BFI Finance Boosts Cybersecurity with Rp300 Billion IT Investment

Strengthening Digital Defenses

BFI Finance (BFIN) has announced plans to allocate approximately Rp300 billion for technology-related capital expenditure (capex) and operational expenditure (opex) in response to growing cyber threats. The financial services company, partially owned by Garibaldi Boy Thohir and Jerry Ng, experienced a significant cyber attack in 2023 that prompted this substantial investment in IT security.

Learning from Past Experience

The company's director of finance, Sudjono, shared that BFI Finance had previously suffered a cyber attack in 2023. Although the company was able to identify the breach quickly, the recovery process was lengthy due to malware embedded in their existing applications. The incident highlighted the importance of having robust backup systems and multiple data centers. BFI Finance was fortunate to have four sets of data, with two sets stored in a disaster recovery center that allowed them to restore critical systems.

Key Takeaways and Future Measures

The experience taught BFI Finance valuable lessons about cybersecurity. Firstly, the company realized the importance of not relying on single-person access control for critical systems. Sudjono emphasized the need for strong control mechanisms to prevent remote unauthorized access. Secondly, the company has since invested heavily in enhancing their IT security infrastructure. This includes implementing multiple security clusters and engaging external IT experts to strengthen their systems against potential cyber threats.

Implementation and Expected Outcomes

The allocated Rp300 billion will be used for both capex and opex related to IT development, with a significant portion dedicated to enhancing security measures. While not all of the budget is exclusively for cybersecurity, it represents a comprehensive approach to improving the company's overall IT infrastructure. BFI Finance aims to create a more resilient digital environment through these investments, ensuring better protection against future cyber attacks and maintaining the integrity of their operations.