The NDPC Fines Fidelity Bank for Data Breach
On August 21, 2024, NDPC Fines Fidelity Bank. The NDPC (Nigerian Data Protection Commission) issued a huge fine of NGN 555.8 million to Fidelity Bank Plc. Since the commission was established on the 4th of February, 2022, this is one of the few penalties imposed on any organization. The investigation into the data processing activities of the bank started with a complaint lodged with the NDPC. The complaint stated that the bank opened an account for the complainant with personal and sensitive data without express permission of the subject. According to the NDPC, “It is to be noted that the Commission’s initial decision was issued in July 2023, and a directive to pay a remedial fee was issued in December 2023, and over ten correspondents were exchanged. The Commission issued repeated warnings to no avail. The Commission gave several opportunities for full accountability for over one year, considering the need to encourage compliance as a culture. However, Fidelity Bank did not provide the requisite, satisfactory remedial plan.” The commission, NDPC, was left with no other alternative than to issue a fine. NDPC Fines Fidelity Bank For What Reasons? During the investigation, NDPC found the data processing platforms of the bank lacking. Fidelity Bank was found guilty of the following: Why Does It Matter? Personal data is a very important part of every individual and organization. Some examples are: name, credit card number, bank details, age, etc. These data are often used by hackers and cybercriminals to perpetrate crimes like identity theft, fraud, and targeted accounts. Since organizations like banks and businesses gather such information for processing, they need to devise means of data protection. To combat this, Nigeria passed the data protection bill into law as the NDPA (Nigerian Data Protection Act) on 12, 2023. This law guides all organizations towards maximum protection of Nigerian citizens’ data. Now, this law isn’t limited to institutions in Nigeria. For instance, a company in the EU is subject to the NDPA, and so far, the data of a Nigerian is involved. To break it down, these are some of the principles of data protection followed by every organization: In addition to the above, businesses or organizations are mandated to outsource data processing to compliant third-party agencies only. What Does This Mean for Nigerians? The Nigerian banking sector lost approximately NGN 273 billion in 2022 and the number has spiraled beyond that. This shows the importance of data protection and security for banks. Let’s link this back to the ‘NDPC fines Fidelity Bank’ fiasco. Based on the allegations, Nigerians who have accounts with Fidelity Bank are at higher risk of data loss to criminals. Why? The agency the bank uses to process personal data is not NDPA-compliant. In addition to external threats, the personal or sensitive data of their clients risk threats from the inside. All it takes is one corrupt official and the rest is history. Really, the list is endless. What Was The Bank’s Response to The Trending “NDPC Fines Fidelity Bank”? The bank has denied all allegations of data violations by the NDPC. In a statement released on Thursday and signed by Dr. Meksley Nwagboh, Divisional Head, Brand & Communications, Fidelity Bank Plc. said, “Our attention has been drawn to a news story titled, ‘NDPC Fines Fidelity Bank for Data Breach.’ “While the matter is the subject of an ongoing engagement with the regulator, we wish to assure the public that we have conducted ourselves to the highest ethical standards by ensuring full compliance with existing laws on data protection. “Below is a breakdown of our dealings with the NDPC since we received their letter informing us about an alleged data breach: “On April 30th, 2023, we received a notice of investigation from the Nigerian Data Protection Agency (NDPA), now the Nigerian Data Protection Commission (NDPC). “The investigation was in respect of a complaint from [name has been withheld to protect the identity of the complainant], who claimed that [name withheld] details were used to open an account in the bank without [name withheld] consent. “Based on this notice, we conducted an internal investigation into the circumstances surrounding the claim and discovered as follows: It continued; “On May 2, 2023, we responded to the NDPC that the bank did not violate any law because there was no data breach and that the account opening process was not completed. “On our part, we carried out due diligence by immediately blocking the account and subsequently closing the account when we did not receive the outstanding documents. “At no point in the process was the account ever operational. “On July 7th, 2023, we were invited for a pre-action meeting with NDPC. During the meeting, we restated our position as earlier communicated to them in our letter dated May 2nd. “However, despite our explanation and evidence provided to support our claim, the agency informed us that they had reached a conclusion to impose a penalty on the bank. “On December 5, 2023, we got a letter from NDPC demanding we pay a’remedial fee’ of N250 million within 21 days. “We immediately commenced another round of engagements with the Commission as we were convinced we had not breached any existing law or regulation. “While discussions were still ongoing with the NDPC, we received another letter on the 20th of August demanding that we now pay N555.8 million naira. What’s Next After NDPC Fines Fidelity Bank As we anticipate further news on the situation, we hope Fidelity Bank proves its innocence. Otherwise, it might not survive the reputational and financial consequences. The data breach at Fidelity Bank serves as a stark reminder of the risks associated with digital information. The fine imposed by the NDPC can’t even be compared to the threat it poses to individuals. Financial institutions need to prioritize data security and invest in robust protection measures. You can trust us at Johan Consults. If you are a business owner and you are struggling with NDPR and GDPR compliance, you can contact us for a consultation.
