OPAY employs the following containment strategies for cybersecurity incidents: Short-term containment includes freezing affected accounts or wallets, blocking malicious IPs or logins, and disabling login or transaction systems if necessary. Long-term containment involves revoking and resetting access keys for breached systems, enforcing password resets and multifactor authentication (MFA), and segmenting backend access into microservices to limit further damage .

Conducting post-incident reviews and lessons learned meetings are crucial in OPAY's incident response strategy as they help the organization to focus on continuous improvement and avoid blame culture. These reviews allow OPAY to analyze what went wrong, understand the effectiveness of their response, and identify gaps in their current practices. The insights gained from these meetings are imperative for updating incident response policies, access controls, and platform architectures, and they serve as a foundation for revising the incident response playbooks, which ensures that future incidents are handled more efficiently .

OPAY implements several measures for recovering services post-incident that ensure an efficient recovery process. They prioritize the restoration of services from clean backups, focusing initially on essential services like payments, airtime, and withdrawals. Post-recovery, OPAY conducts monitoring to detect any residual malicious activity and confirm that threats have been eliminated. Network scanning tools like Nmap and vulnerability management platforms like Nexxus are deployed to confirm the integrity of restored systems. These measures are instrumental in ensuring that business operations resume swiftly and securely, minimizing downtime and loss of customer confidence .

In the event of a cybersecurity incident, the Cybersecurity Incident Response Team (CSIRT) at OPAY assigns specific roles and responsibilities: the Incident Commander leads the incident lifecycle, approvals, and reporting; SOC Analysts are responsible for detecting, analyzing, and containing threats; IT/DevOps provide infrastructure support, patching, and rollback; the Fraud Team investigates mobile money and account fraud; and Legal & Compliance handle regulatory reporting and legal communications. Customer Support coordinates user communication and manages complaint logs. Backup personnel are available for after-hours escalation .

OPAY handles communication during and after a cybersecurity incident by preparing pre-written templates for customer and media alerts to ensure timely and consistent messaging. They use encrypted messaging platforms such as Signal and ProtonMail during incidents to maintain security. OPAY also maintains contacts for relevant authorities and vendors to facilitate necessary communications. After an incident, they notify users through app popups, SMS, and social media, explaining what happened, the actions taken, and subsequent safety steps, ensuring transparency and maintaining user trust .

OPAY Nigeria PLC ensures continuous protection of user financial data and compliance with regulatory requirements by maintaining a documented and tested Incident Response Plan (IRP). This involves compliance with Nigeria Data Protection Regulation (NDPR), Central Bank of Nigeria (CBN), and Nigeria Inter Bank Settlement System (NIBSS), as well as global cybersecurity frameworks. The plan also requires executive approval for policy enforcement and funding, enabling a prompt and coordinated response to cyberattacks, fraud, and platform abuse .

During a cybersecurity incident at OPAY, the SOC Analyst plays a pivotal role in detecting, analyzing, and containing threats. Their activities are critical for incident management as they involve real-time monitoring and identification of potential security breaches using various security tools such as SIEM systems. By quickly identifying malicious activities and unusual patterns, SOC Analysts help in the rapid containment of threats, which minimizes potential damage and reduces response times. Their central role in facilitating communication with other team members, such as IT/DevOps and the Fraud Team, ensures comprehensive incident management .

OPAY Nigeria PLC utilizes several evidence preservation techniques categorized in their Incident Response Plan to ensure the integrity and admissibility of digital evidence. They archive transaction logs, API request traces, and system snapshots, using write-once storage to maintain evidence integrity. They follow strict chain of custody procedures to ensure that digital evidence is admissible in any subsequent investigations or legal proceedings .

OPAY's use of security infrastructure such as Multifactor Authentication (MFA), Security Information and Event Management (SIEM) systems, and firewalls significantly contributes to their incident response efficiency. MFA adds an additional layer of security, ensuring that unauthorized access is minimized even if login credentials are compromised. SIEM systems are crucial in detecting potentially malicious activities and allowing for quick analysis and correlation of events across the network, leading to faster incident identification and containment. Firewalls, together with other security tools like endpoint detection and response systems, create a robust defense against unauthorized access and attacks, thereby enabling a seamless and effective response to incidents .

In the eradication phase of OPAY’s Incident Response Plan, several key steps are involved: first, a root cause analysis is conducted to determine the initial cause of the security incident, such as phishing or stolen API keys. Forensic analysis and system timelines are reviewed to identify vulnerabilities. Subsequently, system hardening procedures are implemented, which include patching vulnerable systems, removing unused accounts and outdated code, and auditing third-party API usage. Credential and API key resets are carried out to remove compromised access and secure official channels. These steps are integral in preventing future incidents by eliminating vulnerabilities identified during the response and reinforcing the security posture .