Under cyberattack? +243 82 973 9505 Version française

Resources

Free tools to act today: printable bilingual factsheets, step-by-step guides, regulatory references and a glossary so that we all speak the same language.

Exportable bilingual factsheets

Each factsheet shows French and English side by side on one page. Print it or save it as a PDF to post or share.

Des mots de passe solides Strong passwords FR / EN Déjouer l'hameçonnage Beating phishing FR / EN Des sauvegardes qui sauvent Backups that save you FR / EN Réagir à un incident Responding to an incident FR / EN

Practical guides

The essential steps, in the order to apply them.

  1. Install system and software updates, then switch them to automatic.
  2. Check that the antivirus is active and up to date.
  3. Lock the session with a password and turn on automatic locking after five minutes.
  4. Uninstall unused software.
  5. Encrypt the disk (BitLocker, FileVault) on laptops.
  6. Back up your documents to storage approved by your IT department.

  1. List critical accounts: e-mail, administration, remote access, bank accounts.
  2. Prefer an authenticator app or a hardware key over SMS.
  3. Enable two-factor authentication for administrators first, then for everyone.
  4. Plan a recovery procedure in case a phone is lost.
  5. Tell users before switching it on.

  1. Isolate affected machines from the network without shutting them down.
  2. Alert the crisis team and your incident response provider.
  3. Do not pay any ransom or contact the attackers.
  4. Record every action and its time: this log will help the investigation.
  5. Prepare internal communication, then external communication if personal data is affected.
  6. File a complaint with the competent authorities.

  1. Apply the 3-2-1 rule: three copies, two media, one offline or off-site.
  2. Automate backups and monitor that they complete.
  3. Separate backup administration accounts from the rest of the network.
  4. Test a full restore at least once a quarter.
  5. Document the restore procedure and the order in which services restart.

Standards and regulations

The main frameworks we use to audit our clients and bring them into compliance.

Congolese and African framework

DR Congo Digital CodeOrdinance-law No. 23/010 of 13 March 2023
Governs digital activities and services, electronic documents and signatures, personal data protection and cybercrime.
Telecommunications and ICT ActLaw No. 20/017 of 25 November 2020
Sets the framework for telecommunications networks and services and information technology in the DR Congo.
Malabo ConventionAfrican Union, 2014
AU Convention on Cyber Security and Personal Data Protection, a common reference for African states.

International standards

ISO/IEC 270012022 edition
Requirements for an information security management system (ISMS). Certifiable standard.
ISO/IEC 270022022 edition
Catalogue of security controls and guidance on implementing them.
ISO/IEC 27005Risk management
Method for identifying, analysing and treating information security risks.
ISO 22301Business continuity
Requirements for a business continuity management system.
NIST Cybersecurity FrameworkVersion 2.0
Framework in six functions: govern, identify, protect, detect, respond, recover.

Sector and foreign texts

GDPREuropean Union
Applies as soon as you process data of European residents, for example with EU partners.
PCI DSSBanking sector
Payment card data security standard for banks and merchants.

Cybersecurity glossary

The terms you will come across in our reports and training.

Antivirus
Software that detects and removes known malicious programs.
Backdoor
Hidden access left in a system to bypass normal authentication.
Botnet
Network of infected machines remotely controlled by an attacker.
BCP / DRP
Business continuity plan and disaster recovery plan.
CERT / CSIRT
Computer security incident response team.
CISO
Chief information security officer.
DDoS
Distributed denial of service: an attack that floods a service to make it unavailable.
EDR
Endpoint detection and response tool installed on computers and servers.
Encryption
Transforming data so it cannot be read without the decryption key.
Firewall
Device that filters communication between networks according to rules.
Forensics
Digital investigation that collects and analyses evidence after an incident.
ISMS
Information security management system, as defined by ISO/IEC 27001.
JOC
Joint operations centre, which coordinates military operations.
Malware
Any program designed to cause harm: virus, worm, ransomware, spyware.
Penetration test
Authorised simulated attack to find weaknesses before hackers do.
Phishing
Fraudulent message that imitates a trusted party to steal information.
Ransomware
Software that encrypts data and demands a ransom.
RTO / RPO
Maximum acceptable downtime (RTO) and maximum acceptable data loss (RPO).
SIEM
Tool that centralises and correlates logs to detect incidents.
SOC
Security operations centre that monitors and defends the information system continuously.
Social engineering
Psychological manipulation aimed at obtaining an action or information.
Trojan horse
Legitimate-looking program hiding a malicious function.
Two-factor authentication (2FA)
Sign-in that requires two proofs of identity, such as a password and a one-time code.
Vulnerability
Weakness in a system that an attacker can exploit.
Zero-day
Vulnerability exploited before the vendor has released a fix.