sensible approach, devoid of >>>> fear-mongering and shock practices, should be followed. We all remember >>>> recently how media has mishandled cyber crime news without a very somber >>>> deep analysis >>>> >>>> Since this is an international issue, governments and policy networks >>>> across the world have to come together and discuss openly on what is better >>>> for their citizens. Something like AUCC is a positive move by African states >>>> >>>> Scholars and academics can provide valuable expertise on technological, >>>> psychological, ethical and other issues, while highlighting any misgivings >>>> by those involved in the process. At least Strathmore has tried on this >>>> >>>> The people in their local communities, families and social networks >>>> should help and train each other to increase their peers’ level of Internet >>>> literacy and highlight the advantages of the web. A higher Internet >>>> literacy level can help people protect themselves even better by taking >>>> simple security measures, such as using anti-virus software and identifying >>>> potential risks or scams in their online financial transactions. More is >>>> needed from the technology community to provide awareness to end users even >>>> if through probono program. >>>> >>>> The technology community needs a unity of purpose. Looking at >>>> programmers / developers, DBA, network admins, infosec there has been lack >>>> of proper coordination. Developers are working hard to prove that their >>>> products cant be broken. Infosec on the other hand are working so hard to >>>> prove to blue team / developers that they can break their products. At the >>>> end no one benefit from such a contest. Many technical conferences / >>>> seminars should be encouraged to enable sharing of information / knowledge >>>> in the local technology community. >>>> >>>> Great day comrades. >>>> >>>> >>>> >>>> >>>> >>>> >>>> On Tue, Jul 21, 2015 at 9:28 AM, Stephen Munguti via Security < >>>> security(a)lists.my.co.ke> wrote: >>>> >>>>> Hello all, >>>>> >>>>> I think most of our security concerns stem from internal users and >>>>> this is the reason many banks and telecos refuse to part with this >>>>> information, i could be wrong though >>>>> >>>>> On Tue, Jul 21, 2015 at 8:58 AM, Grace Mutung'u (Bomu) via skunkworks >>>>> <skunkworks(a)lists.my.co.ke> wrote: >>>>> >>>>>> Dear Listers, >>>>>> >>>>>> >>>>>> Kenya has had its fair share of high profile cyber threats, hacking >>>>>> etc, the latest being the alleged compromise of the IFMIS system at >>>>>> NYS/Ministry of Devolution. The country and Africa at large is making >>>>>> efforts to assure cyber-security. These include among others her >>>>>> involvement in the Africa Union Convention on Cybercrime and a proposal for >>>>>> a Cybercrime law, an initiative led by the Office of the Director of Public >>>>>> Prosecutions. Significant financial resources have also been earmarked by >>>>>> government for security and cyber security in particular. There are also >>>>>> partnerships between government and private sector in deploying >>>>>> cybersecurity centres. >>>>>> >>>>>> The private sector has employed practical measures to protect their >>>>>> businesses. However, businesses such as mobile money providers and banks >>>>>> have been shy to divulge their cyber security concerns to protect their >>>>>> interests. >>>>>> >>>>>> Civil society on the other hand has raised concern about the line >>>>>> between protecting the cyber space and creating a facilitative environment >>>>>> for innovators as well as protecting the rights of users. >>>>>> >>>>>> >>>>>> Are our efforts at deterring cyber-crime the correct way to assure >>>>>> cyber security? Are fears about a partnership between government and >>>>>> private sector and the general fears about stifling innovation and human >>>>>> rights in the name of cybersecurity legitimate? Are there other practical >>>>>> approaches that different stakeholders can take to enhance cyber security? >>>>>> >>>>>> >>>>>> Over to you. >>>>>> >>>>>> -- >>>>>> Grace L.N. Mutung'u >>>>>> Nairobi Kenya >>>>>> Skype: gracebomu >>>>>> Twitter: @Bomu >>>>>> >>>>>> <http://www.diplointernetgovernance.org/profile/GraceMutungu> >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> skunkworks mailing list >>>>>> skunkworks(a)lists.my.co.ke >>>>>> ------------ >>>>>> List info, subscribe/unsubscribe >>>>>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks >>>>>> ------------ >>>>>> >>>>>> Skunkworks Rules >>>>>> http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 >>>>>> ------------ >>>>>> Other services @ http://my.co.ke >>>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> >>>>> Best Regards, >>>>> Stephen Munguti. >>>>> >>>>> +254720425104 >>>>> >>>>> _______________________________________________ >>>>> Security mailing list >>>>> Security(a)lists.my.co.ke >>>>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>>>> >>>> >>>> >>>> >>>> -- >>>> >>>> >>>> >>>> >>>> *-------------------------------------* >>>> *Kind Regards**;* >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> *Fredrick Wahome Ndung'uTeam LeaderSecunets Technologies LtdWebsite: >>>> www.secunets.com <http://www.secunets.com/>Cell: +254725264890 >>>> <%2B254725264890>Email: fred(a)secunets.com <fred(a)secunets.com>**Facebook: >>>> secunetstech* >>>> *Twitter: @secunets* >>>> >>>> *Skype: secunets.technologiesExperts in: *Domain Registration, Web >>>> Hosting, Open Source Solutions, Information Security & Training, Digital >>>> Forensic Investigations, Web 2.0 Applications & I.C.T Consultancy. >>>> >>>> *"Secure Business Technology"* >>>> >>>> >>>> >>>> ------------------------------------------------------------------------------------------------------------------------------------------------ >>>> *SECUNETS TECHNOLOGIES DISCLAIMER:* >>>> >>>> This email message and any file(s) transmitted with it is intended >>>> solely for the individual or entity to whom it is addressed and may contain >>>> confidential and/or legally privileged information which confidentiality >>>> and/or privilege is not lost or waived by reason of mistaken transmission. >>>> If you have received this message by error you are not authorized to view >>>> disseminate distribute or copy the message without the written consent of >>>> Secunets Technologies and are requested to contact the sender by telephone >>>> or e-mail and destroy the original. Although Secunets Technologies takes >>>> all reasonable precautions to ensure that this message and any file >>>> transmitted with it is virus free, Secunets Technologies accepts no >>>> liability for any damage that may be caused by any virus transmitted by >>>> this email. >>>> >>>> >>>> _______________________________________________ >>>> Security mailing list >>>> Security(a)lists.my.co.ke >>>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>>> >>> >>> >> >> _______________________________________________ >> Security mailing list >> Security(a)lists.my.co.ke >> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >> > _______________________________________________ > Security mailing list > Security(a)lists.my.co.ke > http://lists.my.co.ke/cgi-bin/mailman/listinfo/security > > > > _______________________________________________ > Security mailing list > Security(a)lists.my.co.ke > http://lists.my.co.ke/cgi-bin/mailman/listinfo/security > -- Grace L.N. Mutung'u Nairobi Kenya Skype: gracebomu Twitter: @Bomu <http://www.diplointernetgovernance.org/profile/GraceMutungu>

