Building Cyber Security Strategies for Emerging Industries in Sub Saharan Africa

Overview: Laura Tich and Evelyn Kilel, co-founders of the SheHacks KE cybersecurity community in Kenya, examine the unique cyber threat landscape and defensive challenges facing emerging industries in Sub-Saharan Africa (SSA). Presenting at Black Hat USA, the speakers analyze the explosive growth of the regional ICT sector, fueled by massive mobile money adoption among previously unbanked populations. They identify critical structural vulnerabilities across mobile financial services, government infrastructure, and regional banking, while outlining community-driven strategies and consumer protection mechanisms to address severe cybersecurity talent and telemetry shortages.

Key Topics: - Rapid digitization and mobile money dominance (M-Pesa and 82% regional penetration) - Primary threat vectors: SIM swapping, mobile money fraud, ATM jackpotting, and social engineering - Structural deficits: lack of regional threat intelligence telemetry, talent shortages, and tool licensing costs - Context-specific countermeasures: M-Pesa Hakikisha, transaction reversal protocols, and open-source testing (MARA)

Technical Details: The speakers review the rapid digital transformation of Sub-Saharan Africa, noting that the regional ICT market was projected to expand from $95.4 billion in 2020 to $104.2 billion by 2023. This expansion is overwhelmingly anchored in mobile financial services: regional mobile money penetration stands at 82%, exemplified by Kenya's M-Pesa platform serving over 30 million active users. Mobile money bridged the gap for the historically unbanked population, but rapid adoption created unique cyber attack surfaces. Relying on reports from regional firms like Serianu, the speakers identify government entities and the banking sector as the primary targets of cybercrime. The massive deployment of ATMs to convert mobile balances into physical cash led to widespread ATM malware infections and jackpotting attacks across the continent.

Tich and Kilel analyze prevalent attack vectors that exploit both technical and human vulnerabilities. Threat actors—ranging from local fraud syndicates like the Sakawa boys to transnational cybercriminals—routinely deploy social engineering, phishing, and SIM swapping to hijack user accounts. A common fraud scheme involves calling victims under the guise of an accidental money transfer and manipulating them into returning funds that were never sent. The authors emphasize that these threats are exacerbated by severe structural challenges: Western cybersecurity threat reports rarely collect or publish telemetry specific to Sub-Saharan Africa, leaving regional security leaders without actionable local threat intelligence. Additionally, organizations struggle with prohibitive licensing costs for commercial proprietary security tools, forcing security teams to rely heavily on open-source alternatives like the Mobile Security Framework and the MARA (Mobile Application Risk Assessment) framework.

To counter these threats, the authors highlight innovative local defenses deployed by telecommunications providers. For example, M-Pesa implemented "Hakikisha," a pop-up verification system that displays the verified full legal name of the recipient before a transaction completes, preventing mistyped or fraudulent transfers. Furthermore, providers established automated SMS-based reversal protocols (e.g. texting details within a 60-second window to halt transfers) and deployed velocity-checking algorithms to flag abnormal transaction patterns.

Key Takeaways: Cybersecurity strategies in developing economies cannot merely replicate Western models; they must address localized attack surfaces like mobile money, SIM swapping, and telecommunications infrastructure. Financial and telecom providers should implement user-centric fraud controls like mandatory recipient identity verification and rapid automated transaction reversals. To overcome acute talent shortages and commercial tooling cost barriers, organizations should support grassroots initiatives like SheHacks KE, invest in local cybersecurity education, and contribute to open-source security assessment frameworks tailored to regional technologies.

(AI summary — Gemini Flash)