Find cybersecurity risks through systematic threat detection and

Published

find cybersecurity risks
Table of Contents

Cybersecurity risks evolve rapidly, demanding a proactive approach to identify vulnerabilities before they escalate into breaches. Organizations must integrate technical assessments, human-factor awareness, and threat intelligence to construct a resilient defense strategy. This guide explores structured methodologies—from penetration testing and dependency analysis to social engineering countermeasures and emerging attack vectors—to uncover hidden threats systematically. By adopting a risk-based framework, businesses can prioritize vulnerabilities, mitigate exposure, and fortify their security posture against both known and evolving adversaries.

The modern threat landscape extends beyond traditional malware, encompassing AI-driven deception, supply chain compromises, and weaponized human psychology. Each attack vector—whether technical, procedural, or psychological—requires tailored detection and response mechanisms. This discussion bridges theoretical foundations with actionable techniques, including zero-day vulnerability assessments, dark web monitoring, and IoT/OT risk prioritization. Through comparative analyses, real-world case studies, and step-by-step guides, stakeholders gain the insights needed to preemptively address cybersecurity weaknesses before they materialize into critical incidents.

find cybersecurity risks

Identifying Cybersecurity Vulnerabilities in Systems

Cybersecurity vulnerabilities often remain undetected until exploited, leading to data breaches, system compromises, or financial losses. Proactive identification through structured testing—such as penetration testing, dependency analysis, and misconfiguration audits—reduces exposure to attacks. This section outlines systematic approaches to uncover hidden risks in networks, software dependencies, cloud environments, and third-party vendors, leveraging industry-standard tools and frameworks.

Network Penetration Testing to Uncover Hidden Risks

Network penetration testing (pentesting) simulates real-world attacks to identify exploitable weaknesses in infrastructure. The process involves reconnaissance, scanning, exploitation, and post-exploitation, with tools like Nmap, Metasploit, and Burp Suite automating key phases. Below is a structured breakdown of scanning techniques and their execution.

Reconnaissance and Scanning
Network enumeration begins with passive and active reconnaissance to map targets. Tools like Nmap (Network Mapper) perform:

  • Port Scanning: Identifies open ports and services using TCP/UDP probes (e.g., `-sS` for SYN stealth scan, `-sV` for version detection).
  • Service Discovery: Fingerprints services (e.g., `-sV --script=banner`) to determine software versions prone to known exploits.
  • OS Detection: Guesses the target OS (e.g., `-O`) to tailor payloads for specific vulnerabilities.

    • Vulnerability Scanning
    Automated tools like OpenVAS or Nessus cross-reference discovered services against vulnerability databases (e.g., CVE, NVD). Key techniques include:

  • CVSS-Based Prioritization: Vulnerabilities are ranked by Common Vulnerability Scoring System (CVSS) metrics (e.g., CVSS 9.8 for critical flaws like EternalBlue).
  • Exploitability Assessment: Tools like Metasploit Framework test for confirmed exploits (e.g., `msfconsole > use exploit/windows/smb/ms17_010_eternalblue`).

    • Exploitation and Post-Exploitation
    Successful exploitation confirms vulnerabilities. Metasploit modules (e.g., `exploit/multi/handler` for reverse shells) demonstrate attack vectors. Post-exploitation involves:

  • Privilege Escalation: Tools like LinPEAS or WinPEAS identify misconfigurations granting elevated access.
  • Lateral Movement: Mapping internal networks (e.g., `enum4linux` for SMB shares) to assess attack surface expansion.

    • Example Workflow
    1. Initial Scan: `nmap -sV -O -T4 192.168.1.1` (aggressive scan with OS detection).
    2. Vulnerability Matching: Nessus generates a report with CVSS scores for identified flaws.
    3. Exploit Testing: Metasploit confirms exploitability (e.g., `exploit/windows/smb/ms17_010`).
    4. Remediation Validation: Patch management or firewall rules mitigate confirmed risks.

    Risk Assessment Framework for Software Dependencies

    Software dependencies—such as libraries, APIs, and frameworks—often introduce vulnerabilities through unpatched flaws or insecure configurations. A structured risk assessment framework integrates tools like OWASP Dependency-Check and Snyk to evaluate dependencies systematically.

