Cybersecurity Risks and Countermeasures in Nigeria

 

By Omodiaogbe Samuel

Last Updated: December 3, 2023

Introduction

Cybersecurity threats represent one of the most serious national security, public safety, and economic challenges we face particularly in the 21th century. The very technologies that empower us to do our work effectively also enable adversaries to steal and destroy. Cybercrime is not only a question of attacks against the confidentiality, integrity and availability of computer data and systems, but also against the core values and human development of societies that is increasingly relying on information technology. Cybersecurity risk management therefore is the process of identifying vulnerabilities and threats to information resources and operations of an organization, and deciding what countermeasures to take in order to the reduce risks to an acceptable level. So, cyber threat intelligence is all about knowing what the adversaries does, and using that information to improve decision making on countermeasures against cyberattacks

The sad news is that every organization is a potential victim. There is no such thing as 100% security and so, an organization will probably experience some form of cyberattack at some time. All organizations have something of value that is worth something to others. Therefore, any organization that openly demonstrate weaknesses in its approach to cybersecurity by failing to do the basics, will experience a cyberattack. That means having an effective security incident response plan can help to reduce the impact of the attack. As a result, a cybersecurity strategy should involve an enterprise-wide approach. It has to take the whole organization to manage cyber risk. It requires a multidisciplinary team effort to develop a security strategy that reflects the scale and complexity of the organization challenge. So, it is imperative to cast a wide net and include representatives from across business units in the strategy formulation, and ensure there is a buy-in from the entire staff. To be effective in managing cybersecurity risk in Nigeria, we need to have insights on the various components that determines effective cybersecurity risk managemen

Critical Perspective

Cybersecurity Landscape in Nigeria:

Nigeria and most African countries are at a higher risk of cyberattack due to a couple of factors, such as low level of awareness, poor infrastructure, poor network architectural design, weak regulation, non-cohesive legal framework, and massive skill deficiency in cybersecurity profession. These factors increase the vulnerabilities of organizations in Nigeria. And the fact that cybercrime is global means that any cybercriminal or criminal gang can take full advantage of security vulnerabilities in Nigeria from anywhere in the globe. The reality is that many organizations have been hacked in the country without been aware of it. Most others that are aware kept mute because of the reputational damage it could cause the organization. But that does not remove the reality that lots of money has been loss or people’s data are in the hands of criminals

Governments and businesses today are facing security threats that would have been un-imaginable only a few years ago. This is even so in an economy as Nigeria where there is little or no cohesive national policies, standards, regulations and guidelines for cybersecurity. These factors lead to high level of vulnerabilities in most organizations. The most common vulnerabilities include weak passwords, outdated firewalls, missing software patches, unencrypted data, outdated antiviruses, unrestricted use of USB flash drives, and unsecured Wi-Fi networks. When the cyberattack happened, it might catch everyone by surprise, but it shouldn’t. It was just a matter of time, because the organization had a high level of technology deficiency; the IT security lacked alignment with the business; the business unit failed to understand its level of risk and necessary controls; and the organization had given minimal attention to incident response measures. To make organization to be resilience to attacks in the country, organizations need to deploy the right patch management, anti-virus software, firewalls, host-based intrusion detection systems (HIDS), network-based intrusion detection systems (NIDS), intrusion prevention system (IPS), Security Information and Event Management (SIEM), content filtering software, etc. But technology is not enough to fight cybercrime, the right governance, process, and culture has to be in place as well

Legal Frameworks and Regulations:

There have been several attempts to institutionalize cybercrime in the country through guidelines, legal frameworks and regulations, and those initiatives include enacting or establishing the following:

  • Economic and Financial Crimes Commission (EFCC) Act 2004
  • Advance Fee Fraud and other Related Offences Act, 2006
  • Evidence Act as amended in 2011 (for admissibility of electronic evidence)
  • Cybercrimes (Prohibition and Prevention) Act 2015

Other notable cybercrime control initiatives include:

  • National Cybercrime Working Group (NCWG)
  • Computer Emergency Response Team (CERT) (center by NCWG and NITDA)
  • The upgrade of the Nigeria Financial Intelligence Unit (NFIU) to a full-fledged Agency (NFIA)

Some of the existing regulatory instruments for the development of a Digital Economy include:

  • Guidelines for Nigerian Content Development in Information and Communication Technology (ICT)
  • Nigeria e-Government Interoperability Framework (Ne-GIF)
  • Nigeria Cloud Computing Policy
  • Framework and Guidelines for Public Internet Access (PIA) 2019
  • Guidelines for Clearance of Information Technology (IT) Project by Public Institutions
  • Nigeria Data Protection Regulation 2019
  • Standards for Data Interoperability
  • Consumer Code of Practice Regulations

Based on these measures put in place, one would have expected Nigeria to be a point of reference in terms of preparedness against cyberattacks. But according to Nigerian Communication Commission (NCC) report in 2017, Nigeria ranked third in the world for cybercrime surpassed only by the U.S. and the U.K. Why is it that despite all the laws, regulations, frameworks and guidelines that Nigeria still remains cybercrime hub? The fact remains that many of the existing regulatory instruments have been developed in silos. There is no cohesive national approach to make all the cybercrime initiatives to work together, and as a result, there is confusion on who does what. Also, the punitive measures in most of the initiatives are not stringent enough to deterred perpetrator. Most of the punitive measures are only slap on the wrist, and therefore encourages risk taking by the cybercriminals

We must also acknowledge that cybercrime is global phenomena that requires international coordination and collaboration.  Therefore, there are international treaties that enable fighting cybercrime to be coordinated on international scale. For example, the Budapest Convention, also known as the Convention on Cybercrime of the Council of Europe, is an international instrument that serves as a guideline for countries that wish to develop a comprehensive national legislation against Cybercrime. Over 130 countries are signatory to it, but Nigeria is not. Also, in Africa we have African Union Convention on Data Protection and Cybersecurity, also known as the Malabo Convention. The convention attempts to address a wide range of online activities, including electronic commerce, data protection, cybersecurity and cybercrime. Thus, it gives room to a coordinated approach to fighting cybercrime in Africa, and it was subject to a minimum of fifteen member states of AU ratification. Unfortunately, Nigeria and other members of AU have not ratified it, and that makes continental coordination very difficult. It equally makes Nigeria a safe haven for cybercriminals because these international cybercrime laws are not rectified in Nigeria, and so makes offenders not punishable domestically with those laws

Compliance to International Standards:

Risk management is often linked to compliance standards. Compliance to a security standard helps organizations to manage risk as there is an externally defined framework for security management and controls.  Therefore, we want to focus on two international standards organizations in Nigeria need to comply with― ISO/IEC (International Organization for Standardization/International Electrotechnical Commission) 27001, and PCI-DSS (Payment Card Industry-Security Standards Council). ISO/IEC 27001 is the most accepted cybersecurity standard globally. It was developed with the intent to help organizations improve their information security and minimize the risk of business disruptions. On the other hand, PCI-DSS applies to all entities involved in payment card processing. PCI DSS also applies to all other entities that store, process, or transmit data and/or sensitive authentication data. Why should organizations in Nigeria take these certifications much more seriously? Certification brings a number of benefits above and beyond mere compliance, it’s a source of competitive advantage. Certification not only helps protect a business, but it also sends a clear signal to customers, suppliers, and the marketplace that such organization has the ability to handle information securely.

