Cybersecurity in theBanking Industry:
African Case Studies

Case studies by:Prof. Francis Wambalaba, United States
International University (USIU)
Dr. Paula Musuva, United States International
University (USIU)
Judy Ouma, Technical University of Kenya
William Makatiani, Serianu Limited
Brencil Kaimba, Serianu Limited
Dr. Koussis Nicos, Fredrick University

Security andrisk experts
within Africanorganisations
have identified
methodologies
and frameworks
for minimising andquantifying theirrisks within theirlimited budgets.
2CYB E R S E CUR I T Y I N T HE B ANK I NG I NDUST R Y: T E ACHI NG CAS E S T UD I ES

Introduction

The financial sector has
always been a primary target
for cyber-attacks and it isimperative that cyber risk
minimisation practices within
financial institutions remain
resilient to cyber threats.
Organisations in Africa are faced with numerous
attacks against their infrastructure, however, withlimited budgets to support risk minimisation efforts
most risk experts are usually unable to deploy theright skills and tools.
A recent Africa Cybersecurity Report states that up to80% of organisations in Africa spend less than USD
10,000 on cybersecurity annually.

3

While innovative technologies are key in acompetitive market, there also needs to be acorresponding investment in the development
and enforcement of policy guidelines to safeguard
operational environments.
There have been commendable advancements inthe enactment of cybercrime and data protection
legislation by East African countries following theestablishment of the 2014 African Union Convention
on Cyber Security and Personal Data Protection.
However, it is important for policy makers andgovernance professionals within the banking industry
to understand the impact any lag between technology
and policy has on cyber security.
Through a partnership between The SWIFT Instituteand The Global Business School Network (GBSN)*
two research case studies have been developed
looking at cybersecurity and banking across theAfrican and specifically East African context.

CYB E R S E CUR I T Y I N T HE B ANK I NG I NDUST R Y: T E ACHI NG CAS E S T UD I ES

Case studies

1.

Cybersecurity Risk
Minimisation Best Practices— African Experiences:
Identifies key cyber security risks, cyber security
risk quantification and minimisation practices inthe banking industry. Taking a comparative view,
it highlights the African experience, and provides
mitigating measures and strategies for cybersecurity risk minimisation on emerging areas ofconcern for African financial institutions.

2.

Cybersecurity Risks andNational Policy Implications— East African Experiences:
Assesses the cybersecurity risks stemming from lags
between policy development and technological advancesin the banking industry with particular focus on the East
African Region.

4

CYB E R S E CUR I T Y I N T HE B ANK I NG I NDUST R Y: T E ACHI NG CAS E S T UD I ESKey takeaways acrossthe case studies

Cybersecurity threats

What role is technology playing?

••••

•

Organisations in Africa are faced with numerous
attacks against their infrastructure, however, withlimited budgets to support risk minimization efforts
most risk experts are usually unable to deploy theright skills and tools.
With regards to cybersecurity risk, banks are facing
huge risks relating to financial fraud, data theft andmalware attacks. The greatest source of these risks
are malicious insiders and local organised crimesyndicates.
Insider threat causes the largest security losses,
and is the hardest to detect, remediate andprosecute. Insiders constitute employees, vendors
or contractors.
Organised crime syndicates are not only on theincrease in terms of geographical reach but also in
the number of collusions with malicious insiders withthe objective of launching sophisticated attacks.

••

Over the period 2010 to 2017, USD $722 million
was invested into FinTech in East Africa, with Kenya
receiving the largest investment.
In the East African banking industry, the top fivetechnology advancements are: mobile banking,online banking, open banking, bank assurance andcloud computing.
Drivers for the adoption of these technology
innovations are to:• provide faster access to 24/7 banking services• increase operational efficiencies• drive down costs

How are institutions responding?
••

•

5

By deploying various detective and preventive
measures to deter and protect their assets fromcyber-attacks.
By implementing Information Security Policies tosupport risk management and security education
training and awareness.
By adopting various frameworks to streamline theircyber risk management processes to benchmark
with industry standards. To date, ISO 27001 is
the most adopted industry framework. The paper
discusses ISO, NIST, PCI-DSS and the SWIFTCustomer Security Programme.

