Why Financial Institutions are being hit hard by Cyber Criminals 0 201

  • Kenyan bank accounts are at risk. Kenya lost about $175million last year to cyber crime.
  • The Serianu 2016 Kenya Cyber security Report, which highlighted that about 44% of financial institutions run on a cyber security budget of $1-1,000 annually.
  • With the increased terrorist activities within Kenya, the Internet presents national enemies such as the Al-Shabaab and other extremist groups with a unique and ubiquitous opportunities.
  • There is no existing comprehensive data protection regulation in the jurisdiction of Kenya.
Why Financial Institutions are being hit hard by cybercriminals

Kenya has been widely celebrated as one of the foremost innovators around the question of financial inclusion. With the acclaim of being the leading nation in the adoption and use of mobile banking platforms such as M-PESA and Equitel, numerous fintech start-ups are opening office in the Silicon Savannah.

In Kenya, the effect of innovation by fintech companies has been brilliantly positive. Per a 2016 Finaccess Household Survey endorsed by the Central Bank of Kenya and the Kenya National Bureau of Statistics, the number of Kenyans formally included by the financial system has grown by 50% in the last ten years.

More than 75.3% of Kenyans are formally banked

Over three-quarters (75.3%) of Kenyans are now formally included, up from 66.8% in 2013. Financial exclusion, which is now down to 17.4%, has more than halved since 2006.

Cyber crime on the rise:

There is no simple way to say this. Kenyan bank accounts are at risk.

The latter statement has been evidenced by the statistics present in the recent Cyber security Report published by Serianu, which asserts that Kenya lost about $175million last year.

Moreover, the Report managed to establish that cyber criminals are deliberately targeting the Kenyan digital economy with the intention of wreaking havoc and making away with millions.

Essentially, in terms of cyber resilience, the Kenyan digital economy can be likened to a slow, plump gazelle stumbling through the “cyber-savannah” in the full view of agile, informed and hungry cyber-predators who have begun to sink their teeth into their sumptuous prize.

Cybersecurity is a budgetary concern

With more than 75.3% of Kenyan citizens formally included in financial services, one would logically expect a correspondent increase in cyber security investments in the financial services sector.

Notably, the Serianu 2016 Kenya Cyber security Report, which highlighted that about 44% of financial institutions run on a cyber security budget of $1-1,000 annually, whilst about 33% of financial institutions in Kenya have $0 spend on all matters cyber security.

44% of financial institutions run on a cyber security budget of $1-1,000 annually Click to Tweet

Effective infrastructural cybersecurity measures come at a budgetary cost which must be respected by C-Suite executives. The threat landscape is constantly evolving as hackers collectively invest in their own expertise and tools to hack siloed

Financial organisations should staff more cyber security specialists

Notably, 63% of financial organisations in Kenya have an in-house cybersecurity department. However, only 29% of the employees within in-house cybersecurity departments in financial organisations are security certificate holders.

Financial organisations such as banks and fintech companies should ensure that their customers’ data is under the watch of certified cyber security professionals who can:

  • Promptly update their security infrastructure to match threat trends,
  • Clearly communicate the organisation’s cyber security needs to Board Executives,
  • Collaborate with digital product creators to ensure that their consumers enjoy safer technology,
  • Train other employees in online hygiene as a safety net against social engineering,
  • Swiftly respond to hacking incidences to mitigate losses and collect forensic data for litigation support.

Certified security specialists are a key asset for any financial organisation, as they not only guarantee their organisations’ business continuity by perpetuating trust and reliability of financial products, but also as business enablers who can assist in ensuring that there is security by design in the creation of new financial products.

Immature Data Protection Regulation:

There is no existing comprehensive data protection regulation in the jurisdiction of Kenya. This is in vast contrast to other thriving digital economies such as South Africa, states within the European Union and Canada.

One of the impactful consequences of poor data protection is the immensely secretive way through the occurrence of breaches is treated.

Financial institutions are not necessitated by any law to proactively inform the public regarding any substantial data breaches that have occurred to the detriment of their consumers.

