The increasing frequency and magnitude of cybercrime incidents globally make it apparent that cybercrime is here to stay, according to a report by KPMG.
In the report, KPMG acknowledged that the Central Bank of Nigeria’s report for the first half of 2013 noted that there were 2,478 fraud and forgery cases involving Nigerian banks valued at over N20 billion.
This represented an 8% increase over the previous year volume but a significant increase in value of over 200% from 2012.
In its 2014 survey, KPMG reported that 2% of retail customers indicated that they had experienced a fraud incident in the last year.
Thus, the researchers expressed worry that while this number appears small today, it may signify the start of a potentially disturbing future trend.
Gerben Schreurs, John Hermans and Olumide Olayinka, partners at KPMG, wrote in the report, “Although the internet banking has an underrated opportunity and while the adoption of electronic banking has provided some measure of convenience and ease to customers, it is difficult to ignore the resultant security risks that may face customers and financial institutions at large.
The trio highlighted that the growing popularity and convenience of electronic banking has further presented enhanced opportunities for cybercrime.
There is a far-reaching scope of threats that range from low degree crimes to high volume and value crimes, all with the potential to impact large corporations and individuals.
The survey also revealed that “Awareness Needs Continuous Efforts’, hence security awareness and understanding of risks is crucial in cybercrime defence.
“As attackers understand the risks of people, processes and technology and how to exploit them, so should organisations. As a consequence, organisations should ask themselves whether they are aware and capable of handling a cybercrime attack.
“From our survey, we found that 35% do not agree that their organisation is sufficiently aware of cybercrime, although the financial sector respondents score significantly lower. This would imply that financial institutions are more aware of cybercrime than other typologies. As previously discussed, the full scale of cybercrime implications is often overlooked.
“The biggest loss companies perceive is disruption of business processes, but is this true or is it a lack of awareness?” they queried.
They added that understanding the motives is key, as attacks may come by various methods and means.
“Organisations have experienced some form of ‘social engineering’ attack such as phishing and compromised web applications according to 33% of the respondents. The main motives for attacks found are that organizations are perceived as ‘low hanging fruit’ for organised crime. Contrary to previous trends, espionage is not a relevant motivation for attackers, according to 63% of the respondents.
“Since detective internal control measures are currently not widely used by organisations, the increased use of these internal control measures might change the perspective of organisations on the means and motives of attacks. The financial sector represents 67% of the attacks where the attacker’s motive was access to money,” the report read.
When taking all sectors into account, consumer market companies are most concerned about disruption of business and production processes, KPMG said.
Loss of money, disclosure of intellectual property and other data are so far only recognized as a cause of attack to a limited extent.
Some of the major technical areas at high risk, they said, include email servers, web application servers, ERP systems, desktops, and unstructured data on file systems (file servers). Mostly mentioned were web application servers (38%), followed by file servers (16%) and mail servers (17%). Less frequent are attacks that have penetrated ERP systems, desktops, and process control domains (<8%).
Based on many reviews and security tests of web applications, we believe that many web applications and therefore websites are still insecure, and even contain ‘low hanging fruit’ weaknesses such as cross site scripting, etc.
Many websites are not developed with secure programming in mind, nor are they sufficiently tested for security before going live, KPMG highlighted.