Why Cybercrime is not Going Away Soon in Nigeria

Broadband Penetration:

According to the Nigerian Communication Commission, broadband penetration in the country has increased over the years to 45.02% (85,941,222) as at December 2020. The implication of that the number of Nigerians that have access to the internet has increased tremendously. Gone are the day when EFCC could bust into cybercafe looking for “yahoo boy.” With the high penetration rate of broadband, it means access to the internet does not have to be cybercafe anymore. Cybercrime can now be committed from the comfort of homes or anywhere. Computers are not required anymore to get involved. Also, according to the NCC, the teledencity in the country was 107.18% (204, 601, 313) as at end of December 2020. With such the teledencity higher that the population, coupled with declining prices of smartphones, and data, it means cybercrime is bound to increase. Greater number of Nigeria getting access to the internet is a blessing or cause depending on how the country prioritize the fight against cybercrime. At the moment, we seem not to take the advantages of using the internet to better lives and economy, but the negative side seems to be prevalent  

Raising Level of Poverty:

Nigeria has recorded an average less than 1% GDP growth in the last 5 years, while the population growth has been above 2.5% in the same period. Also, according to Nigerian Bureau of Statistics (NBS), the unemployment rate has risen to 33% as at March 2021. The implication of that is raising level of poverty, and that has pushed most youths into crimes. Criminal activities such as robbery, kidnapping, banditry, terrorism, and the likes have increased over the years. Of course, cybercrime is no exemption. As long as the GDP growth remains lower than that of the population growth, the problem is bound to persist. Some youths have taken to cybercrime as an option out of poverty, while others see it as employment in the absence of no other opportunities. Therefore, as long as other criminal activities continue to be on the increase, we shouldn’t expect cybercrime to decline soon, rather, it is bound to increase as well. Afterall, the returns on cybercrime are very high, one ‘hit’ could suddenly turn a beggar into a millionaire. On the other hand, the punitive measures are not stringent enough, and that encourages risk-taking. Fighting cybercrime has to be holistic in outlook, and there is no way we can effectively tackle the problem without addressing to root causes.

It’s difficult not to notice the declining rate of arm robbery in the country, while on the other hand, the rate of kidnapping has increased significantly in the last couple of year. Rubbery declined because of technological innovation. People no longer save money at home or travel with large sum of money. E-banking and the use of ATM has made cashless transaction seamless. On the other hand, kidnapping has increased because that is where the money is. Kidnappers can make millions of naira on one successful operation, and therefore the incentive to take the risk is high. As the incentive for kidnapping is getting higher, organizations need to be wary. There is higher incentive for ransomware than kidnapping for ransom. Ransomware is a type of malicious software that threatens to harm a system by denying the user access to data, unless a ransom is paid. Before now ransomware was through cash or transfer, but the landscape is changing. Cryptocurrency is taking ransomware to another dimension. Blockchain, the underlying technology that drives cryptocurrency makes it impossible to unlock any transaction encrypted with private key. Therefore, cybercriminal could exchange their public key to receive ransom, but anybody that does not have the private key can access the cryptocurrency in their wallet. Also, the possibility of tracing transaction in private wallet is almost impossible. Cybercrime though ransomware is already happening in Nigeria, expect more of it

Why people fall prey for cyberattacks:

Human beings are the weakest link in cybersecurity architecture. Even some trained and highly aware personnel on cyberattack methods can still fall prey to cyberattacks. The cybercriminal through reconnaissance can gather all the information about their client, and then deploy their social engineering and phishing methods to execute the evil arts. It’s more of a psychological problem to fall into those tactics, although we might not want to admit it. They use psychological tools to work on people minds. Tools such as obedience to authority, conformity, anchoring, cognitive bias, framing, scarcity, reciprocity, urgency, and heuristics are used by cybercriminals to execute their arts. Then they use phishing technique like authentic-looking e-mail to request information or transaction from organizations or direct them to fake or malicious websites. They might look so authentic that even the most sophisticated and well-trained executives or staff could fall for them. These tools couples with poor network architecture, access to corporate data with personal devices, lack of firewalls, fake or unpatched operating systems, and installation of unauthorizes apps make organizations to be vulnerable to cyberattacks. Once they get access though the weakest link, they could perpetrate colossal damage on the organization

Shortage of Skills:

Shortage of cybersecurity skill is not just a problem for developing country like Nigeria, but a global challenge. However, it’s a greater challenge in developing countries because of poor educational systems, poor training culture, low level of awareness, and of course, brain drain. IBM  2019 report revealed that there are 2.8 million professionals worldwide currently working in the field of cybersecurity, and an additional 4.07 million more are needed. The implication of that is that there is shortage of skills to fight the sophisticated enemy. The shortage of skill is especially acute for experienced professionals in threat and vulnerability assessment, incident and crisis management, and security management. Cybersecurity skill shortage is really a great challenge especially taking into consideration the growing nature of cyberattacks in the country. Nigeria is cybercrime hub in Africa, and it’ s equally attracting press attention around the globe as safe haven for cybercriminals. That mean much more need to be done to make the country safe for individuals as well as businesses. The skilled cybersecurity experts in Nigeria would rather seek greener pasture abroad. There is no shortage of demand of cybersecurity experts abroad, because the profession has zero unemployment rate. Therefore, brain drain has further compounded the skill deficiency in the country.

New technologies, new challenges:

The cyber-threat landscape is continuously evolving with the advancement in technologies such as Internet of Things, blockchain technologies, cloud computing, artificial intelligence, as well as online payment transaction models, digital file-sharing platforms, and digital collaboration and marketing tools. The 4th industrial revolution powered by Internet of Things (IoT) solutions will shape the future of communication, digital ecosystem, and manufacturing. It is estimated that there are already over 21 billion Internet of Things (IoT) devices worldwide, and that number is expected to double by 2025. Also, the use of blockchain in cybersecurity is also rapidly gaining momentum and is expected to become mainstream within the next couple of years. However, blockchain technology also opens up a new door for illegal commerce on the ‘dark web’ where cryptocurrencies are used for such transaction. Artificial Intelligence can be used to fight cybercrime, and at the same time, can be used by the criminals to perfect their acts. Cloud computing is growing exponentially, but no software is perfect, and therefore there are vulnerabilities on the cloud as well. By and large, the emerging technologies have created new opportunities, as well as new challenges in cybersecurity. And the fact that the adversaries are always far ahead means a lot of troubles for developing country like Nigeria

Black Market for Attack Software:

The fast-growing black market for attach software should be a great concern in Nigeria. It was safe to say Nigeria didn’t have enough software developers to design and deploy attacks on Nigeria organizations. That narrative is fast changing with the growing black market for attack weapons on the ‘dark web.’ This is a huge market where highly organized and ultrasophisticated criminal organizations develop and sell all sorts of attack weapons. On the dark web, they can maintain anonymity and sell malwares, and teach buyers the techniques of deploying. Malwares such as viruses, worms, trojans, keyloggers, ransomware, spam, rootkits, adware, spyware, scareware, and even zero-day vulnerabilities are all sold on the dark web. The implication of that is, you don’t need to be a software engineer to develop and deploy these weapons. The sellers are there to educate the buyers on how to deploy them, and some even have money-back guarantee. The rise of cryptocurrencies has made the black market to be more sophisticated. The use of public and private keys on blockchain technology mean the cryptocurrency can exchange hands without trace by any law enforcement agency. The reward in cybercrime is very high, and that mean the criminals can afford to invest on any weapon with the desire of positive returns on investment. The reality is that today’s attacks are not only multidimensional in nature but also use an increasingly sophisticated set of techniques that are constantly changing. And with the rise of such black market, we should expect the level of attacks in Nigeria to rise as well.

