E-Business
Nigeria Needs Cyber security Office for Effective Coordination – Makatiani
William Makatiani, managing director, Serianu, recently visited Nigeria and spoke to chike Onwuegbuchi on cyber security issues
Africa is playing catch-up in cyber security
We are not prepared in Africa. The problem we have in Africa is that, we like to do easy things fast. Easy thing means deploy technology, some vendors will come and tell you this thing works in the US, put it in place and we put it in-place. The problem with that is you never get to look at security.
Security is complicated because there is local aspect around securing systems, most of our fraudsters live here, most of the banks that lose money are in Nigeria, in Ghana, in Kenya among others and those that perpetrate these frauds are within those environments. There is no way somebody will come from the US and secure it, that is the hard work. We need somebody to understand how these people are doing it.
Only locals can do it, those are the difficult things, implementation of the system is easier and those are the things we are focusing on.
When it comes to preparation we are not ready because we don’t have enough skills. Secondly, we are not ready because we are not collaborating. If you are Bank A and I’m Bank B, if you get compromised you keep quiet if it is insured you go get compensated and you will not tell Bank B and Bank B will get hit, it really empowering the hackers now they know they can get away with all these attacks.
Third issue is Malware- malicious software. We are not training our people well enough. You get an employee, an assistant to the chief executive officer, the CEO tells his assist if you get an email click on it, print it for me let me see what it is. Now, they are clicking on malicious links. Immediately they click they get Ransonware and get compromised and Ransonware takes over the network as you are looking at that our curriculum in the universities are old.
There is no single individual that can come from our traditional university that will be able to get into cyber security field without additional preparation.
We have those gaps. When you think of where we are headed and we need to ask ourselves how do we address it?
Our board members does not understand technology, if you tell them about the safe, that somebody is getting into the safe they will understand, but the safe is no longer save. The database is the new safe, if a board member cannot understand that Oracle database is the new safe there is pretty much they can be able to secure, so if I tell them I want to secure Oracle database, they will say last year we bought a router this year we have bought a firewall why are we buying something new? They will say no, but the padlock we bought for the safe last year was good but has gone out of the market we need a new padlock, that padlock will cover our database which is Oracle. This is the language we need to get to our board members.
The language technical people are taking to board members and senior managers is out dated, you cannot talk technology to somebody who spend his time playing golf or somebody who spends his time looking at financial statements you need to come up with something that is comparative.
From a typical corporate perspective the question is how do we change? If you come to global cyber security problem you have three steps.
First is, understanding what is happening; second is attributing it to an individual and third is how do we stop that individual?
In understanding in Africa, we are trying our best but we are 20 per cent, this has to do with deploying of technology to understand what is going on in the network. When it comes to attribution we are poor just 2 per cent , there is no single attack that has be successful being attributed very few, because these individuals came out and say it happened like this or this is what led to this or that.
If it comes to attribution of attacks happening in different countries in Africa it is not easy to attribute it to somebody, attribution is a challenge.
Deterrent requires law enforcement and it is where we are really struggling. Law enforcement agents are not working together you find judiciary, national intelligence or Army, they don’t know how to coordinate this issue of cyber security so that they can be able to attribute most of the bigger attacks to somebody. That is the biggest cyber security problem and that is where we are facing challenge.
Issues of lack of collaboration
The reason why there isn’t much collaboration is because of fear. For instance, with the private sector such as banks there is this fear that customers will run away, we don’t want people to know they have stolen from me, it is an African problem. Africans we don’t want sharing our things in public.
We have to move beyond where we are and only regulation will force people to talk to each other. If you get compromised, it is okay. It is normal let us know so that we allow other people to learn from that experience. That is the key.
Most of these law enforcement officials don’t coordinate because some of them don’t know. We also need to be very clear in terms of who is responsible for what, if you are an investigation agency, we need to know where you start and where you stop. If you are in national intelligence services, you need to help us develop intelligence on why banks are getting attacked, who is attacking and who is benefit from these money that is where you start and ones you get it you empower the police who are going out to investigate some of these crimes so that they can be able to be addressed.
If you are in the army you need to have intelligence to know if it is a state problem, if the hackers are coming from Ghana, Ukrane, Ruwanda or Kenya, you need to look at that and say how do we coordinate this? And then empower the prosecution and the judges so that they can make a clear case of what is going on when and how. That is the type of collaboration we need.