1 0

Re: [Skunkworks] [Security Forum] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Mwendwa Kivuva 21 Jul '15

21 Jul '15

On 21 July 2015 at 18:11, Lesley Leposo via Security < security(a)lists.my.co.ke> wrote: > I can see why they would use open source software, other than it being > free. > But, my point of view only makes sense if the GOK, businesses and > universities also fostered/sponsored some (moderately) experienced COMODO > tinkerers/hackers. > But surely, why should we use some free or open initiatives like COMODO while we dished out more than $8M of taxpayers money on the National PKI? Is there a problem somewhere? Or this are just allegations On another note, is it possible for somebody in a position of authority, say CA or ICTA to be so kind as to share the implementation status of the National PKI with the community? ______________________ Mwendwa Kivuva, Nairobi, Kenya "There are some men who lift the age they inhabit, till all men walk on higher ground in that lifetime." - Maxwell Anderson

1 0

Drupal developer permanent job
by Tom Musau 21 Jul '15

21 Jul '15

Hi Skunks, Am still looking for drupal CMS developer, anyone interested can email offlst. Python interviews to be conducted in a weeks time, anyone interested to contact me. Kind Regards Tom

1 0

Re: [Skunkworks] [Security Forum] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Mwendwa Kivuva 21 Jul '15