    Dependency Scanning Tools

  • OWASP Dependency-Check: Integrates with build pipelines (Maven, Gradle) to scan for CVEs in dependencies (e.g., `dependency-check:check`).
  • Snyk: Provides Software Bill of Materials (SBOM) analysis and prioritizes risks by:
  • Severity: Critical (CVSS ≥ 9.0), High (7.0–8.9), Medium (4.0–6.9).
  • Exploitability: Publicly available exploits (e.g., Proof-of-Concepts on GitHub).

    • Risk Prioritization Criteria
    Dependencies are evaluated using:
    1. CVSS Score: Higher scores indicate immediate remediation needs.

    CVSS Formula: Temporal + Environmental + Base Score (e.g., Base 7.5 + Exploit Code 3.9 = Total 9.8).
    2. Exploit Maturity: Tools like Exploit-DB or Shodan flag dependencies with active exploits.
    3. Usage Context: Critical paths (e.g., authentication libraries) require stricter scrutiny.

    Remediation Steps

  • Patch Management: Update vulnerable libraries via `npm audit fix` or `mvn dependency:tree`.
  • Isolation: Containerize or sandbox high-risk dependencies (e.g., Docker with `--security-opt`).
  • Vendor Advisories: Monitor CISA KEV Catalog for known exploited vulnerabilities.

    • Example Dependency Risk Table

    LibraryVulnerability (CVE)CVSS ScoreExploit MethodMitigation
    Log4j 2.14.1CVE-2021-4422810.0RCE via crafted JNDI lookupUpgrade to 2.17.1+ or patch JVM
    Apache Struts 2.5CVE-2017-563810.0REST Plugin deserializationApply Struts 2.5.17+ patch
    OpenSSL 1.0.2CVE-2014-0224 (Heartbleed)5.0Memory leak disclosureUpgrade to OpenSSL 1.0.2g+

    Checklist for Misconfigured Cloud Environments

    Cloud environments frequently expose data due to misconfigurations, such as overly permissive access controls or unencrypted storage. Below is a checklist for AWS, Azure, and GCP, categorized by risk area.

    Data Storage Misconfigurations

  • Open S3 Buckets: Verify bucket policies deny `s3:GetObject` to public IPs (use `aws s3api get-bucket-acl`).
  • Unencrypted Databases: Ensure TLS 1.2+ encryption for RDS/Cloud SQL (check `ssl_mode=require`).
  • Exposed APIs: Restrict API Gateway endpoints to VPC endpoints (avoid `ANY` in `aws_api_gateway_method_settings`).

    • Identity and Access Management (IAM)

  • Excessive Permissions: Audit IAM roles for `*` wildcards (use `aws iam list-policies --scope Local`).
  • Unused Credentials: Revoke inactive access keys (via AWS IAM > Users > Security Credentials).
  • Root Account Activity: Disable root account MFA and enforce least privilege.

    • Networking and Firewalls

  • Overly Permissive Security Groups: Replace `0.0.0.0/0` with specific CIDR blocks (e.g., `10.0.0.0/16`).
  • No VPC Flow Logs: Enable logs for traffic analysis (`aws ec2 create-flow-logs`).
  • Publicly Accessible Load Balancers: Use AWS Shield Advanced for DDoS protection.

    • Compliance and Logging

  • Missing CloudTrail Logs: Enable data events for API calls (`aws cloudtrail put-event-selectors`).
  • No GuardDuty Alerts: Deploy AWS GuardDuty for anomaly detection.
  • Unpatched Services: Use AWS Inspector or Trivy for container vulnerability scans.

    • Example Misconfiguration Impact

  • Case Study: Capital One Breach (2019): Exposed 100M records due to an unpatched AWS Web Application Firewall (WAF) misconfiguration.
  • GCP Misconfiguration: Unrestricted Cloud Storage buckets led to $5M in unauthorized costs (2020).

    • Auditing Third-Party Vendors for Cybersecurity Risks

    Third-party vendors introduce supply chain risks through insecure APIs, outdated systems, or poor incident response. A vendor risk assessment evaluates security posture using Security Questionnaires (VRQs) and objective evidence (e.g., SOC 2 reports).