Impact of different regulatory agencies in the fight against cyber crime
If you have a cyber-security office which in Nigeria is lacking, this will have an incumbent who is responsible for cyber security policy in the country like we are seeing in the UK, South Africa among others, where you have office of the cyber security incumbent who could coordinate all these issues.
It can become a problem if it is political, he can’t do much. That is why it is allowed to run just like Attorney general.
The biggest problem with cyber security office depends on where it sits. For countries where it is located in the judiciary it works very well, because the whole idea is to be able to oppressionalize the security laws and if it is located under the attorney general it works very well. If you move it into ICT ministry it fails, if you move it into NIS or national security Agency it fails.
Cyber security law
Cyber security changes very fast, four years ago we didn’t know about Ransomeware, we didn’t know about cryptomining, cryptomining is a biggest thing now. What we see across the world is instead of us to focus on technology, we focus on particulars of crimes which means at the end of the day it is fraud, unauthorised access, there is sabotage and those were the results of somebody coming in and compromising in an environment.
Most of our laws are copy and paste especially from Malaysia, Singerpole. We copy our laws from those countries across Africa and if you look at the laws we have in place, they focus a lot on tools and techniques and that is what is out-dated.
The tools, techniques and processes of attacking have changed. We have to change from focusing so much on tools, techniques and processes and focus on fraud say somebody did A,B,C,D whichever way they did it, it is still a fraud.
Criminals 100 years ago were interested in stealing money, information about you, interested in making sure you don’t move, it is the same thing today. Criminal are interested in stealing money from banks, making sure you don’t provide service, interested in stealing Intellectual Property (IP) or private data. In terms of motive they have not changed, intentions have not changed and therefore we have to build flexible laws that address motives, intensions and the principles of what the laws are trying to achieve to deter.
Building Cyber security Skills in Organisations to Fight Cyber-attacks
If I were an ambitious leader, I will cancel quite a number of technology programmes in our curriculum, they are wasting time. Get in touch with the industry, get some professional from other countries, look at the areas of artificial intelligent, analytics, look at the areas of cyber security build practical programmes.
Start with forcing graduates to do one to two year programme where they learn practical, set up research foundations behind these new technologies, because if you don’t do it now, even smaller countries like Rwanda, Botswana Mauritius will be more powerful than bigger countries like even South Africa, Nigeria. In some of these areas, the problem is to start early.
Number one thing is to change the curriculum, the curriculum we have now is useless. Yes, it builds the people to the level where you can convert them, but it doesn’t build the curiosity to continue building your capability into analytics crypto. If you look at the curriculums of those in the United States, UK and Europe even Rwanda and Mauritius you now see the embedding of these new technologies and new media. First of all you have to start with that.
Number two, it is unfortunate the tools most of the professional we have in the market place are bringing are out-dated. The days of sitting somewhere looking at risk on huge template are gone, if you are going to lose money you lose money through the payment system, through a card or fund and risks starts there. And you fall back who is likely to do it? That has changed, now employees need to change, they don’t need to sit down in class, but they need to look at what they are doing, what is changing in the industry and then retrain in terms of approach.
The 2025 Kaspersky Security Bulletin provides a review of the major cybersecurity trends of the year and offers a look towards the future of cybersecurity, including within the financial sector.
According to the report, in 2025, the financial sector navigated a rapidly evolving cyber landscape, with malware spreading through messaging apps, AI-assisted attacks, supply chain compromises, and NFC-based fraud.
Based on Kaspersky Security Network statistics for the year (from November 2024 to October 2025), 8.15% of users in the finance sector globally faced online threats and 15.81% faced local (on-device) threats. 1,338,357 banking trojan attacks were detected by the company’s solutions. 12.8% of B2B finance sector companies faced ransomware this year – that marks a 35.7% increase in unique users in 2025 compared to the same period of 2024.
The company’s experts highlight the following cybersecurity trends and cases shaping the financial sector in 2025:
Large-scale supply chain attacks: the financial sector faced a series of unprecedented supply chain attacks, which are incidents that exploit vulnerabilities in third-party providers to reach their primary targets. The breaches demonstrated how vulnerabilities in third-party providers can cascade through national payment networks, affecting even central systems.