21 Jul '15

Hosea Kandie and Fredick Wahome have raised very important points of institutional frameworks. I just wanted to share the National PKI website which has a tonne of information on what Kenya has done in that regard. http://www.ke-cirt.go.ke/index.php/services/national-pki/ Here is a copy paste from the home page: Kenya’s National Public Key Infrastructure (NPKI) The National Public Key Infrastructure (NPKI) project is coordinated by the Ministry of ICT in collaboration with the Communications Authority of Kenya (CA) and the ICT Authority (ICTA). A Public Key Infrastructure (PKI) refers to a system for the creation, storage and distribution of digital certificates which are used to verify that a particular public key (online identity) belongs to a certain entity. A PKI is a technical infrastructure that comprises of a Root Certification Authority (RCA) and a Certification Authority (CA), referred to as an Electronic Certification Service Provider (E-CSP) in Kenya’s legal and regulatory framework. The PKI creates a framework for protecting communications and stored information from unauthorized access and disclosure by addressing the fundamentals of cyber security – confidentiality, integrity, authentication and non-repudiation. A PKI is key to the rollout of e-transaction services. The Kenya Information and Communications Act, 1998, mandates the Communications Authority of Kenya (CA) to issue a license to a person operating an Electronic Certification Service. In this regard, the Communications Authority of Kenya (CA) has developed a licensing framework for Electronic Certification Service Providers (E-CSPs). Kenya’s National PKI comprises of a Root Certification Authority (RCA), which is managed by the Communication Authority of Kenya (CA) as a regulatory function, and the Government Certification Authority (GCA), an E-CSP which is managed by the ICTA. The NPKI is instrumental towards the effectiveness of the licensing of Electronic Certification Service Providers (E-CSPs) by the Communications Authority since a licensed E-CSP must be accredited by the RCA for its digital certificates to be globally recognized and trusted. The ICT Authority (ICTA), which is the body responsible for the management of the mainstream government ICT services, operates the GCA. Other interested stakeholders who may be issued with an E-CSP license on application include the banking Sector and the Academia. The benefits of a National PKI include: i. Locally available and cheaper digital certificates/signatures; and ii. Operations and services that are within Kenyan law (jurisdiction), among others. ______________________ Mwendwa Kivuva, Nairobi, Kenya "There are some men who lift the age they inhabit, till all men walk on higher ground in that lifetime." - Maxwell Anderson On 21 July 2015 at 11:02, fredrick Wahome via Security < security(a)lists.my.co.ke> wrote: > The fact that there is high internet penetration in Africa / Kenya where > an average of one user for every five has access to affordable internet has > created enabling environment for cyber-criminals. > > By the nature of cyberspace where the perpetrators of cyber-crime remain > ubiquitous. This necessitated a need for legislation to control crime, and > to provide confidence and security in African cyberspace, leading to the > drafting of the Africa Union Convention on Cybersecurity (AUCC). But some > groups like CIPIT and civil society opposed the convention on the ground > that it was prepared without their inputs. Their main argument is that the > convention did not make enough provisions to protect privacy and freedom of > speech. > > Member States have to undertake necessary measures to encourage the > establishment of institutions that exchange information on cyber > threats and the evaluation of vulnerabilities such as Computer > Emergency Response Team (CERT). Kenya has at least done something on this > by establishing KE-CIRT at CA. There is also a masterplan and PKI in place > thou there has been implementation challenges. We will note that most > governments departments have not yet established cybersecurity departments > and this leads to low / lack of budgetary allocation. > > In summary Government bodies, policy networks, scholars, the media, > technology experts and the people need to engage in a global conversation > that will help demystify Cyber-crime and define what it constitutes of and > how Cyber-criminals should be dealt with. > > The role of the media (television, blogs, online news outlets and more) is > critical in the process of educating the public and engaging in a > conversation, as they will be the mediators and curators of information and > discourse on the issue. Thus, a concise and sensible approach, devoid of > fear-mongering and shock practices, should be followed. We all remember > recently how media has mishandled cyber crime news without a very somber > deep analysis > > Since this is an international issue, governments and policy networks > across the world have to come together and discuss openly on what is better > for their citizens. Something like AUCC is a positive move by African states > > Scholars and academics can provide valuable expertise on technological, > psychological, ethical and other issues, while highlighting any misgivings > by those involved in the process. At least Strathmore has tried on this > > The people in their local communities, families and social networks should > help and train each other to increase their peers’ level of Internet > literacy