Statistical Insights: The World Economic Forum (WEF) predicts that over 60% of global GDP will be digitized by 2022 and that over the next decade, digital platforms will be used to create close to 70% of new value. The WEF also said that cyberattacks have become a common hazard for individuals and businesses, and their surveys ranked it as the seventh most likely and eighth most impactful risk, and the second most concerning risk for doing business globally over the next 10 years. According to Global Insights, cybercrime damage costs is expected to hit $6 trillion annually by 2021 up from $3 trillion in 2015. Cybersecurity spending to exceed $1 trillion from 2017 to 2021. Global spending on cybersecurity products and services are predicted to exceed $1 trillion over five years, from 2017 to 2021. According to the United Nations Conference on Trade and Development (UNCTAD), Nigeria’s e-commerce spending is projected to increase to $75 billion in 2025. According to Verizon’s Data Breach Investigations Report published in 2020, 86% of the overall breaches were financially motivated. Also, Symantec examined a large number of email addresses used by the scammers and found that 46 percent have Nigerian IP addresses. The rest were from the United States, the United Kingdom, South Africa, Malaysia, and Russia. Where does all these lead us? Cybersecurity is a great challenge for individuals, organizations and nations. The challenge is of more concern for developing country like Nigeria where the enabling environment is weak in terms of infrastructure, governance, and human capital

The Right Strategic Approach to Cybersecurity in Nigeria:

Cybersecurity is real, and no organization is immune. While cybersecurity has traditionally been regarded as an expensive but necessary evil, it can no longer be seen as a cost center that eats into time, budgets, and resources anymore. Organizations need to wakeup to the reality that vulnerabilities are everywhere, and the more an organization is prepared the better. Cybersecurity need not longer be seen as simply a CIO, CISO, or IT department issue. Cybersecurity attacks can impact business operations and workforce productivity, leads to reputational damage, cause financial loss, and attracts litigation. Therefore, it is a responsibility that must be shared amongst the board, management team, IT team and indeed all employees. For a business to be cyber resilient, cybersecurity needs to be incorporated into the culture of the organization, and all stakeholders must work together to achieve the common goal of cyber-resilience. As a result, organizations in Nigeria need to wake up to the reality that cyberattack is real, and that every organization is a potential victim 

As technology continues to revolutionize the world, threats to business operations become increasingly complex, therefore organizations particularly in Nigeria need to rethink how security is integrated across its infrastructure. To effectively prepare to response to incidence, manage risk, and mitigate an attack requires holistic approach. For that, most organizations in Nigeria are not prepared yet. Apart from legacy infrastructure that were not setup with cybersecurity in mind, there are other challenges in the cybersecurity architecture that makes such desired perfect cybersecurity unattainable. The reality is that, there is no such thing as perfect cybersecurity, even for organizations that have all the security measures. However, the case is worse in Nigeria where the necessary cyber-resilience ecosystem is not in place. Organizations may deploy state-of-the-art antivirus, antispyware, antispam, network firewalling, intrusion detection and prevention systems, content filtering, and leak prevention. Yet, none or combination of all those can guarantee perfect cybersecurity. Besides, thinking of cybersecurity narrowly as an IT issue to be addressed simply with technical solutions is a flawed strategy. For example, the single biggest vulnerability in cyber systems is people. Insiders, whether they are poorly trained, distracted, angry, or corrupted, can compromise many of the most effective technical solutions. Therefore, organizations in Nigeria need to have a holistic approach to cybersecurity by looking at it from multiple dimensions

Organizations need to have the right strategic approach to cybersecurity. We must not deny the fact that there is cybersecurity skill shortage in the country, as well as the adjacent profession that makes a comprehensive cybersecurity management to successful. We have shortage of skills in data science, artificial intelligence, machine learning, computer engineering, cloud computing, and other related technical skills. To be effective in cybersecurity risk management requires a holistic and multidisciplinary approach of those technical skills, as well as business skills. Hardly any organization has all the skills required for cybersecurity inhouse, and the case is much worse in developing nation as Nigeria where there are inherent challenges that hinder such model. An attempt to assemble all the skills for cybersecurity inhouse might be counterproductive. First, the talents are not in abundance, and secondly, it might be too expensive to do so, thus, putting such organization at competitive disadvantage. As a result, the right strategic approach should a hybrid model where the in-house cybersecurity personnel are allowed to do the basics, while outside consultants and managed service providers does the much complex work