Organised crime converging with cybercrime: organised crime is increasingly combining physical and digital methods, creating more sophisticated and coordinated attacks. Financial institutions faced threats that blend social engineering, insider manipulation, and technical exploitation.
Old malware, new channels: cybercriminals increasingly exploit popular messaging apps to spread malware, shifting from email phishing to social channels. Banking trojans are being rewritten to use messaging platforms as a new distribution vector, enabling large-scale infections.
AI scales malware to new heights: this year, AI-enabled malware has increasingly incorporated automated propagation and evasion techniques, allowing attacks to spread faster and reach a larger number of targets. This automation also shortens the time between malware creation and deployment.
Mobile banking attacks and NFC fraud: Android malware using ATS (Automated Transfer System) techniques automate fraudulent transactions, altering transfer amounts and recipients in real time without the user noticing. NFC-based attacks have also emerged as a key trend, enabling both physical fraud in crowded places and remote fraud via social engineering and fake apps mimicking trusted banks.
Blockchain-Based C2 Infrastructure is on the rise: crimeware attackers increasingly embed malware commands in blockchain smart contracts, targeting Web3 to steal cryptocurrencies.
This method ensures persistence and makes the infrastructure extremely difficult to remove. Using blockchain for C2 operations allows attackers to maintain control even if conventional servers are shut down, highlighting a new level of resilience in cyberattacks.
Ransomware presence: these types of attacks remained a persistent threat for the financial sector with 12.8% of B2B finance organisations globally affected in November 2024 through October 2025. The figure for Africa is similar, with 12.9% of B2B finance organisations affected by ransomware from November 2024 through October 2025.
Disappearance of certain malware families: some malware families are likely to disappear, as their activity depends directly on the operations of specific criminal groups.
“In 2025, financial cyber threats evolved into a complex landscape, with attacks hitting businesses and end users alike. Criminal groups increasingly combined digital tools, insider access, AI and blockchain to scale operations, forcing organisations to secure not only their systems but also the human networks that support them,” said Fabio Assolini, Head of the Americas & Europe units at Kaspersky GReAT.
Kaspersky’s predictions for what finance cybersecurity might face in 2026, include:
Banking Trojans will be rewritten for WhatsApp distribution: criminal groups will increasingly rewrite and scale banking trojans distribution and abuse messaging apps like WhatsApp to target corporate and government organisations that still rely on desktop-based online banking. These environments are where Windows-based banking trojans thrive.
Growth of deepfake/AI services for social engineering: the trade in realistic deepfakes and AI-powered campaigns is expected to expand even more, fueling scams around job interviews and offers, driving underground demand for tools that fully bypass Know Your Customer (KYC) verification.
Appearance of regional info stealers: as Lumma, Redline and other stealers are still active, we expect to see the appearance of regional info stealers, targeting specific countries or regions, expanding the use of malware-as-a-service model.
More attacks on NFC payments: as a key technology used in payments, we’ll see more tools, more malware and attacks directed against NFC payments, in all types.
The advent of Agentic AI malware: agentic AI malware is characterised by its ability to dynamically alter behaviour mid-execution. Unlike conventional malware that relies on pre-defined instructions, agentic variants are designed to assess their environment, analyse their impact, and adapt their tactics on the fly.
This means that a single piece of malware could exhibit a range of behaviours, from initial infiltration to data exfiltration or system disruption, all in response to the specific defences and vulnerabilities it encounters.
Classic fraud will obtain new delivery: fraud will remain a major threat to end users, but its delivery methods will keep evolving. As new services and messaging platforms emerge, attackers will continue to adapt their tactics to the channels where their target audience is most active.
The persistence of ‘out of box’, pre-infected devices: the threat of counterfeit smart devices sold already infected with trojans (such as Triada) will continue to evolve.
These trojans often come with extensive capabilities, including the ability to steal banking credentials, and affect not only “gray” Android smartphones but also other smart devices such as TVs.
Kaspersky’s latest research reveals that the majority of compromised passwords not only violate password-safety guidelines but also remain unchanged for extended periods, which drastically reduces their security.