    Vendor Risk Questionnaire (VRQ) Template

    CategoryQuestionAcceptable Evidence
    Access ControlsAre vendor systems protected by MFA?SOC 2 Type II report (Section: AIC.03)
    Data ProtectionAre customer data encrypted at rest/transit?ISO 27001:2013 certification
    Incident ResponseDoes the vendor conduct quarterly penetration tests?Penetration test report (last 12 months)
    Compliance

    find cybersecurity risks - Ilustrasi 2

    Human Factors and Social Engineering Risks

    Social engineering exploits human psychology and behavioral patterns to manipulate individuals into compromising security. Unlike technical vulnerabilities, these attacks rely on deception, trust, and cognitive biases, making them highly effective. Organizations must implement layered defenses, including employee training, monitoring, and incident response protocols, to mitigate these risks. This section examines phishing attack vectors, psychological manipulation tactics, and practical countermeasures, including dark web monitoring and role-based training exercises.

    Phishing Attack Vectors and Real-World Lures

    Phishing attacks leverage deception to trick victims into divulging sensitive information or executing malicious payloads. Attackers refine their tactics based on behavioral analysis, often using spear phishing (targeted individuals), business email compromise (BEC) (financial fraud), and smishing (SMS-based attacks). Below is a breakdown of these vectors, including common lures and payload delivery methods.

    Spear Phishing
    Targeted at specific individuals (e.g., executives, HR, or finance teams), spear phishing relies on personalized information to increase credibility. Attackers research victims via LinkedIn, corporate websites, or leaked data to craft convincing messages.

    - Lures and Examples:

  • Fake Invoices: A supplier’s email appears legitimate but includes a malicious attachment (e.g., a "past-due invoice" with a `.docm` macro-enabled file).
  • Urgent CEO Requests: An email mimicking a CEO’s signature demands an immediate wire transfer for a "confidential acquisition" (e.g., the U.S. Federal Reserve’s 2016 $81M BEC scam).
  • Job Application Scams: A fake hiring manager offers a remote position with a "background check" link leading to credential harvesters.

    • - Payload Delivery Methods:

  • Malicious Attachments: `.pdf`, `.docx`, or `.xlsx` files with embedded macros or exploits (e.g., CVE-2017-11882 in Microsoft Office).
  • Drive-by Downloads: Links to compromised websites hosting exploit kits (e.g., Angler Exploit Kit).
  • Phishing Pages: Fake login portals (e.g., Microsoft 365 or banking sites) with credential stealers.

    • Business Email Compromise (BEC)
    BEC attacks focus on financial fraud, often involving email spoofing or account takeover. Attackers impersonate trusted contacts (e.g., vendors, partners) to manipulate victims into transferring funds.

    - Lures and Examples:

  • Vendor Impersonation: An email from a "supplier" requests an updated bank account for future payments (e.g., 2020 Costa Rica Coffee Group’s $3.2M loss).
  • Legal Threats: A fake "legal notice" demands immediate action to avoid litigation, accompanied by a malicious attachment.
  • CEO Fraud: An urgent request to purchase gift cards for "employee bonuses" (e.g., 2019 Facebook’s $100K BEC attack).

    • - Payload Delivery Methods:

  • Wire Transfer Instructions: Manipulated emails with altered bank details.
  • Fake Purchase Orders: PDFs with embedded malware or instructions to call a compromised number.
  • Social Media Spoofing: Attackers hijack LinkedIn or Twitter accounts to send fraudulent messages.

    • Smishing (SMS Phishing)
    Smishing exploits the urgency and trust associated with text messages. Attackers send SMS with malicious links or instructions to call a premium-rate number.

    - Lures and Examples:

  • Fake Package Delivery Notices: A text claims a "failed delivery" with a link to "reschedule" (e.g., 2020 DHL smishing campaign).
  • Bank Alerts: A message warns of "suspicious login activity" and directs users to a phishing site.
  • Two-Factor Authentication (2FA) Bypasses: A text asks users to "verify their account" via a malicious link (e.g., 2019 Capital One breach-related smishing).

    • - Payload Delivery Methods:

  • Shortened URLs: Links to credential harvesters (e.g., Bitly or TinyURL).
  • Premium-Rate Calls: Victims are tricked into calling a number that incurs charges (e.g., $19.99/minute tech support scams).
  • Malicious APKs: Links to fake mobile banking apps on third-party stores.

    • Training Module for Recognizing Pretexting and Tailgating Risks

    Pretexting involves fabricating a scenario to extract information, while tailgating exploits physical access controls. Employee training must include role-play scenarios, red-team exercises, and de-escalation techniques to build resilience.