and highlight the advantages of the web. A higher Internet > literacy level can help people protect themselves even better by taking > simple security measures, such as using anti-virus software and identifying > potential risks or scams in their online financial transactions. More is > needed from the technology community to provide awareness to end users even > if through probono program. > > The technology community needs a unity of purpose. Looking at programmers > / developers, DBA, network admins, infosec there has been lack of proper > coordination. Developers are working hard to prove that their products cant > be broken. Infosec on the other hand are working so hard to prove to blue > team / developers that they can break their products. At the end no one > benefit from such a contest. Many technical conferences / seminars should > be encouraged to enable sharing of information / knowledge in the local > technology community. > > Great day comrades. > > > > > > > On Tue, Jul 21, 2015 at 9:28 AM, Stephen Munguti via Security < > security(a)lists.my.co.ke> wrote: > >> Hello all, >> >> I think most of our security concerns stem from internal users and this >> is the reason many banks and telecos refuse to part with this information, >> i could be wrong though >> >> On Tue, Jul 21, 2015 at 8:58 AM, Grace Mutung'u (Bomu) via skunkworks < >> skunkworks(a)lists.my.co.ke> wrote: >> >>> Dear Listers, >>> >>> >>> Kenya has had its fair share of high profile cyber threats, hacking etc, >>> the latest being the alleged compromise of the IFMIS system at NYS/Ministry >>> of Devolution. The country and Africa at large is making efforts to assure >>> cyber-security. These include among others her involvement in the Africa >>> Union Convention on Cybercrime and a proposal for a Cybercrime law, an >>> initiative led by the Office of the Director of Public Prosecutions. >>> Significant financial resources have also been earmarked by government for >>> security and cyber security in particular. There are also partnerships >>> between government and private sector in deploying cybersecurity centres. >>> >>> The private sector has employed practical measures to protect their >>> businesses. However, businesses such as mobile money providers and banks >>> have been shy to divulge their cyber security concerns to protect their >>> interests. >>> >>> Civil society on the other hand has raised concern about the line >>> between protecting the cyber space and creating a facilitative environment >>> for innovators as well as protecting the rights of users. >>> >>> >>> >>> Are our efforts at deterring cyber-crime the correct way to assure cyber >>> security? Are fears about a partnership between government and private >>> sector and the general fears about stifling innovation and human rights in >>> the name of cybersecurity legitimate? Are there other practical approaches >>> that different stakeholders can take to enhance cyber security? >>> >>> >>> Over to you. >>> >>> -- >>> Grace L.N. Mutung'u >>> Nairobi Kenya >>> Skype: gracebomu >>> Twitter: @Bomu >>> >>> <http://www.diplointernetgovernance.org/profile/GraceMutungu> >>> >>> >>> _______________________________________________ >>> skunkworks mailing list >>> skunkworks(a)lists.my.co.ke >>> ------------ >>> List info, subscribe/unsubscribe >>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks >>> ------------ >>> >>> Skunkworks Rules >>> http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 >>> ------------ >>> Other services @ http://my.co.ke >>> >> >> >> >> -- >> >> Best Regards, >> Stephen Munguti. >> >> +254720425104 >> >> _______________________________________________ >> Security mailing list >> Security(a)lists.my.co.ke >> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >> > > > > -- > > > > > *-------------------------------------* > *Kind Regards**;* > > > > > > > > *Fredrick Wahome Ndung'uTeam LeaderSecunets Technologies LtdWebsite: > www.secunets.com <http://www.secunets.com>Cell: +254725264890Email: > fred(a)secunets.com <fred(a)secunets.com>**Facebook: secunetstech* > *Twitter: @secunets* > > *Skype: secunets.technologiesExperts in: *Domain Registration, Web Hosting > , Open Source Solutions, Information Security & Training, Digital > Forensic Investigations, Web 2.0 Applications & I.C.T Consultancy. > > *"Secure Business Technology"* > > > > ------------------------------------------------------------------------------------------------------------------------------------------------ > *SECUNETS TECHNOLOGIES DISCLAIMER:* > > This email message and any file(s) transmitted with it is intended solely > for the individual or entity to whom it is addressed and may contain > confidential and/or legally privileged information which confidentiality > and/or privilege is not lost or waived by reason of mistaken transmission. > If you have received this message by error you are not authorized to view > disseminate distribute or copy the message without the written consent of > Secunets Technologies and are requested to contact the sender by telephone > or e-mail and destroy the original. Although Secunets Technologies takes > all reasonable precautions to ensure that this message and any file > transmitted with it is virus free, Secunets Technologies accepts no > liability for any damage that may be caused by any virus transmitted by > this email. > > > _______________________________________________ > Security mailing list > Security(a)lists.my.co.ke > http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >

1 1

Re: [Skunkworks] [Security Forum] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Grace Mutung'u (Bomu) 21 Jul '15

21 Jul '15

Very interesting turn the discussion has taken. Understandably, Equitel is something to watch as it could disrupt the market. many hope it will. Are techies here telling us that the security of using Equitel SIM cannot be guaranteed unless there are strict internal controls? Does this mean we already need laws for what is quite a novel application in Kenya? And how does ethics as mentioned by Jaco come in here if at all? 2015-07-21 16:17 GMT+03:00 Lesley Leposo via Security < security(a)lists.my.co.ke>: > Cool Steve. > > Now from a policy and regulation standpoint, the fundamental isssue (by > far) is that…. > > A *proprietary* technology is being deployed by a public utility/service. > > There are always major risks with going “proprietary” vs. > standardized/open/open-source. > > > On Jul 21, 2015, at 4:11 PM, Stephen Munguti <kamitu.sm(a)gmail.com> wrote: > > @ fredrick, > > I don't think the issue is with Equitel (given that they have normal sim > cards in use), I think the issue is the thin sim > > @lesley > > noted > > On Tue, Jul 21, 2015 at 3:52 PM, fredrick Wahome <frewah85(a)gmail.com> > wrote: > >> They would not have prevented thin SIM adoption but they would have >> played some politics using science. For now lets hope that Mwangi is going >> to disrupt this market and deliver us from monopolization. >> >> On Tue, Jul 21, 2015 at 3:36 PM, Stephen Munguti via Security < >> security(a)lists.my.co.ke> wrote: >> >>> @lesley, >>> >>> The key issue is the data exchange between the Safaricom SIM card and >>> the phone (this has nothing to do with the Safaricom Servers), bearing in >>> mind that there exists a third party between the Safaricom SIM and the >>> Phone >>> >>> On Tue, Jul 21, 2015 at 3:28 PM, Lesley Leposo <leposo(a)unoasystems.com> >>> wrote: >>> >>>> Everyone is griping about the keys (i.e. triplets and session keys >>>> derived from that). >>>> I think someone needs to be very specific about the security threat >>>> involved here and both players aren’t revealing much. >>>> >>>> IMHO, there are at least 3 areas where security threats can emerge: >>>> >>>> 1) Normally EAP-SIM would be used to authenticate the client/phone vs. >>>> the telco server (Safaricom in this case). >>>> The valuable information in this case would be the SIM triplets (and >>>> derived session key). Hence, this baseline EAP-SIM needs to be protected >>>> (Safaricom knows how this is done). >>>> If it isn’t, then we already have a problem that’s not due to thin-siim. >>>> >>>> 2) For the thin-sim, another EAP-SIM negotiation between the >>>> client/phone vs. the overlay sever (Equity in this case). >>>> The valuable information again would be the thin-SIM triplets (and >>>> derived session key). Hence this overlay EAP-SIM needs to be protected in a >>>> manner that Safaricom can’t even see it… this is totally in the domain of >>>> how Equity has designed their network and their provisioning. (e.g. by >>>> encrypted negotiation & tunnelling directly between the client/phone and >>>> the Equity server). >>>> >>>> 3) For the handsets, they would have to make sure that the telco >>>> applications can’t snoop or inject traffic/data into each other’s walled >>>> garden - there are 2 walled gardens in this case. The walled garden >>>> includes the sim triplets (and derived session key) along with each telco >>>> network routes, policies, arp-cache and tcp/ip connections. There exists a >>>> possibility of threats due to backwards incompatibility (with phones that >>>> can’t fully manage these walled gardens). Perhaps this is what Safaricom is >>>> complaining about? >>>> >>>> On Jul 21, 2015, at 2:20 PM, Mwendwa Kivuva via Security < >>>> security(a)lists.my.co.ke> wrote: >>>> >>>> >>>> > @mwendwa, >>>> > >>>> > Its possible for the owner of the network of the thin sim to be privy >>>> to information that only the host network sim should be having. It all >>>> comes back to someone internal at Equitel having the proper technical >>>> skills and motivation to use the same >>>> >>>> Stephen, >>>> Then we have a major problem right there. I would not like Safaricom to >>>> disown any responsibility on their part when my security is compromised >>>> because I used thin sim. Therefore any security conscious users would not >>>> dare jeopardize their transactions by using thin