BBQ 109
An evolving battleground in the finance sector
CYBERSECURITY
David Loxton chats about the current state of cybersecurity in South Africa
Banks, fintechs and other service pro-viders invest heavily in cybersecurity. But is the network of third-party pro-viders, technology partners and outsourced services they depend on as well protected as their internal operations?
“In the field, we sometimes see a relaxing of critical checks and balances, especially as the relationship between the organisation and its providers matures,” says David Loxton, CEO at Loxton Forensics.
Such complacency could cause a cyberse-curity disaster with severe legal and reputational consequences.
A growing threat
AI and AI agents have introduced dangerous new forms of attack for cybercriminals, state-sponsored groups, hacktivists and others seeking to breach corporate systems.
Cybersecurity is now an evolving battle-ground on which organisations must continually adapt.
In July, autonomous AI agents broke free of their sandboxed testing environment at OpenAI, accessed the internet and launched an unauthorised cyberattack on the Hugging Face AI platform. Their objective was to obtain information needed to complete a task assigned by their trainers.
Imagine the consequences in the hands of a determined cyberattacker.
AI and AI agents have introduced dangerous new forms of attack for cybercriminals, state-sponsored groups, hacktivists and others seeking to breach corporate systems.
“Organisations are rushing to keep up, but they need to assure themselves that their vendors are moving at the same pace and all routes in their service supply chain are locked down,” says Loxton.
Trust no one
Under Zero Trust principles, companies should treat service providers and their sys-tems as untrusted and vulnerable, even if cybersecurity audits suggest otherwise.
This demands continuous verification of external attempts to access, transfer or pro-cess their data.
“However, once the data is outside the organisation, providers must guarantee the appropriate level of system security required to protect it—one that cascades down to their own vendors,” says Loxton.
Most companies have contracts binding providers to strict SLAs, timely intrusion alerts, prompt patching, regular audits and other good practices.
Trouble arises when personal relation-ships compromise these commitments. Loxton says the worst sin is leniency.
Relationship woes
He has encountered poorly drafted con-tracts, even at major financial institutions, giving vendors too much leeway in imple-menting essential standards because of their reputation or previous dealings.
Even an ironclad contract can unravel. Re-newals may be awarded without the strict reviews conducted at initial signing.
Most companies have contracts binding providers to strict SLAs, timely intrusion alerts, prompt patching, regular audits and other good practices.
“Unfortunately, the trust developed between the parties can lead to an almost automatic renewal that assumes, without question, that the vendor has maintained its original standard,” says Loxton.
One-time deviations or compliance lapses may initially be overlooked but become more pronounced with each renewal.
“This can result in a fairly unregulated relationship with the vendor, leading to un-acceptable operational and legal risks that go unnoticed until catastrophe strikes,” says Loxton.
Assured impartiality
Due diligence when onboarding a vendor is insufficient. Non-compliance typically emerges through ongoing monitoring, access-rights audits and reviews of incident notification obligations.
An independent department should reg-ularly monitor vendors, assess their performance and review contractual oblig-ations for inconsistencies.
“Most importantly, this independent body should monitor and review the relationship between the approver and the vendor to ensure contracts are based on demonstrable value rather than industry reputation or per-sonal trust,” says Loxton.