    Module Outline:
    1. Theoretical Foundations

  • Define pretexting (e.g., posing as IT support to request passwords) and tailgating (unauthorized entry via piggybacking).
  • Explain social proof (e.g., "Everyone else is doing it") and authority bias (e.g., "I’m from corporate security").

    • 2. Role-Play Scenarios

  • Scenario 1: IT Support Impersonation
  • Attacker: Calls an employee claiming to be from IT, requesting a "password reset" via email.
  • Employee Response: Verify the caller’s identity using a pre-approved contact list or multi-factor authentication (MFA).
  • Script:

    • Attacker: "Hi, this is John from IT. We’ve detected unusual activity on your account. To secure it, send your password to [fake@email.com]."
    Employee: "Can you verify this via our IT ticketing system? I’ll check the approved contacts list."

    - Scenario 2: Tailgating at Reception

  • Attacker: Holds the door for an employee entering a secure area, claiming to "forget their badge."
  • Employee Response: Politely decline and escort the individual to the front desk.
  • Script:

    • Attacker: "Sorry, I forgot my badge. Can you hold the door?"
    Employee: "I’m afraid I can’t let you in without proper authorization. Let me walk you to the reception."

    3. Red-Team Exercises

  • Simulate phishing campaigns using tools like GoPhish or Social-Engineer Toolkit (SET).
  • Conduct physical penetration tests to assess tailgating vulnerabilities (e.g., propping doors open).
  • Measure employee detection rates and refine training based on results.

    • 4. De-Escalation Techniques

  • Verify, Don’t Assume: Always cross-check requests with official channels (e.g., HR, IT).
  • Slow Down: Urgency is a red flag; pause to assess legitimacy.
  • Report Suspicious Activity: Use a whistleblower hotline or incident reporting portal.

    • Psychological Manipulation Tactics in Social Engineering

    Attackers exploit cognitive biases to bypass security controls. The following tactics are commonly used in real-world breaches:

    - Urgency: Creates fear of missed deadlines or consequences.

  • Example: The WannaCry ransomware (2017) used fake "urgent updates" to deploy malware via phishing emails.

    • - Authority: Leverages perceived legitimacy (e.g., titles, uniforms).

  • Example: Colonial Pipeline (2021) attackers impersonated IT staff to gain access to internal systems.

    • - Scarcity: Exploits fear of missing out (FOMO).

  • Example: Fake "limited-time offers" for software licenses (e.g., 2020 SolarWinds breach used urgent "security patch" emails).

    • - Likability: Builds rapport to lower defenses.

  • Example: Attackers use LinkedIn connections to send personalized messages (e.g., 2019 Twitter Bitcoin scam).

    • Mitigation Strategies:

  • Cognitive Bias Training: Teach employees to recognize manipulation tactics.
  • Mandatory Delays: Require second approval for urgent financial requests.
  • Behavioral Analytics: Use User and Entity Behavior Analytics (UEBA) to detect anomalies (e.g., sudden changes in communication patterns).

    • Step-by-Step Guide for Dark Web Monitoring Programs

    Dark web monitoring detects exposed credentials, leaked data, or discussions about an organization. Below is a structured approach using tools like Have I Been Pwned (HIBP), Dehashed, and Intel 471.

    Step 1: Define Scope and Objectives

  • Identify target data (e.g., employee emails, customer PII, API keys).
  • Set alert thresholds (e.g., credentials appearing in breach databases).

    • Step 2: Select Monitoring Tools

    ToolPurposeExample Use Case
    The cyber threat landscape evolves rapidly, driven by technological advancements and the increasing sophistication of adversarial techniques. Emerging threats leverage artificial intelligence, supply chain vulnerabilities, and novel attack vectors to bypass traditional defenses. This section examines AI-powered attacks, supply chain compromises, ransomware-as-a-service models, and risks associated with IoT and OT systems, along with advanced malware techniques that evade detection through stealthy execution.

