Advertisements

Advertisements

Advertisements

The recent revelation by the Nigeria Inter-Bank Settlement System (NIBSS) that banks in the country had lost N9.7 billion to e-fraud in first seven months of 2023 has further vindicated the position of the National Data Protection Commission (NDPC) during a recent training of ICT media executives in Lagos last month in Lagos.

Speaking in his presentation at the training workshop for IT journalists in Lagos, the Head, IT and Cybersecurity, Mr. Olorunisomo Ishola said as days go by, more innovative attack models are churned out by cyber criminals on financial institution especially in developing economies where cyber security platforms are yet to take higher dimensions.

According to him, the cyber-attacks on banks mostly are aimed at the organizations with sole aim to steal or disrupt services.

Business Hilights recalls that the Managing Director of NIBSS, Premier Oiwoh, disclosed this during the Nigerian Electronic Fraud Forum (NeFF) third quarter (Q3) general meeting and the launch of its website in Lagos. Oiwoh, who was represented by the Chief Risk Officer at NIBSS, Temidayo Adekanye, stated that the highest fraud counts in the last six months of 2023 were recorded in May with 11,716 records, while the lowest count was recorded in June with 6,240. He expressed concern that the fraud trend in the last 5 years has increased each year since 2019 from N3 billion to N14.3 billion in 2022, representing a 377 percent increase. According to him, the cashless policy from the Central Bank of Nigeria partly contributed to the increase in e-fraud. We had the cashless policy from CBN, and that policy incurred a dramatic increase in the volume of transactions in the industry which variably had an impact on the volume of fraud in the industry itself.

At the media training, Ishola enumerated attacks on financial and other institutions to include as follows:

Ransomware is a style of cyber-attack that is known as information hijacking, where the attacker uses a code to get access to the organization’s server. The objective is to hold a company’s data hostage until the affected user pays a specific amount, which can often n bbe hefty These attacks can use email to penetrate a system, but can also be initiated by visiting an infected website, clicking on an online ad with malicious code, or hackers exploiting network vulnerabilities

Distributed denial-of-service (DDOS) A cyber attacker floods the system with a high number of simultaneous functions, such as a request to a webpage. The goal is to overwhelm networks, systems, or devices.

Malware is a type of malicious software that is designed to damage computers or steal information. Hackers can use malware to delete files, access sensitive information, or disable a computer. In other words, it is intended to take control of or disrupt a target’s computer system or infrastructure.

Social engineering represents a catch-all term for various tactics that are used by hackers. These tactics are designed to trick individuals into giving out sensitive or confidential information (e.g: Phishing. Smishing, Vishing, etc.)

Advanced Persistent Threats (APT) is a sophisticated, sustained cyberattack in which an intruder establishes an undetected presence in a network in order to steal sensitive data over a prolonged period of time. An APT attack is carefully planned and designed to infiltrate a specific organization, evade existing security measures and fly under the radar.

SQL injection attacks, often known as SQLi attacks, are a type of vulnerability in website and web app code that allows attackers to take control of back-end operations and access, retrieve, and destroy sensitive data from databases.

Man-in-the-middle attack (MITM) is a type of cyber threat in which a hacker intercepts communication between two people to obtain information. On an insecure WiFi network, for example, an attacker could intercept data passing between the victim’s device and the network.

Insider threat is the potential for an insider to use their authorized access or understanding of an organization to harm that organization. This harm can include malicious, complacent, or unintentional acts that negatively affect the integrity confidentiality, and availability of the organization, its data, personnel, or facilities

Third-Party Threats are typically contractors or vendors non formal members of an organization, people but have to complete been granted their work. some These level of threats access may to be facilities, direct or systems, indirect networks, or   ANDPC 19 threats.