How Nigerian Businesses Can Navigate The New Wave Of Cyber Threats

In today’s fast paced world of business, cybersecurity is not an option anymore. Cyber threats are on the rise, targeting Nigerian companies both large corporations and small startups are at increased risk.

Affected businesses are susceptible to disruption of operations, financial loss and causes damaged to business reputation as a result of cyber-attacks.

Given that Nigeria’s organisations are increasingly adopting digital and are conducting online operations, now becomes a time to raise awareness and ensure that risk is also managed.

This article outlines the major cyber threats that affect Nigerian businesses; the effects of these threats and how businesses can protect themselves against these threats and the role of the Nigerian Government and collaborations in mitigating these threats

The Rise of Digital Businesses in Nigeria

As Africa’s most populous nation and largest economy, Nigeria is going digital. The country with over 200 million people, a youthful population and growing internet penetration also presents itself as the perfect place for business opportunities and technological advancement.

Technology is being used by multiple industries to simplify operations, improve customer experiences, and appropriate in the market.

The rapid adoption of e-commerce platforms; the FinTech solutions and cloud services speaks volume of this digital economy which is thriving in Nigeria.

The COVID-19 forced many organizations to embrace work from home, e-commerce and other digital means of interacting with their customers as well as making payment. Nigeria is today home to a fast-growing tech hub popularly known as “Silicon Valley of Africa” where various tech-based startups as well as existing firms are pushing forward technological advancement across the various sector.

Nonetheless, this digital growth has resulted in increased cyber threats; it has exposed Nigeria to become a preferred hunting ground for internet fraudsters, cyber-criminals or threat actors.

READ ALSO: CBN Issues Ultimatum to OFIs on Cybersecurity Compliance

With millions of users, growing dependence of the population on digital transactions, and changes in the digital architecture makes her a honey spot for attackers. Whether it is a stolen database, a ransomware attack, malware attacks, phishing scam or any other kind of cyber threat, Nigerian businesses are under threat from highly evolved cyber-criminals, whose operation can lead to financial and reputational losses.

Because of the high level of FinTech activity in Nigeria, the country ranks among the most attractive for cybercriminals.

However, digital transformation brings along with it an enormous opportunity for innovation, and at the same time, a major concern of security threats.

Proactive measures of protection are not only necessary to ensure assets security but also to enhance customers, partners and investors confidence.

Security- conscious firms are able to market themselves as strong stakeholders in a networked economy thus improving competitiveness.

With the Nigerian economy increasingly Digitized, Ensuring the incorporation of robust cybersecurity programs into development processes will continue to form the bedrock for its resilience.

Key Cyber Threats Facing Nigerian Businesses

Ransomware Attacks

In a ransomware attack, malicious actions gain access to confidential business data, encrypts the company’s data, and then ask for a certain amount of money before they can restore access to the data.

This kind of attack is on the increase in Nigeria, mainly in key sectors like banking, health and education. Businesses losses crucial customer data, suffer reputational damage, and huge financial loss due to sanctions and lawsuits that follow.

The lack of reliable backup system during ransomware attack causes a more devastating effect as businesses are left with no option than to pay the huge ransom demanded by the cyber-criminals.

The best approach to protecting against ransomware is having several layers of defense such as data backup that is often kept off-line, the use of anti-ransomware software, network segmentation, endpoint protection software such as antivirus, antimalware, and intrusion prevention and detection systems.

READ ALSO: Cybersecurity Strategies Of Remaining Safer Online

It is also recommended that organizations perform table-top exercises to consequently enhance the overall readiness of the organisation to ransomware attacks and response rates.

Ransomware attackers have also shifted their focus to companies’ supply chain, where they seek weaknesses in vendors software to infiltrate large companies.

Third-party risk is now a continually emerging risk that Nigerian companies must assess and ensure that they hold their third-party contractors to adequate cybersecurity standards.

Phishing Scams

Phishing refers to emails or messages that are created in order to make people reveal personal information such password or bank statements.

Small and medium businesses in Nigeria particularly fall prey to this form of attack; attackers’ individuals posing as reputable organisations to gain access into the firm’s system and download information or install malicious software.