    AI-Powered Cyberattacks and Adversarial Machine Learning

    Artificial intelligence has become a double-edged sword in cybersecurity, enabling both defenders and attackers to automate and refine their operations. Attackers exploit AI to generate highly convincing phishing emails, deepfake audio/video communications, and adaptive malware that evades signature-based detection. Automated phishing campaigns, for instance, use natural language processing (NLP) to craft personalized messages that mimic legitimate correspondence, increasing success rates. Deepfake voice calls, such as those targeting executives with cloned voices, have been used in high-profile business email compromise (BEC) schemes, with attackers using AI to replicate vocal patterns with near-perfect accuracy.

    Adversarial machine learning involves manipulating AI-driven security tools by introducing subtle perturbations into input data. For example, attackers may alter images or files in ways imperceptible to humans but cause machine learning models—such as those used in email filtering—to misclassify them as benign. A notable case involved researchers demonstrating how adversarial attacks could bypass facial recognition systems by applying carefully designed perturbations to images. Similarly, AI-generated synthetic data can train malware to mimic legitimate software behavior, reducing the likelihood of detection by anomaly-based detection systems.

    AI-powered attacks exploit automation, personalization, and adaptive learning to circumvent traditional security controls, requiring organizations to adopt AI-driven threat detection and behavioral analytics.

    Supply Chain Attacks and Exploiting Trusted Software Updates

    Supply chain attacks target the interconnected dependencies of software ecosystems, leveraging the trust placed in third-party vendors to distribute malware. These attacks compromise widely used tools, libraries, or updates, allowing attackers to infiltrate multiple organizations simultaneously. The SolarWinds breach in 2020 remains one of the most sophisticated examples, where Russian state-sponsored actors (APT29) inserted malicious code into legitimate updates of the Orion platform, a tool used by thousands of enterprises. The attack remained undetected for months, with the malware (Sunburst) communicating with command-and-control servers via DNS queries to evade network monitoring.

    A timeline of major supply chain breaches highlights the evolving tactics:

  • 2013: Target Corporation – Malware embedded in third-party HVAC vendor software led to the theft of 40 million credit card records.
  • 2017: NotPetya – A supply chain attack via compromised Ukrainian tax software (MEDoc) caused global damage, with losses exceeding $10 billion.
  • 2021: Kaseya VSA – Ransomware (REvil) exploited vulnerabilities in Kaseya’s remote management software, affecting hundreds of downstream businesses.
  • 2023: 3CX Desktop App – A trojanized update in the VoIP software distributed malware to over 600,000 users globally.

    • Attack vectors in supply chain compromises include:

  • Compromised software updates (e.g., SolarWinds, Kaseya).
  • Malicious third-party libraries (e.g., EventBot malware via Android libraries).
  • Fake software repositories (e.g., PyPI package typosquatting, such as "urllib3" vs. "urllib").
  • Insider threats or vendor collusion (e.g., insiders at SolarWinds with access to build systems).
    • Supply chain attacks exploit the principle of least trust, requiring organizations to implement software bill of materials (SBOM), continuous integrity monitoring, and vendor risk assessments.

    Ransomware-as-a-Service (RaaS) Models and Affiliate Structures

    Ransomware-as-a-Service (RaaS) democratizes cybercrime by allowing non-technical actors to launch attacks via subscription-based models. Unlike traditional ransomware operations, RaaS operators provide malware, infrastructure, and support in exchange for a percentage of ransom payments. This model has led to a surge in ransomware incidents, with affiliates targeting small businesses, healthcare providers, and critical infrastructure. Payment methods primarily rely on cryptocurrencies (e.g., Bitcoin, Monero) to ensure anonymity, while negotiation tactics often involve double extortion—threatening to leak stolen data if the ransom is unpaid.

    A typical RaaS attack lifecycle follows these stages:
    1. Recruitment: Affiliates are recruited through dark web forums, Telegram channels, or referral programs, often with performance-based incentives.
    2. Malware Distribution: Affiliates deploy ransomware via phishing emails, exploit kits, or compromised RDP credentials.
    3. Encryption and Exfiltration: The malware encrypts victim data while exfiltrating sensitive files for extortion purposes.
    4. Negotiation: Victims receive ransom demands, often with deadlines and threats to publish data if payments are delayed.
    5. Payment and Decryption: Successful payments may result in decryption tools, though law enforcement agencies frequently advise against compliance due to lack of guarantees.