This contrasts with the impending General Dara Protection Regulation in Europe, the Protection of Personal Information Act of South Africa and the Digital Privacy Act (whose adoption introduced mandatory notification via an amendment in the Personal Information Protection and Electronic Documents Act) who urge that any data breach that may result in a risk to the rights and freedoms of individuals should be reported to the relevant supervisory authority.

If unaddressed such breaches can have significant detrimental effect on individuals, i.e, discrimination, damage to reputation, financial loss, loss of confidentiality or any other significant economic or social disadvantage.

Under the Constitution of Kenya 2010, Kenyans’ consumer rights as well as the right to privacy has been asserted as a fundamental right that should be protected by the full legislative might of the Government.

Innovative legislators should get to work to protect the economy of the Republic of Kenya.

Conclusion

Large banks, microfinance institutions even cutting-edge fintech firms have been taking hooks to the jaw thrown by hungry cyber criminals who can see the vulnerabilities present within Kenya’s financial ecosystem.

The reputational harm to the financial sector has been immense as confidence in new, innovative financial products continues to decline sharply.

The finance market runs on the foundational principal of user trust. If financial institutions in Kenya do not champion the cyber security agenda, share threat intelligence to develop a fresh, synergised approach to cybercriminals, those heavy blows to their infrastructure will continue to wreak havoc to their stellar brands.

Previous ArticleNext Article

Security trends to look out for in 2018 0 247

After a turbulent 2017 with Cyber Security making regular headlines, looking ahead to the coming year, there will no doubt be further discussions about the threat landscape.

Ransomware Revolution  – Ransomware of Things

Technological advances and their accelerated use have led to a number of scenarios considered unlikely just few years prior, are now within the realm of possibility. The advice going into 2018 from ESET researchers is to back up everything that matters to you, often, by keeping at least some backups offline – to media that aren’t routinely exposed to corruption by ransomware and other malware – in a physically secure location. As the Internet of Unnecessarily Networked Things becomes less avoidable, the attack surface increases, with networked devices and sensors embedded into unexpected items and contexts: from routers to fridges to smart meters, from TVs to toys, from power stations to petrol stations and pacemakers. As everything gets ‘smarter’, the number of services that might be disrupted by malware becomes greater.

Criminals following the money

With data being the most valuable asset, ransomware is set to remain in great demand among cybercriminals. It is important to note that many ransomware attacks are not sophisticated enough or never intended to recover the victim’s data once the ransom has been paid. For these reasons we suggest not only backing up of data online and offline but also implementing proper security measures such as proactively training staff on what phishing emails entail and how to avoid clicking on them and entering any credentials.

Critical infrastructure attacks on the rise

Cyber attacks on the Ukrainian power companies resulted in electricity service being turned off in hundreds of thousands of homes. The implications of this for future attacks of this kind include more than just the power grid but also includes critical manufacturing and food production, water and transport and the defence and healthcare sectors.

Safer for all

This year has seen ESET’s malware analysts continue to help law enforcement crack down on malicious campaigns and, by extension, the criminals spewing them. We are confident that 2018 will bring further successful investigations as we will continue to lend a hand to authorities so that, ultimately, the internet can become a safer place for everyone – except cybercriminals.

Download the full Security Trends 2018 report here

ESET’s top 5 tips for safe online shopping this festive season 0 288

safe online shopping

Holiday shopping is so quick and easy to do online, no traffic to get to the store, no waiting in queues or travelling to one specific shop just to find out – oh no, they’re out of stock of the one item you went there for.

We want to make sure your holiday shopping experience is quick, easy and most of all safe. Here are our top 5 tips for safe shopping this festive season:

  1. Don’t have the same passwords for all online shopping sites, have strong passwords and for extra security, change them before the holiday shopping commences.
  2. Only shop on trusted sites and directly from vendors.
  3. Don’t click on links from emails, instead go straight to the site on your browser.
  4.  When shopping online use a secure internet connection such as your home WiFi and make sure the necessary firewalls are in place – Avoid online payments via public WiFi.
  5. This coupled with a strong antivirus and/or anti-spyware software for scanning email, applications, and data that resides on your computer, you can rest assured that only you will catch or detect any form of intrusion in good time.

To find out how ESET can help secure your online shopping experience visit our website or contact us at sales@esetafrica.com