Why Financial Institutions are being hit hard by Cyber Criminals 0 958

  • Kenyan bank accounts are at risk. Kenya lost about $175million last year to cyber crime.
  • The Serianu 2016 Kenya Cyber security Report, which highlighted that about 44% of financial institutions run on a cyber security budget of $1-1,000 annually.
  • With the increased terrorist activities within Kenya, the Internet presents national enemies such as the Al-Shabaab and other extremist groups with a unique and ubiquitous opportunities.
  • There is no existing comprehensive data protection regulation in the jurisdiction of Kenya.
Why Financial Institutions are being hit hard by cybercriminals

Kenya has been widely celebrated as one of the foremost innovators around the question of financial inclusion. With the acclaim of being the leading nation in the adoption and use of mobile banking platforms such as M-PESA and Equitel, numerous fintech start-ups are opening office in the Silicon Savannah.

In Kenya, the effect of innovation by fintech companies has been brilliantly positive. Per a 2016 Finaccess Household Survey endorsed by the Central Bank of Kenya and the Kenya National Bureau of Statistics, the number of Kenyans formally included by the financial system has grown by 50% in the last ten years.

More than 75.3% of Kenyans are formally banked

Over three-quarters (75.3%) of Kenyans are now formally included, up from 66.8% in 2013. Financial exclusion, which is now down to 17.4%, has more than halved since 2006.

Cyber crime on the rise:

There is no simple way to say this. Kenyan bank accounts are at risk.

The latter statement has been evidenced by the statistics present in the recent Cyber security Report published by Serianu, which asserts that Kenya lost about $175million last year.

Moreover, the Report managed to establish that cyber criminals are deliberately targeting the Kenyan digital economy with the intention of wreaking havoc and making away with millions.

Essentially, in terms of cyber resilience, the Kenyan digital economy can be likened to a slow, plump gazelle stumbling through the “cyber-savannah” in the full view of agile, informed and hungry cyber-predators who have begun to sink their teeth into their sumptuous prize.

Cybersecurity is a budgetary concern

With more than 75.3% of Kenyan citizens formally included in financial services, one would logically expect a correspondent increase in cyber security investments in the financial services sector.

Notably, the Serianu 2016 Kenya Cyber security Report, which highlighted that about 44% of financial institutions run on a cyber security budget of $1-1,000 annually, whilst about 33% of financial institutions in Kenya have $0 spend on all matters cyber security.

44% of financial institutions run on a cyber security budget of $1-1,000 annually Click to Tweet

Effective infrastructural cybersecurity measures come at a budgetary cost which must be respected by C-Suite executives. The threat landscape is constantly evolving as hackers collectively invest in their own expertise and tools to hack siloed

Financial organisations should staff more cyber security specialists

Notably, 63% of financial organisations in Kenya have an in-house cybersecurity department. However, only 29% of the employees within in-house cybersecurity departments in financial organisations are security certificate holders.

Financial organisations such as banks and fintech companies should ensure that their customers’ data is under the watch of certified cyber security professionals who can:

  • Promptly update their security infrastructure to match threat trends,
  • Clearly communicate the organisation’s cyber security needs to Board Executives,
  • Collaborate with digital product creators to ensure that their consumers enjoy safer technology,
  • Train other employees in online hygiene as a safety net against social engineering,
  • Swiftly respond to hacking incidences to mitigate losses and collect forensic data for litigation support.

Certified security specialists are a key asset for any financial organisation, as they not only guarantee their organisations’ business continuity by perpetuating trust and reliability of financial products, but also as business enablers who can assist in ensuring that there is security by design in the creation of new financial products.

Immature Data Protection Regulation:

There is no existing comprehensive data protection regulation in the jurisdiction of Kenya. This is in vast contrast to other thriving digital economies such as South Africa, states within the European Union and Canada.

One of the impactful consequences of poor data protection is the immensely secretive way through the occurrence of breaches is treated.

Financial institutions are not necessitated by any law to proactively inform the public regarding any substantial data breaches that have occurred to the detriment of their consumers.

This contrasts with the impending General Dara Protection Regulation in Europe, the Protection of Personal Information Act of South Africa and the Digital Privacy Act (whose adoption introduced mandatory notification via an amendment in the Personal Information Protection and Electronic Documents Act) who urge that any data breach that may result in a risk to the rights and freedoms of individuals should be reported to the relevant supervisory authority.

If unaddressed such breaches can have significant detrimental effect on individuals, i.e, discrimination, damage to reputation, financial loss, loss of confidentiality or any other significant economic or social disadvantage.

Under the Constitution of Kenya 2010, Kenyans’ consumer rights as well as the right to privacy has been asserted as a fundamental right that should be protected by the full legislative might of the Government.

Innovative legislators should get to work to protect the economy of the Republic of Kenya.

Conclusion

Large banks, microfinance institutions even cutting-edge fintech firms have been taking hooks to the jaw thrown by hungry cyber criminals who can see the vulnerabilities present within Kenya’s financial ecosystem.

The reputational harm to the financial sector has been immense as confidence in new, innovative financial products continues to decline sharply.

The finance market runs on the foundational principal of user trust. If financial institutions in Kenya do not champion the cyber security agenda, share threat intelligence to develop a fresh, synergised approach to cybercriminals, those heavy blows to their infrastructure will continue to wreak havoc to their stellar brands.

Previous ArticleNext Article

Ransomware Protection Crucial to Enterprise 0 275

Ransomware

Ransomware is by far the biggest threat among Enterprises.  So what is Ransomware? It is a malicious code that blocks or encrypts the contents of a device and demands a ransom to restore access to the data.

According to research done by ESET,  Companies named ransomware their number one concern.

In response to customer needs and concerns, ESET integrated Ransomware Shield into its security solutions. ESET has long been providing its customers with very good behavior-based malware detection and also with Host-based Intrusion Prevention System (HIPS) that allows users to set custom rules for the protection against ransomware. However, should something slip past the 11 other security layers, Ransomware Shield will be automatically activated.

While ransomware infection often starts with clicking a suspicious link or a fictitious invoice, ESET found that email remains the most common distribution method.

To combat these scenarios, enter ESET Dynamic Threat Defense (EDTD). EDTD provides another layer of security for ESET products like Mail Security and Endpoint products. It utilizes a cloud-based sandboxing technology and multiple machine learning models to detect new, never before seen type of threats. In result, attachments that were classified as malicious are stripped off the email and the recipient gets information about the detection.

To learn more about how ESET can protect your business, and to book a FREE in house Cybersecurity Training Session for your employees, please sign up below.

Free Training

Interview: Addressing the Six Biggest Cybersecurity Challenges for Enterprise 0 193

cybersecurity challenges enterprise
Ken Kimani, Channel Manager of ESET East Africa, introduces the 6 biggest cybersecurity challenges for enterprises

Enterprises are under constant attack from cybersecurity threats resulting in the loss of millions in revenue annually. Factors such as ransomware, targeted attacks, insufficient network visibility, various operating systems in an organization, bad security behaviour among office staff, lack of skilled cybersecurity workforce and the level of tolerance among staff are the major causes of cyber-attacks in the country.

To mitigate these issues, ESET East Africa offers free training, suitable for all skill levels to help educate enterprises on the importance of cybersecurity.

Subscribe to our newsletter to find out more about this training, our enterprise offering and to follow our series on the 6 Biggest Cybersecurity Challenges for Enterprises.