To provide users with access to more sophisticated and modern ways to log in, Kaspersky’s Password Manager has been enhanced with Passkey technology, enabling users to securely access their accounts while enjoying seamless cross-device synchronisation.
Although passwords still remain one of the major authentication methods, they no longer top the security charts. Often crafted by users themselves, passwords are heavily influenced by human factors, which makes them potentially vulnerable. Kaspersky experts analysed major password leaks from 2023 to 2025 and identified several recurring patterns:
- Users frequently append predictable elements like numbers, dates, and personal identifiers to their passwords. For example, 10% of passwords in datasets analysed contain a number resembling a date (from 1990 to 2025), 0.5% of all leaked passwords end with the number 2024, which is every 200th password!
- The most commonly occurring password combination is ‘12345’, which drastically reduces cryptographic strength and shortens the time required for brute-force attacks to succeed. Among other popular password components are the word ‘love’ and users’ names, as well as countries’ names which are also often included in passwords.
- Moreover, the majority of leaked passwords remain unchanged for years. In 2025, 54% of leaked passwords had already been part of prior data breaches, underscoring widespread reuse of outdated passwords. According to data analysis the average lifetime of the password found in these leaks is 3.5-4 years.
What makes Passkeys more secure?
All these findings highlight the critical vulnerability of password-based authentication when protocols for creation, management, and storage are not rigorously followed. In response to the growing need for robust security, the industry is increasingly shifting its focus toward next-generation solutions like Passkeys, which offer stronger protection against evolving threats.
Passkey technology is based on cryptographic keys and biometrics and is not subjected to threats like phishing or data leaks. A passkey is created for a particular account on a particular platform and is stored directly on the user’s device or in a password manager.
New Passkey feature in Kaspersky Password Manager
When a user registers on a platform that supports Passkey, the device creates a private key and shares a public key with the service. The private key is stored directly on the device, which is good from a security point of view, but complicates authorisation from other devices.
Now Passkeys can be created and stored directly in Kaspersky Password Manager, which allows users to not only sign in to supported services with a single tap, but also access Passkeys on all their devices owing to secure synchronisation.
“From our own experience, we’ve seen how constantly juggling logins and passwords for work, study and even leisure can erode both time and security. Kaspersky Password Manager has long streamlined this process with tools like our secure password generator and auto-fill functionality – ensuring users never sacrifice safety for speed.
In addition to that, we are happy to offer to our customers a new Passkey feature – an enhanced level of accounts protection which makes authentication even simpler and, most importantly, more secure,” comments Marina Titova, Vice President for Consumer Business at Kaspersky.
Passkey functionality is now available on all platforms in the latest version of Kaspersky Password Manager. To create a passkey in Kaspersky Password Manager, first update the app to the latest version and grant it all necessary permissions. Then, open the website where you want to create the passkey and simply follow the in-app guidance to register and save it.
Africa’s Global Bank, United Bank for Africa (UBA) Plc, has once again, reaffirmed its leadership as one of the continent’s most innovative and resilient financial institutions, as the bank has, for the third time in five years, been named the African Bank of the year 2025 by the Banker.com.
UBA
UBA also won the Best Bank of the Year awards in nine of its 20 African subsidiaries, bringing its total awards this year to ten as UBA Benin, UBA Chad, UBA Republic of Congo (Congo-Brazzaville), UBA Liberia, UBA Mali, UBA Mozambique, UBA Senegal, UBA Sierra Leone, and UBA Zambia, all came out tops as the best banks in their respective countries, underscoring the bank’s strength across West, Central and Southern Africa and highlighting the depth of its Pan-African franchise.
The Banker.com, a leading global finance news publication published by the Financial Times of London, organises the annual Bank of the Year Awards, and this year’s edition was held at a grand ceremony at the Peninsula, London, on Wednesday.
The Chief Executive Officer, UBA UK, Deji Adeyelure, received the awards on behalf of the bank, representing the Group Managing Director/CEO, Oliver Alawuba, and was accompanied by the bank’s Head Business Development, Mark Ifashe, and Head, Financial Institutions, Shilpam Jha.
The Banker’s awards are widely regarded as the most respected and rigorous in the global banking industry, celebrating institutions that demonstrate outstanding performance, innovation and strategic execution.