sim. The question then is, >>>> how many of us care about their transaction security? >>>> >>>> >>>> >>>> >> >>>> >> On Tue, Jul 21, 2015 at 1:52 PM, Mwendwa Kivuva via skunkworks < >>>> skunkworks(a)lists.my.co.ke> wrote: >>>> >>> >>>> >>> Then the trending issue of the day. Equitel. Safaricom had taken >>>> Equity to court and sounded a big warning on the use of thin sim. >>>> http://www.businessdailyafrica.com/Corporate-News/Safaricom-sounds-warning-… >>>> >>> >>>> >>> London-based GSMA, the global association of telecoms operators >>>> using the GSM technology, wrote to the Kenyan authorities warning of the >>>> risks that use of the slim SIM cards pose to the integrity of the mobile >>>> telecommunications platforms.The GSMA said the overlay SIM (which is >>>> embedded between a normal SIM card and the device) has the potential of >>>> harvesting and revealing sensitive data passing the system. >>>> >>> >>>> >>> Of course we all know Safaricom failed miserably in stopping Equity >>>> from progressing with its plans. >>>> >>> >>>> >>> Now the thin sim is here, and Equitel has said it will encrypt all >>>> data to and from the thin sim. Can experts in this area assure us that the >>>> use of thin sims will not affect the integrity of M-Pesa transactions? >>>> >>> >>>> >>> Regards >>>> >>> >>>> >>> >>>> >>> _______________________________________________ >>>> >>> skunkworks mailing list >>>> >>> skunkworks(a)lists.my.co.ke >>>> >>> ------------ >>>> >>> List info, subscribe/unsubscribe >>>> >>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks >>>> >>> ------------ >>>> >>> >>>> >>> Skunkworks Rules >>>> >>> http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 >>>> >>> ------------ >>>> >>> Other services @ http://my.co.ke >>>> >>>> >> >>>> >> >>>> >> >>>> >> >>>> >> -- >>>> >> >>>> >> Best Regards, >>>> >> Stephen Munguti. >>>> >> >>>> >> +254720425104 >>>> > >>>> > >>>> > >>>> > >>>> > -- >>>> > >>>> > Best Regards, >>>> > Stephen Munguti. >>>> > >>>> > +254720425104 >>>> >>>> _______________________________________________ >>>> Security mailing list >>>> Security(a)lists.my.co.ke >>>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>>> >>>> >>>> >>> >>> >>> -- >>> >>> Best Regards, >>> Stephen Munguti. >>> >>> +254720425104 >>> >>> _______________________________________________ >>> Security mailing list >>> Security(a)lists.my.co.ke >>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>> >> >> >> >> -- >> >> >> >> >> *-------------------------------------* >> *Kind Regards**;* >> >> >> >> >> >> >> >> *Fredrick Wahome Ndung'uTeam LeaderSecunets Technologies LtdWebsite: >> www.secunets.com <http://www.secunets.com/>Cell: +254725264890Email: >> fred(a)secunets.com <fred(a)secunets.com>**Facebook: secunetstech* >> *Twitter: @secunets* >> >> *Skype: secunets.technologiesExperts in: *Domain Registration, Web >> Hosting, Open Source Solutions, Information Security & Training, Digital >> Forensic Investigations, Web 2.0 Applications & I.C.T Consultancy. >> >> *"Secure Business Technology"* >> >> >> >> ------------------------------------------------------------------------------------------------------------------------------------------------ >> *SECUNETS TECHNOLOGIES DISCLAIMER:* >> >> This email message and any file(s) transmitted with it is intended solely >> for the individual or entity to whom it is addressed and may contain >> confidential and/or legally privileged information which confidentiality >> and/or privilege is not lost or waived by reason of mistaken transmission. >> If you have received this message by error you are not authorized to view >> disseminate distribute or copy the message without the written consent of >> Secunets Technologies and are requested to contact the sender by telephone >> or e-mail and destroy the original. Although Secunets Technologies takes >> all reasonable precautions to ensure that this message and any file >> transmitted with it is virus free, Secunets Technologies accepts no >> liability for any damage that may be caused by any virus transmitted by >> this email. >> >> > > > -- > > Best Regards, > Stephen Munguti. > > +254720425104 > > > > _______________________________________________ > Security mailing list > Security(a)lists.my.co.ke > http://lists.my.co.ke/cgi-bin/mailman/listinfo/security > -- Grace L.N. Mutung'u Nairobi Kenya Skype: gracebomu Twitter: @Bomu <http://www.diplointernetgovernance.org/profile/GraceMutungu>

2 2