Security

Nigerian startups have suffered more than their own fair share of hacks in recent times. This is particularly true of financial technology startups and their applications. These hacks usually lead to a compromise of users’ information and more importantly, their funds domiciled on those platforms.
These breaches are usually attributed to the general security infrastructure breach. However, there are no real explanations as to why and how these infrastructure breaches happen. However, <a href="http://ec2-44-233-33-191.us-west-2.compute.amazonaws.com/x/d?c=36043786&amp;l=4e73e591-79c6-47a6-9efb-9a1ffbb16d85&amp;r=92cf0a21-0ea5-4dbf-ad38-6475d1e963f8" target="_blank" rel="noopener noreferrer nofollow">Deimos</a> a leading African cloud-focused cybersecurity company has revealed the mistakes startups make that lead to security breaches.
In a statement to Technext, the South Africa-based cybersecurity company highlighted the common pitfalls that startup organisations encounter when securing their operations. According to the company, most problems are more human problems than technical. These include:
Startups prioritise speed and agility over security in their go-to-market strategy; Pursuing a reactive approach to cybersecurity – that addresses security only after breaches or cyberattacks have already occurred. Finally, not implementing secure access control measures for employees working with sensitive information and systems.
<div class="wp-block-image">
 <figure class="aligncenter size-full" data-beyondwords-marker="b9c2598f-b9ae-452d-ab6c-0bf9de46fce5"><img width="512" height="250" src="https://technext24.com/wp-content/uploads/2021/09/Patricia-2.jpeg" alt="" class="wp-image-124657" srcset="https://technext24.com/wp-content/uploads/2021/09/Patricia-2.jpeg 512w, https://technext24.com/wp-content/uploads/2021/09/Patricia-2-300x146.jpeg 300w" sizes="(max-width: 512px) 100vw, 512px">
 <figcaption>
 Nigerian fintech, Patricia recently suffered a security breach
 </figcaption>
 </figure>
</div>
Expanding it further, Director of Security Engineering at Deimos, Deen Hans, explained that startups tend to prioritise the quick release of features as against making sure their security is tight. He said while pursuing quick go-to-market feature deployments, they sometimes accept security risks that may have a more devastating impact instead of delaying releases.
He also pointed out that startups usually carry out inadequate or no risk assessment at all.
<blockquote class="wp-block-quote" data-beyondwords-marker="849d73ec-6949-47eb-b304-2fc8b44c4aaf">
 “Startups tend to measure risk from the standpoint of having a smaller user base, or on the basis of not yet encountering a security breach or incident yet. This leads to deprioritization, or complete oversight of security issues in their production environment that can lead to reputation damage or loss in user trust, primarily as a result of a data breach<cite>Deen Hans, Director of Security Engineering at Deimos</cite>
</blockquote>
Finally, he said startups fail to understand risk appetite. According to the security chief, there must be a balance between feature development and security in a startup environment. Trade-offs also need to be made to make security improvements after releases. He said many startups do not have a full overview and insight into their risk appetite and this would lead to making trade-offs that negatively impact their business.
“Risk appetite goes hand in hand with identifying and having a good grasp on what are a business’s most valuable assets they need to secure, be it their user’s private identity, financial data or monetary funds. Having a full picture of what needs to be secured, aids in not making incorrect assertions that can compromise the assets required for a business to operate and to uphold user safety and security,” he finished.
<h2 id="how-startups-could-protect-themselves" data-beyondwords-marker="d05a8b01-a023-45e3-95a1-7e0744966d71">How startups could protect themselves</h2>
According to Kaspersky, the world’s largest private vendor of Internet security solutions, nearly 57,116 Distributed Denial of Service (DDoS) attacks were reported in Q3 2022. During these DDOS attacks, an attacker floods an organisation’s server with traffic to prevent users from accessing connected online services and sites.
<div class="wp-block-image">
 <figure class="aligncenter size-full" data-beyondwords-marker="3ae9e9bc-ea47-4271-bb1c-41922348d2e4"><img width="670" height="450" src="https://technext24.com/wp-content/uploads/2023/10/Deimos.png" alt="3 reasons why fintech startups get hacked and how they can protect themselves" class="wp-image-218611">
 </figure>
</div>
