Do you consider that your institution is prepared to deal with the widest variety of cyber threats?
Our information technology area is constantly evolving and building its capabilities to ensure maximum protection and anticipation of potential threats. We know, however, that attackers also keep pace with this evolution, which is why continuous monitoring of global trends is mandatory for any institution that wants to be prepared to deal with the various threats. There is a culture of collaboration between various actors and the authorities for sharing information and learning, with the aim of becoming ever better equipped when it comes to the security of our environment. However, it is important to bear in mind that, when we talk about cybersecurity, competitive advantage is limited, since collaboration is of the utmost importance to ensure growth and development. We find ourselves in an environment where some of our information is shared with external parties, such as regulators and operators of financial infrastructure and services, all of which are also attractive targets for cyber attacks.


What kind of measures does the Bank take to combat cyber attacks?
The Bank has a proactive, multidisciplinary security model, with the capacity to identify, protect against, detect, respond to and recover from attacks, whether in physical and/or digital environments. In other words, we have preventive and detection mechanisms and controls, and also recovery plans, to ensure active intervention at any stage.


What are the most frequent cybersecurity problems in Mozambique?
The problems are not localised; in the current era, problems are global. There is a mechanism called “social engineering” in which cybercriminals use persuasion to get us to lower our guard, encouraging us to take impulsive and harmful decisions with the aim of making us commit errors that compromise security or hand over sensitive and confidential information. This mechanism is commonly used in the form of phishing, smishing and vishing, which occur through e-mails, SMS messages and phone calls respectively and, as in the rest of the world, have become relevant in the context of cybersecurity in Mozambique. In addition, social engineering can lead to ransom attacks, aimed mainly at business organisations, in which they threaten to expose customer data and/or confidential data on public web pages or on the ‘Dark Web’.

Because of the festive season, should we take extra care?
We should be careful throughout the year. Of course, at this time of year we may be more prone to lowering our guard, and it is undoubtedly necessary to be alert. As I explained earlier, social engineering aims to make us commit security errors and is centred on the human component. It is therefore imperative that we pay attention to the decisions we take in general, and especially in relation to requests to hand over personal information, easy-to-win prizes, instant wealth and cash deposits or refunds.


As ordinary citizens, what kinds of attacks should we watch out for? What immediate steps should a customer take if they suspect they are the victim of fraud?
People, as individuals, are the target with the greatest chance of success for cybercriminals, so I reiterate the need to be more attentive to the decisions we take. And, in these cases, the forms of social engineering most used include phishing, smishing and vishing, where the recipient of an email, text message or phone call is asked to take an action that can result in the disclosure of personal and confidential information, such as, for example, their bank card number, access passwords or even the secret answers to security questions. And, in these situations, we recommend that the customer immediately inform their bank of any suspicious e-mail, text message or call so that the teams, together with the competent authorities, can respond quickly and block the malicious activity before the damaging act occurs.


And as a company? In the business context, how do attacks usually occur and where should companies invest?
Companies have been investing more and more in their information technology, both in the robustness of their infrastructure and in the intelligence of their systems, with a view to improving the protection of the technological environment, which makes intrusion increasingly difficult for cybercriminals. However, it has been shown that 93% of successful cyber attacks on companies have a human component, which is why constant awareness-raising about the decisions they take is important. Companies should invest in parallel in awareness, training and communication about the types of attacks frequently used, with a view to equipping their people for the most diverse situations and, in this way, reducing the effect of the human component in relation to social engineering. In addition, it is important that they ensure investment in automatic updates of the systems themselves, as is the case with patching (Patching is a process for repairing a vulnerability or a flaw that is identified after an application or software has been released. Newly released patches can fix a bug or a security flaw, can help improve applications with new features and fix security vulnerabilities), which can represent an enormous return in terms of cybersecurity, bearing in mind that a simple act such as updating the patch can significantly reduce the options for attacks.


In a post-Covid era, in which the digital world has gained enormous prominence, do you notice that this type of attack is more advanced and more frequent?
Clearly the pandemic accelerated and capitalised on digitalisation, remote working and the adaptation of technologies to ensure continuous delivery of services to customers. However, these attacks have always been present; it is just that there is now greater exposure, owing to the scale and amplification of digitalisation. And that is why we have increasingly invested in individual awareness and understanding of these risks, with a view to safeguarding information and the business itself.


If you could set out three essential tips for staying more alert, what would they be?
There are several tips on this subject and I recommend that you read about them, but often it is a matter of staying alert and using common sense, for example:

• If something seems too good to be true, it is probably a fraud. So always be alert, protect your personal data and do not share information.

• Always keep applications and electronic devices up to date, and even switch on automatic update notifications.

• Create complex passwords and, above all, do not share them with anyone.