The Importance of Data Security in 2024
Introduction An organization comprises several sectors or departments. And the synchronization of all their activities makes the organization functional. How does the importance of data security come into play?. Data is an important part of every business and organization. It‘s use is versatile and broad. Organizations make use of data to know the pain points of their target audience, scope out the competition and do marketing. This article reveals the basics of data security and highlights its importance. Read on. What is Data Security? Data security is the process an organization takes to keep data safe from compromise, cyber attacks, mishandling, and other woes. All businesses, whether large, medium, or small, are at constant risk of data breaches—emphasis on ‘constant’. While SMEs think they aren’t on the target list, that couldn’t be more false. Small and medium businesses have proven to be easier targets of cyberattacks because they don’t have a comprehensive data security system. As a matter of fact, statistics show that SMEs will make up a large percentage of the total victims of attacks in 2024. Large corporations are not left out either, but they usually have better ways of securing data. Regardless, the financial implications of a successful data breach frustrate the big guns. The importance of data security goes beyond the one stated above. It is a legal requirement under several data protection laws, like the GDPR, NDPR, and the Data Protection Act of 2023. These laws mandate organizations to secure the personal data of employees and clients against unauthorized access, loss, and compromise. Failure to comply with the data security requirements of these laws incurs severe penalties. Differences Between Data Security and Cyber Security While the application of these terms overlaps, they cannot always mean the same thing. Data security is simply concerned with safeguarding data; on the other hand, cyber security protects the entire digital assets and computer system of an organization. For better comprehension, cybersecurity is the fence protecting the building (digital assets and computer systems) and data security is the door protecting a room (databases) in the building. Types of Data Security There are several ways you can safeguard data as an organization. You can use any combination of these methods you find suitable for your business. Below are some of the most common types of data security. Data encryption Data encryption is the logical scrambling of a dataset to prevent unauthorized parties from understanding it. This is perfect because hackers and other vile people cannot read it without a decryption key. Data erasure Data erasure is exactly as the name implies. After processing data for the intended use(s), you’ll need to get rid of them in accordance with the GDPR and NDPA. This method gets the job done without leaving a trace. Data backup Data backup involves storing another copy of the information on a secure external database. Do not mix it up with data storage. When you lose the original copy, you can easily retrieve the secondary copy as a replacement. This ensures data resiliency (continuity of data after loss or compromise). Data masking Although similar to data encryption, this method is a bit different. Rather than scrambling the data, some characters in the data are replaced with entirely different characters. This makes the information unreadable without the password. Authentication This is probably the most important type of data security. Here’s how it works. To access a particular data or database, authorized users must prove that their identity is accurate. This can be done with a login and password system. Biometrics like fingerprints and rectinal scans are further steps to authentication—two-factor authentication. Firewalls A firewall secures data by blocking access from certain IP addresses. importance of Data Security The importance of data security cannot be overemphasized. These are some reasons why you should take data security seriously in your organization. Unnecessary expenditure Businesses are always on the receiving ends of data insecurity. The reason why is that corporations have to spend significant amounts of money to reverse the damages inflicted during data loss, compromise, and theft. Aside from that, the owners of compromised data can seek to file lawsuits against the institution careless enough to lose data. Such actions take a toll on the company’s pocket. Automated attacks The importance of data security shows itself here. Hackers found an easier way to attack in the form of BOT attacks. It’s an automated system with which they can consistently raid your database without breaking a sweat. To combat this, all businesses need to update their data security systems. Reputational damage Absolutely no one would trust a brand known to always lose their data. Most data held by organizations is very personal and sensitive. Examples are names, bank details, health status, social media passwords, etc. The illegal release of such data is dangerous to its owners, as impersonations, targeted attacks, and online scams will be issued against them. Therefore, organizations need to secure data to protect brand image. Data integrity The integrity of data relies on its reliability and accuracy. This means that for data to maintain its integrity, it must be void of compromises or variations as much as possible. You can maintain data integrity through the centralization of data storage and putting it on various servers. This ensures that uncompromised data is available at all times. GDPR Compliance The General Data Protection Regulation is the law that guides organizations towards data protection in the EU. Although an EU law, the GDPR is regarded as the most comprehensive data protection regulation in the world. organizations In compliance with the GDPR, businesses and organizations have to implement foolproof data security systems. Why? The law penalizes defaulting entities with fines, sanctions, and even outright bans. Conclusion In 2024, data security will be a must for all organizations—small, medium, and large. With it, you can prevent financial loss and reputational damage in addition to complying with legal regulations like GDPR. endeavor to mount more data security methods in your organization; you’ll be better for it. Want more info on
What Is Database Activity Monitoring (DAM)? Benefits, Features, Techniques And Software