CYB E R S E CUR I T Y I N T HE B ANK I NG I NDUST R Y: T E ACHI NG CAS E S T UD I ESTechnology to mitigate cyber risks

What role has regulation played?

••

•

•

The research surveys indicated that the technology
controls that East African banks have found to beessential relate to network firewalls, anti-malware
solutions, backups, domain access management,
information security policies, system auditing
and monitoring, security education training andawareness and log management.
Those least implemented included dataclassification, digital forensics and Security
Operation Centres (SOC).
Essential processes to mitigate cyber risks relate tological access and password policies, anti-malware
solutions, regular patch management (combinedwith regular vulnerability scanning) penetration
testing, risk assessments and cyber incident
response through a coordinated response team andsecurity operations centre.

•••••

6There have been commendable advancements inthe enactment of cybercrime and data protection
legislation by East African countries following theestablishment of the 2014 African Union Convention
on Cyber Security and Personal Data Protection.
Such legislation makes it possible to prosecutecybercriminals and act as a deterrent factor whenenforced.
Regards enhancing cyber risk management
practices in the banking sector, the Central bankguidelines have played a key role, closely followedby the data protection laws passed within the same
countries. These regulations and guidelines outline
minimum security measures that organisations
should implement to protect customer assets.
Equally the regulatory push has elevated theimportance of cyber-awareness to board-level,
whereby there has been an increased need for Chief
Information Security Officers (CISOs) to fully quantify
and explain the organisations’ cybersecurity postureand exposures.
Cyber risk quantification is a fairly new concept inAfrica. Various frameworks have been designed
specifically to assist CISOs and security teams toquantify their risks and present this data in a clear
and quantifiable manner.
Despite potential benefits in mitigating cybersecurity
risks and fighting fraud, East African banks have
not yet operationalised artificial intelligence and ingeneral have a negative perception of blockchaintechnologies.

CYB E R S E CUR I T Y I N T HE B ANK I NG I NDUST R Y: T E ACHI NG CAS E S T UD I ES

Conclusion

The studies highlight that a
number of challenges remain
to be addressed, such as
greater investment in humanresource development acrossorganisations, policy makers
and law enforcers to guide thechanging face of technology
innovation and to avert
potential cybersecurity risks.
The need for greater co-operation between
FinTech innovators and regulatory bodies is clearlyflagged, however on a positive note, regulators
are adopting models such as FinTech observation
techniques in controlled sandbox environments.
There is a clear intention not to stifle innovation,

7and ensure policy guidelines are well informed toavert negative outcomes and cybersecurity risks.
Security and risk experts within Africanorganisations have identified methodologies andframeworks for minimising and quantifying theirrisks within their limited budgets. Overall, cybersecurity risk minimisation has to be seen as anever-ending challenge that will require Africanorganisations to continuously adapt and tackle.
These two case studies developed by GBSN will be
used in business schools across Africa to teach thenext generation of cyber security professionals.
In the short-term, they offer good insights andguidance for financial institutions on how tocontinue the fight against cyber-crime.
*About the Global Business School Network: GBSN is a nonprofit organization that partners with business schools, industry,foundations and aid agencies to improve access to quality, locallyrelevant management education for the developing world.

CYB E R S E CUR I T Y I N T HE B ANK I NG I NDUST R Y: T E ACHI NG CAS E S T UD I ES

The SWIFT Institute,
set up by SWIFT,
funds independent
research, supports
knowledge-led
debate and provides
a forum whereacademics andﬁnancial practitioners
can learn from eachother.
8W W W .S W I F T I NS T I T UT E .O R G