Deimos noted that DDoS attacks and similar breaches are due to a failure in prioritising good governance practices, education, and awareness of cloud technology from a security perspective. However, many startups are uncertain about their compliance status and the state of their security, sometimes realising security flaws at the last moment before launching their services and apps. This automatically necessitates a return to the development stage.
IBM estimates that 82% of breaches involved data stored in the cloud. As African companies transition to remote teams and embrace cloud operations in their day-to-day activities, they often overlook access control measures and necessary permissions, thereby creating vulnerabilities. A single compromised user can have far-reaching consequences.
Verizon’s 2023 <a href="https://www.verizon.com/business/resources/reports/dbir/" target="_blank" rel="noopener noreferrer nofollow">Data Breach Investigations Report</a> estimates that 74% of breaches involved the human element, which includes social engineering attacks, errors or misuse. Deimos agrees, observing that the absence of cybersecurity in Africa primarily impacts remote work. It therefore advocates automated security processes to reduce manual reviews and controls, thereby mitigating human errors.
As remote and hybrid work is the new normal, businesses increasingly rely on cloud technology. Deimos sheds light on three vital methods engineering teams must apply to increase their cloud security:
Shifting left: This involves moving the security planning, design, and testing of key products earlier in the software development life cycle, rather than after release. This means thinking about security right from the start of making a new software or product, not just after it’s finished
Defending right: This includes implementing firewalls and intrusion detection systems to protect products from external threats. This is like putting up barriers and security systems to protect your products from outside threats.
Using Automated Tools: Think of this like using smart machines to check your work. These tools can look for any mistakes or weaknesses in the code or software you’re creating. Utilising automated tools to establish guardrails before moving into production – such as static and dynamic application security testing, or package vulnerability scanning, to analyse source code, software packages, or web application respectively, for vulnerabilities. Utilising automated tools to establish guardrails before moving into production.
<div class="wp-block-image">
 <figure class="aligncenter size-full" data-beyondwords-marker="51fe3961-260b-4d25-ab38-d37788c36672"><img width="700" height="275" src="https://technext24.com/wp-content/uploads/2023/10/Startup-closed.jpeg" alt="" class="wp-image-218613">
 <figcaption>
 Security breaches could lead to startup failure
 </figcaption>
 </figure>
</div>
These protections are crucial for Africa’s fast-growing tech ecosystem which holds lucrative data and assets within the cloud, making unprepared businesses an attractive target for cybercriminals. Each breach further impacts millions of Africans, across the continent and diaspora, and whilst cyber security solutions are readily available, many are not followed.
Deen Hans, Deimos’ Director of Security Engineering, emphasised that businesses must “fortify themselves against cloud security vulnerabilities. In my experience working with our clients, the focus is very much on operations that lead to growth, competitive edge and so on. A Cybersecurity strategy usually comes in the aftermath of a breach. However, this can be costly, with critical vulnerabilities that damage reputation and erode trust. The consequences of pursuing growth without a strong security posture can be detrimental,” he finished.
Similar read: <a href="https://technext24.com/2023/05/30/cyberattack-concern-for-nigeria-fintechs/" data-type="post" data-id="194656" rel="noopener noreferrer nofollow">MoMo, Flutterwave, now Patricia; Nigerian fintechs must work harder to prevent cyber attacks</a>

3 reasons why fintech startups get hacked and how they can protect themselves

Table of Contents

Technext.ng

Other articles published on Oct 19, 2023

Crypto Market Analysis: End Of Bear Market is Near; When Will Bitcoin & Altcoins Bounce Back?

Lightning Labs Released Taproot Assets Mainnet Alpha, Enabling Stablecoin and RWA Issued on Bitco...

Tesla Continues to Hold Bitcoin Without Selling: What Does It Mean for the Crypto Market?

Superdao shuts down, will return investor funds

IOTA 2023: Can IOTA Display A Rise, Despite A Bearish Trend?

Terra Luna Classic Price Prediction as LUNC Lags Broader Crypto Rally – Here’s Why the Shitcoin W...

Join our free newsletter for daily crypto updates!