Given the circumstances of Nigeria and the complexity of cybersecurity, the outsourcing model will be much more effective approach. Cybersecurity strategic outsourcing is where an organization allows an independent specialist company that focus all their skills and knowledge on just cybersecurity to manage their security services much effectively. This approach allows the organization to deploy all its efforts on its core competency while allowing the cybersecurity firm to do what it does best. Managed service providers have a greater breadth of knowledge that they can apply to the enterprise’s overall security. They are often able to attract top-notch talent and implement cutting-edge cybersecurity faster than any organization could do on its own. Also, outsourcing cybersecurity services is far cheaper for an organization, taking into consideration the total cost of ownership. As a result, organization in Nigeria need to be strategic by weighing the cost-benefit of inhouse vs outsourcing. Looking at it from strategic point of view, they could leverage cybersecurity to create a competitive advantage.

Managed Security Services Providers (MSSPs) have cybersecurity as their core competence.  As a result, by outsourcing security operations to MSSP, organizations can take advantage of the expert skills, infrastructure, and processes that the service providers offer and so, significantly enhance their security systems without making a large investment on those resources. MSSP support organizations by looking around-the-clock, monitor, manage their security devices and systems by a team of seasoned security experts. Managed security services partner cannot only help your organization shoulder the burden of today’s sophisticated cyberattacks, but can also act as a powerful extension of your team.  MSSPs can also facilitate business continuity by providing advanced intelligence to thwart attacks before they cause damage and disrupt business operations. Moreover, the right MSSP can reduce the cost and complexity of information security while helping you build a stronger security posture. Internationally, companies are increasingly adopting MSSP model as it makes them to free up time and resources while they focus on what is core to the company. So, organizations in Nigeria need to catchup with the global trend. For an affordable monthly fee, such organizations can gain 24×7 access to more talent than they could ever afford in-house. With massive volumes of network activity housed in their data lakes, MSSPs can deploy analytic tools that generate deep insights about the threat landscape —knowledge that can benefit all of their customers across board

Summary

Cybersecurity is not only an IT problem, it is an enterprise-wide problem that requires an interdisciplinary approach, and a comprehensive governance commitment to ensure that all aspects of the business are aligned to support effective cybersecurity practices. The harsh reality is that no amount of cybersecurity technologies put in place can stop cyberattack; they can only reduce the risk. The adversaries are always on top of the game, they use sophisticated techniques to gather intelligence on their victims before carrying out colossal damage. The severity of an attack is therefore determined by how quickly a company can detect and respond to threats as they occur. Bear in mind, cybersecurity isn’t just about technology. It also involves people, information, systems, processes, culture and indeed the ecosystem. Therefore, organizations in Nigeria need to have a holistic approach that involves technical and non-technical approaches. To guarantee success, managing cybersecurity risk must be an ongoing and iterative process, not a one-time, infrequent, or check the-box activity.

Omodiaogbe Samuel, MSc. CMC, ChMC, FIMC

Omodiaogbe is a Strategic Management Consultant, and he the Principal Consultant/CEO at Vast Thinking Consults Ltd where he help organizations and business leaders to create superior value. Omodiaogbe holds BSc. and MSc. in Economics. Also, he is a Certified Management Consultant (CMC), a Chartered Management Consultant (ChMC), and a Fellow, Institute of Management Consultants, Nigeria. He is an Instructor on Coursera, where he teaches 25 courses in Strategic Management. Omodiaogbe is one of the world’s leading MOOCs learners on Coursera and Edx with over 500 Certificates from top-ranked Universities and Business Schools. His areas of expertise centers on Strategic Management

Contact him:
Email; somodiaogbe@vastthinking.com.ng
Visit: www.vastthinking.com.ng

Vast Thinking Consults Ltd is a Strategic Management Consulting firm that is into Partnership with a reputable Indian based cybersecurity company to bring top quality cybersecurity solutions to Africa.
Services include:
• Cyber Security Consulting
• Awareness & Training
• Managed Security Services

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top
×