Accra, March 22, 2018//-Bank of Ghana (BoG) would soon require financial institutions to publish bank-specific cyber security policies in line with the provisions in the Payment Systems and Services Bill which is expected to be passed by Parliament soon.
The move is to help protect players in the financial sector against cyber-attacks within and outside the country.
The Governor of BoG, Dr Ernest Addison disclosed this at a summit on digital banking and cyber security organised by Standard Chartered Bank in Accra.
He added: “Financial Institutions would also be required to implement an integrated approach by adopting enterprise-wide frameworks of cyber risk management in line with business objectives”.
It is anticipated that the integrated approach to cyber security management would support financial institutions achieve both business and security focused objectives, as well as regulatory compliance in an efficient and effective way, according to him.
As policymakers and regulators, Dr Addison assure that they would continue to exercise firm oversight of the payment system, monitor risks associated with digital innovation and develop appropriate regulatory responses without stifling innovation.
What BoG has done so far
So far, the BoG has prepared a banking sector Cyber and Information Security guidelines to protect consumers and create a safer environment for online and e-payments products.
Among others, the guidelines seek to; create a secure environment for transactions within the cyberspace and guarantee trust and confidence in ICT systems; provide an assurance framework for the design of security policies in compliance to global security standards and best practices by way of cyber and information security assessments; and protect banks, customers and clients against the potentially devastating consequences of cyber-attacks.
—-the onus lies on banks—
Dr Addison noted that; “regulatory compliance by itself is not cyber security. The onus lies on banks to examine the state of their security systems, identify gaps and design appropriate mechanisms to counter possible cyber threats”.
“Today’s world is completely different from a decade ago as changes in information and communication technology increase exponentially. Consequently, financial institutions need to undertake cyber security-related due diligence and assessments, identify proper detective controls, and enforce third party and insider risk programs”.
The digitization of banking operations has engineered innovative financial products and expanded the scope of financial services alongside improved payments and settlement systems. This continuous technological advancement has radically changed how banks conduct their businesses, transformed ways of engagement with customers, and ultimately expanded the scope for financial inclusion.
These notwithstanding, the growth of technology-driven electronic payments are also associated with cyber related risks such as insecure card data systems and identity theft. Cyber-attacks that target customer transactions and online banking services have increased in tandem with financial technology.
Indeed, financial institutions are not only targets for cyber-attacks but also bear significant legal and fiduciary responsibility to safeguard customers’ privacy and data.
Globally, cyber-attacks on digitized payment products are increasingly becoming sophisticated, especially on financial institutions with insecure IT systems.
“We have witnessed global cyber-attacks which resulted in disruptions to some critical financial services and destroyed financial assets and savings. It is important therefore to ensure that the security of electronic banking products and services are not compromised”.
African Eye Report
