Scammers Are Targeting Banks Directly In 2015, Expert Warned

“As you may be aware about two years ago the CBN mandated the entire banking industry to have anti-skimming devices against those who were skimming customers’ card and siphoning bank customer’s money. That was targeted at protecting the Bank customers; this has been achieved to a very large extent, as directed by the apex bank then. However, now that the CBN has taken the food from the mouth of the criminals, they will look for other means to eat, so we have seen ahead and discovered that the next crime the criminals will be committing is to take the attack directly to the banks. In the nearest future, the banks will be experiencing so many attacks, especially as it concerns the customers’ data and money. The criminals will be taking the money directly from the banks and not from the customers. For instance, there are situations already happening in Europe and some part of America, this started at Eastern Europe, whereby the ATMs would be dispensing cash without anybody inserting a card or its PIN. We are approaching some discerning banks, telling them the need to protect their ATM and other self service terminals. We are urging the banks not to wait till they see the attacks in Nigeria, before they will begin to protect their terminals, some of them are already responding. We hope to launch some of these products so that we can prevent banks from suffering some of these losses already suffered by Banks outside Nigeria. We also want to make the banks comply with some security standards, because digital crimes are a moving target, for the fact that you were secured yesterday doesn’t mean you are good for business today. So, we are expanding our service offerings from recovery to saving our customers’ data and to protecting the banks’ e-Channels business related transactions.”

Chief Executive officer (CEO) of Data Recovery Specialist Limited, Mr. Bolanle Omotosho, gave these details warning in an interview with ITPulse’s Martin Ekpeke. Excerpts:

Tell us briefly about Data Recovery and how you go about it?

Let me give a scientific definition of data recovery and then we go ahead to break it down. It can be defined as a scientific means of recovering seemingly lost information asset from digital storage devices. Seemingly lost in the sense that the information you think had been lost is actually not lost. What we do as a business is to assist organizations or individuals to recover a seemingly lost information asset from digital storage devices. The data is not lost unless we say so! That is our slogan.

How do you prevent data lost? Secondly, don’t you think cloud computing is gradually taking over your business?

One of the ways to prevent a data lost situation is to have a back up. You can have your physical back up in your office or keep it off-site. You can equally keep the information online as a data repository managed by a third party called service providers. Now, let’s talk about the cloud computing; it’s called cloud because you don’t see where your data is stored physically. The Internet is used to upload the data to the servers, which are outside your domain. That’s why it is called the cloud. Let me also inform you that when the Internet sends the information to the cloud, it goes to some peoples’ servers; nobody sends data into the sky. So, Cloud Computing is just a literary language, but because you don’t need to go to where the server is before accessing your information, it is then called cloud.

Apart from recovering lost data, don’t you think there is a need to consult with your client on proactive means for business continuity?

Yes! We do both reactive recovery and proactive data lost prevention services. Each time a customer comes to us, we always advise them of the need to be proactive. We did a serious recovery for a bank recently and they asked if there is no way we can prevent such incidents from happening, we told them we can help them set up a data loss prevention solution, such that, even if you suffer a data loss situation, the client would be able to recover it without calling us. It’s difficult to have a 100% data loss prevention solution, but what matters is the return time to operation, such that when a data loss happens, you would be able to return to work almost immediately. So, the essence of having a data loss prevention solution is to reduce your return to work time.

Can you say what you are doing is in compliance with privacy laws, because how do you confirm that the information you want to recover truly belongs to the person that has brought it to you?

We are an information security firm, and we understand what it means to protect privacy and confidentiality of information assets. Now, one of our policies is that when somebody brings in a device for data recovery, the person must give us a signed agreement showing the device actually belongs to him; and is being authorized to do the recovery on behalf of himself or the employer. We have terms and conditions that we operate with; one of such is that if a system has a password and you want us to remove the password, you must get an affidavit from the court to confirm that you truly own the device.

Can you mention any track record and success story?

We have a huge track record and success stories, but there would be no need to mention names to prevent negative interpretations that may be given to same. Meanwhile, there have been serious cases that we have been able to resolve; one of such was a case of a very big consulting firm, whose critical information assets were locked up in a hard drive of a laptop as a result of encryption, but we were able to decrypt the information asset after our normal diagnosis. There was also a government agency, who had taken information and images about houses and landscape in a particular state in the South-West Nigeria, but all of a sudden, the server where the information was stored crashed and became inaccessible. They called us and we were able to recover all the information for them within four days. We have also recovered critical information assets for several banks in the country. So, we have handled some landmark cases, even for the federal government, an agency in the Presidency was once our client.

What does the proliferation of Data Center mean for Nigeria?

What it will mean for Nigeria is that, over time, there will be a cost reduction on the part of business owners, who are required to have a Data Centre. Mind you, it’s not everybody that can afford a Data Center, but all the banks that you know have a disaster recovery center somewhere else as mandated by the Central Bank of Nigeria. I believe that as technology continues to evolve, and as data gets lighter on a daily basis, people will begin to subscribe to those Data Centre inasmuch as their privacy and confidentiality can be guaranteed.

What are the aspirations for this year 2016?

We intend to bring some partnership and innovative solutions to the market.

Any last word?

What I will add is that on a daily basis, frauds are being committed. At Data Recovery Specialist Limited, we have skills and solutions to mount on the network of an organization for the control unit to be monitoring to see who is trying to make some malicious transactions. We have solutions to discover already committed digital crimes; we also have a solution to detect crimes that are already being planned before they are executed. We also offer training services for corporate organization. And again, because prevention is cheaper and faster than cure, any organisation whose operations absolutely depend on systems must be ready to protect same and as well ensure the personnel are part of the protection chain simply because, unknowingly, a large number of crimes are committed and of course preventable, had it been the personnel knows the implications or his responsibilities at protecting the organisation he works with. [myad]