    Key differences between RaaS and traditional ransomware include:

  • Affiliate Motivation: RaaS affiliates operate independently, increasing the volume of attacks.
  • Payment Flexibility: RaaS groups often accept partial payments or negotiate discounts for prompt settlements.
  • Target Diversification: RaaS campaigns prioritize high-value targets, including managed service providers (MSPs) to maximize impact.
    • RaaS models reduce the barrier to entry for cybercrime, necessitating proactive measures such as employee training, endpoint detection and response (EDR), and immutable backups.

    IoT and OT (Operational Technology) Risks and Unsecured Protocols

    The proliferation of Internet of Things (IoT) and Operational Technology (OT) devices introduces significant cybersecurity risks due to their inherent vulnerabilities. IoT devices, such as smart cameras, medical equipment, and industrial sensors, often lack robust security controls, relying on default credentials, unpatched firmware, and proprietary protocols. OT systems, which control physical processes in industries like energy, manufacturing, and water treatment, frequently use legacy protocols (e.g., Modbus, DNP3) designed for functionality rather than security. Attackers exploit these weaknesses to disrupt operations, steal intellectual property, or cause physical damage.

    Common IoT/OT vulnerabilities include:

  • Default or Weak Credentials: Many devices ship with hardcoded passwords (e.g., "admin/admin"), enabling trivial access.
  • Unpatched Firmware: Lack of regular updates leaves devices exposed to known exploits (e.g., Mirai botnet targeting unsecured cameras).
  • Insecure Protocols: Industrial protocols like Modbus and S7Comm lack encryption, allowing attackers to manipulate commands (e.g., Stuxnet sabotaging centrifuges).
  • Lack of Segmentation: OT networks often lack micro-segmentation, allowing lateral movement from compromised IoT devices to critical systems.

    • A risk matrix for prioritizing IoT/OT assets considers:

  • Criticality: Impact on safety, operations, or revenue (e.g., a compromised SCADA system in a power grid vs. a smart thermostat).
  • Exposure: Visibility to external networks, public-facing interfaces, or lack of network segmentation.
  • Vulnerability Severity: Presence of unpatched CVEs, default credentials, or misconfigurations.
    • Securing IoT/OT environments requires network segmentation, continuous vulnerability scanning, and the implementation of zero-trust principles tailored to industrial environments.

    Fileless Malware Attacks and Memory-Based Execution

    Fileless malware operates entirely in memory, using legitimate system tools to evade detection by traditional antivirus solutions that rely on file signatures. Attackers leverage built-in utilities such as PowerShell, Windows Management Instrumentation (WMI), and Living-off-the-Land Binaries (LOLBins) to execute malicious payloads without writing to disk. This stealthy approach allows malware to persist undetected for extended periods, making it particularly effective against organizations with robust endpoint protection.

    A typical fileless attack workflow involves:
    1. Initial Compromise: Gaining access via phishing, exploit kits, or stolen credentials.
    2. Memory Injection: Loading malicious code into memory using techniques like:

  • PowerShell Empire: A post-exploitation framework that executes commands in memory.
  • WMI Persistence: Creating scheduled tasks or event subscriptions to maintain access.
  • Process Hollowing: Replacing the memory of a legitimate process (e.g., svchost.exe) with malicious code.
    • 3. Evasion: Using obfuscation, dynamic code generation, or direct system calls to avoid logging.
    4. Lateral Movement: Spreading within the network via techniques like Pass-the-Hash or PsExec.

    Forensic investigation of fileless malware requires memory analysis tools such as:

  • Volatility Framework: Extracts artifacts from memory dumps,

    Identifying cybersecurity risks is not a one-time exercise but a continuous cycle of detection, evaluation, and adaptation. By leveraging structured frameworks—such as penetration testing, risk assessment matrices, and vendor audits—organizations can systematically expose vulnerabilities in systems, human behaviors, and third-party dependencies. The rise of AI-powered attacks and supply chain exploits underscores the need for agility, while psychological manipulation tactics reveal that even the most advanced technical defenses are ineffective without trained personnel. Proactive monitoring, combined with incident-ready response strategies, ensures that risks are mitigated before they compromise operations. Ultimately, a disciplined approach to cybersecurity risk identification transforms potential threats into opportunities for strengthening defenses, fostering resilience, and maintaining trust in an increasingly interconnected world.

    • Leave a Comment

    Comments are moderated before appearing. The data you submit is processed according to the Privacy Policy of ir.msu.ac.zw.