AKTA chief highlights cybersecurity weaknesses in microfinance sector

Azerbaijan's nonbank credit institutions face shortages of cybersecurity funding and qualified specialists, Azerbaijan Cybersecurity Organizations Association (AKTA) Executive Director Rauf Jabarov said.

Report informs that he was speaking at the 12th Investment and Sustainable Development in Microfinance Conference, organized by the Azerbaijan Microfinance Association (AMFA) in Baku.

According to Jabarov, cyberattacks are less frequent in this segment because its level of digitalization is relatively low compared with other parts of the financial sector.

"However, when such attacks occur, problems are inevitable. The Central Bank of Azerbaijan has introduced a regulatory requirement obliging microfinance institutions to follow certain rules. Associations, companies and experts also have a role in this process. Companies and experts conduct audits and gap analyses and establish information security systems within institutions. We are also working with the sector in this area.

"As an association, we conducted a survey. Based on responses from four company representatives and experts-more precisely, four individuals-we established that audits had been conducted at more than 10 microfinance organizations. Those who carried out the audits shared their observations with the association.

"I estimate that more than 50 organizations operate in the microfinance sector. If more than 10 have been audited, we have covered approximately 20% of the sector. I believe that is a reasonably good basis for drawing certain conclusions.

"One of the main obstacles is limited financial resources. We understand the reality, and while preparing the presentation, we encountered budget constraints everywhere.

"Another problem is the lack of qualified specialists within these institutions. I believe this could be addressed by bringing in external experts or consultants. We see that many microfinance organizations do not have cybersecurity departments. When no one is responsible for this area, problems are inevitable.

"Another key issue is the low priority management gives cybersecurity. In many cases, it becomes clear that without the regulatory requirement, microfinance institutions would not have paid any attention to the issue. The Central Bank's requirement obliges them to address cybersecurity," Jabarov added.