The recent case involving a Midlands State University Computer Science student who allegedly used access obtained during an IT internship to facilitate fraudulent transactions exceeding US$1.1 million at CABS should concern every organisation, not just banks.
According to court reports, the allegations involve unauthorised remote access, continued system access after the internship ended, and thousands of fraudulent ZIPIT transactions. The allegations have not yet been tested in court, and the accused remains presumed innocent.
But the cybersecurity lesson is clear:
Cybersecurity is not just about firewalls, antivirus and sophisticated tools. It is about people, processes, access and governance.
Ask yourself:
– Who has access to our systems?
– Why do they have it?
– Who approved it?
– Is their activity monitored?
– When is their access reviewed or revoked?
– What happens when an employee or intern leaves?
This is the principle of least privilege: give people only the access they need, for only as long as they need it.
And having a cybersecurity policy is not enough.
A policy is a promise.
A control is the implementation of that promise.
An audit tells you whether the promise is actually working.
Organisations need regular access reviews, security monitoring, vulnerability assessments, penetration testing, IT audits and compliance assessments to determine whether security controls work in practicenot just on paper.
The biggest cybersecurity risk isn’t always an unknown hacker somewhere across the world.
Sometimes, it is legitimate access that was never properly controlled.
Cybersecurity is everyone’s responsibility.
Munashe Kamangira
IT Consultant
The CABS Cyber Theft Case: A Wake-Up Call for Every Organisation