All organizations have one major life source in common: data, and it’s constantly under siege with cyberattacks by malicious actors. A successful instance of such attacks leads to data breaches, which typically spell doom for businesses. Eventually, the consequences of data breaches, such as identity theft, online scams, financial implications, and reputational damage, pushed organisations to data protection. As a key component in protecting data from external threats, organizations emphasize data security. Data security is a very complex procedure, and owing to the large database most entities possess, the risk of a data breach is almost 100%. Common threats to databases are: SQL Injection: The use of malicious SQL codes to manipulate databases for information access. These are one of the most common web hacking techniques. Malware Attacks: These use software embedded in the database to disable it or steal information. Denial of Service attacks involve flooding a database with queries to stunt or shutdown its performance. In this article, you’ll find information on Database Activity Monitoring, its architectures, features, examples, and a DAM solution checklist. What is Database Activity Monitoring? Any solution used to monitor and analyze database activity in real-time. It is a compilation of tools that help identify and report illegal and negative activities with minimal impact on user operations. The process of monitoring database activity has gone past analyzing user activity in and around related database management systems. Nowadays, DAM works by combining several methods like memory scraping, network sniffing, database audit logs, and reading system tables to paint an accurate picture of the database activities. Why Do Organisations Need DAM? Most databases have one problem, It’s the lack of records. Should a cybercriminal wiggle his/her way into the database, they have enough access to carry out their crimes and wipe out all traces undetected. Considering that data breach discovery already takes too much time, the case above further lengthens the time frame. So, organizations, especially the large ones, need a system that actively monitors each and every activity on databases in detail. Benefits of Database Activity Monitoring Keeps a log of database activities; every activity is recorded, including the identity of the person. Ensures compliance: This is an aspect overlooked by many organizations. DAM is important, since 137 out of 194 countries have laws and regulations to guard the data of their citizens. DAM helps organizations comply with laws like NDPR, CCPA, and the revered GDPR. These regulations carry serious penalties, such as fines and sanctions for non-compliance. Implements division of labor amongst data administrators Generates alerts for data breaches: a lot of times, data breaches occur at the hands of unauthorized entities. DAM alerts the administration of instances of unauthorized access in real time. Key Features of Database Activity Monitoring There are certain features that define DAM. Some of them are as follows: Enhanced data privacy: proactively identifying vulnerable data Automatic identification and classification of different types of databases, such as RDBMS, NoSQL, in-memory, distributed, and big data systems. Safe storage and auditing of database activities and logs in a location separate from the monitored database. Better insight into application traffic and greater accountability for end users. Facilitation of informed decision-making through advanced analytics and reporting. Cross-Platform Compatibility: Supports on-premises, cloud, and hybrid environments. Common Challenges In Database Activity Monitoring Although DAM has been established as an essential part of data security, there are a few hurdles that make its implementation difficult. Encrypted Data: many data are encrypted to prevent unauthorized access. While it’s a welcome data security practice, it can mask both legitimate and suspicious activity. Large Volume of Data: some organizations hold large volumes of data. This may strain database activity monitoring systems. System Performance Impact: use of profilers, logging, and agents can slow down the performance of the database system. Database Activity Monitoring Tools and Techniques Database Profilers: These tools help to understand the database workload by tracking performance metrics such as; CPU Usage Memory usage User sessions Resource pools Connection statistics Query performance Buffer Cache details System and user errors Automated Monitoring Solutions: Examples, Datadog and Nagios, are perfect for continuous oversight of databases. They watch over performance metrics non-stop and give red alerts for suspicious activities. Common Database Activity Monitoring Architectures There are 3 main architectures to implement DAM, which are interception-based, memory-based, and log-based. Interception-Based Most DAM systems in the present day monitor databases by intercepting the communication between database server and client. This interference can happen at several points, like, Database memory level Network level Operating system level Database library level This type of architecture can prove too slow to catch unauthorized queries. Memory-Based Some DAM systems use a small, simple tool that links to secure databases. This tool constantly checks a part of the system where data is stored (SSystem Global Area-SGA) to collect and monitor SQL commands as they run. This approach provides comprehensive coverage of all database transactions. It can also be used to secure databases regardless of their locations (cloud or any IT infrastructure). Log-Based Some Database Activity Monitoring (DAM) systems can retrieve valuable information by inspecting the logs that record changes to the database. These logs keep track of all the changes and can provide useful details about the transactions that have occurred. By analyzing these redo logs, they can gather a lot of important data. A downside of this architecture is that not all the data needed for DAM is stored in redo logs. Therefore, the system will need augmentation from native audit trail information. Database Activity Monitoring Tool Checklist This is a checklist organizations can use to select a DAM tool most suitable with minimal effects on their databases. Should provide real-time ongoing monitoring of all SQL traffic, including network-based SQL traffic. Should be able to start a TCP when blocking a session to ensure the database remains unchanged. Should be able to send alerts over multiple channels. Should use minimal network bandwidth when checking incoming SQL statements to the gateway. Should not take up more than 3% of CPU and disk resources. Top Database Activity Monitoring Tools Varonis IBM Guardium SolarWinds Database