In its remarks on UBA’s winnings, the banker.com said, “For the third time in five years, UBA Group has won the coveted Bank of the Year award for Africa. UBA Group time after time punches above its weight against its larger African rivals. The bank this year also takes home nine separate country awards (one more than it gained for its last continental win in 2024), equivalent to around a quarter of the awards for the continent, and more than any of its continent-wide rivals.”
Continuing, it said, “Perhaps even more impressive is the fact that the awards were won across a broad geographic spread, going to lenders based in the Economic Community of West African States (Benin, Liberia, Senegal, Sierra Leone, and former member Mali), the Central African Economic and Monetary Community (Chad, Republic of Congo) and the Southern African Development Community (Mozambique, Zambia). Its award wins were particularly notable in the highly competitive categories for Benin and Mozambique.”
The Banker also highlighted UBA’s strong financial performance and commitment to future growth. In 2024, the Group recorded a 46.8 per cent increase in assets and a 6.1 per cent rise in pre-tax profits in local currency terms, while continuing to invest significantly in talent and technology. West Africa remains UBA’s heartland, with operating revenue and profit increasing by 87 per cent and 89 per cent respectively in H1 2025.
The bank’s digital and innovation leadership was equally recognised. During the year under review, and launched its Advance Top-Up buy-now-pay-later feature on the *919# USSD platform, expanding financial access for customers, while the bank’s chatbot Leo continued its strong growth trajectory, with transaction volumes rising by 29 per cent year-on-year in H1 2025. Notably, in August, Leo became the first African banking chatbot to enable cross-border payments via the Pan-African Payment and Settlement System (PAPSS).
UBA’s Group Managing Director/Chief Executive Officer, Oliver Alawuba, while reacting to the achievement, said the recognition affirms the bank’s long-term strategy and customer-first philosophy.
“This honour reflects the strength of our Pan-African network, the trust of our customers, and the dedication of our people. Winning Africa’s Bank of the Year for the third time in five years is not by chance; it is a testament to disciplined execution, innovation, and a deep understanding of the markets we serve,” Alawuba said.
“Our nine country awards across diverse regions of Africa show that UBA is not just growing, but growing with impact. We remain committed to driving financial inclusion, supporting economic development, and deploying technology that makes banking simpler, faster, and more accessible to Africans everywhere,” he added.
United Bank for Africa is one of the largest employers in the financial sector on the African continent, with 25,000 employees group-wide and serving over 45 million customers globally. Operating in twenty African countries, the United Kingdom, the United States of America, France and the United Arab Emirates, UBA provides retail, commercial and institutional banking services, leading financial inclusion and implementing cutting-edge technology.
FRC, ICPC Seal Anti-corruption Alliance
Debt Rises in AI Data Centre Boom
MoMo PSB Brings Relief to UNILAG Students with Ultra-Cheap Bus Fares
Young Africans Hit Hardest by Online Gender Violence, Paradigm Initiative Reports
Sterling Bank, Pan-Atlantic University Partner to Certify Non-Oil Export Academy Graduates
Kaspersky Introduces Cyber Pathways to Support Career Development in Cybersecurity
NITDA DG Tasks Youths to Drive Africa’s Digital Transformation
Firm Urges Organizations to Check Protection of their Websites Amid Search Engine Optimisation Attack Schemes
FCCPC Sets Deadline for Digital Lending Regulatory Compliance
Hackers Breach Phones of Dangote and Otedola, Demand Ransom
E-Financial3 days agoCBN Rejigs Financial Inclusion Strategy to Boost Economic Growth
E-Financial3 days agoSEC Urges IST to Freeze all CBEX Bank Accounts in Nigeria
News3 days agoFG to Use Digital Economy Initiatives to Curb Corruption Among Youth
E-Business3 days agoFinancial Sector Faced AI, Blockchain and Organised Crime Threats in 2025 – Report
Telecom3 days agoCOUCH 2025 Grand Finale Highlights Student Breakthroughs, Secures Government Pledge for University Research Commercialization
Broadcasting3 days agoEnd of an Era as Multichoice Delists from JSE After Canal+ Takeover
Telecom2 days agoAirtel Africa Foundation Opens Undergraduate Scholarship Portal in Nigeria
E-Financial2 days agoEcobank Nigeria to Fully Repay $300m Eurobond Ahead of Schedule