The most common form of phishing in Nigeria are email phishing, smishing, vishing, spear phishing, all with one goal which is to deceive the users to click on a link thereby compromising the business internet networks or reveal sensitive information like password, username etc.

Modern phishing attacks are much more subtle, and with fake web sites and personalized emails, even the most careful staff can be duped.

These schemes generally work by appealing to the victim through using their fear, urgency or curiosity; usually leading the victim to click on a link that downloads a virus or opens an attachment that does the same.

Sometimes the criminals simply imitate legitimate government authorities or the offices of famous companies, which add credence to the fake offers.

But today’s cybercriminals are now going a step further and using social media to learn more about the people they are targeting. As a result, they are able to craft a more personalised message that is even more realistic.

How Nigerian Businesses Can Navigate The New Wave Of Cyber Threats

In order to counter this threat, companies should use email filtering tools in an effort to prevent phishing attacks from reaching the staff. They also include ways of effectively creating awareness of these threats and conducting simulations regularly to make the workforce be able to identify phishing emails.

Additionally, culture of skepticism and verification are shown to have a great ability in reducing phishing risks beyond technical solutions.

This kind of encouragement for checking suspicious messages and having a clear way to report what are exactly phishing attempts helps businesses win the fight against attackers.

Business Email Compromise (BEC)

In Business Email Compromise scams, cyber criminals pose as senior execs, trusted partners coax employees into giving up money or confidential information.

But because these scams can take months of meticulous planning and cause serious financial harm, it is hard for law enforcement agencies to take action against them.

For instance, attackers could study any company’s internal communication style to craft emails that people send, ensuring employees cannot tell their frauds apart. A combination of technology and policy is needed to prevent Business Email Compromise (BEC).

Therefore, businesses should put email authentication tools such as Domain-based Message Authentication, Reporting, and Conformance  (DMARC), Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) in place to identify the sender. Other things you need to have in place are financial transaction protocols like requiring dual approval of large payments or making sure requests are verified by phone calls or in person.

Business organizations should train employees on how to detect email scam.

READ ALSO: ‘Cybercrime Has Taken Over In Major Parts Of Lagos Especially In..Insider Threats

Not every cyber threat comes from the outside. Employees can inadvertently or intentionally put a company at risk.

Because they often bypass standard security measures, insiders are particularly dangerous. An employee may accidentally download malicious software or intentionally ‘leak’ sensitive information.

To address insider threats, business need some combination of trust, monitoring and training. Implementing access controls such as Role-Based Access Controls (RBAC),  Mandatory Access Control (MAC) and Discretionary Access Control (DAC) and Separation of Duties policies ensures that employees have permission to access data that are required to perform their job.

How Nigerian Businesses Can Navigate The New Wave Of Cyber Threats

Also, implementing Principle of Least Privileged ensure that employees have the minimum required permissions to perform a task.

While these help to reduce the risk of insider threat, a comprehensive approach such as also regular audits, monitoring of employee activities and endpoint security needs to be implemented to detect unusual behaviors.

Further, the creation of an environment consisting of a positive workplace culture will make it less likely that a malicious insider will carry out an action.  Other means to minimise cyber threats from inside sources, is by taking proactive measures such as conducting exit interviews, revoking access to business resources outside of business hours and ensuring that employees leaving have their access disabled.

Organisations can also have anonymous means through wish employees can report suspicious activities of employees without  fear of reprisals from their fellow employees.

Weak Security for Remote Work

More companies are adopting remote work but don’t have that strong security for their laptop or smartphone. These gaps are exploited by cybercriminals to get access to your business systems and to steal data.

In order to make sure remote work environments are secure, businesses need to offer their employees the company issued devices, configured with up to date security software to secure remote work environments.

Employees should be discouraged from connecting to unsecured Wi-Fi networks to minimize risk of cyber-attacks.  There should be clear remote work guidelines, like the need to use VPN.

If a company does have a large number of employees that has access to the Internet, employers should look into implementing mobile device management (MDM) solutions in order to keep an eye on and protect their devices.

Specifically providing employees with regular security training focused specifically for working from home means employees know the risks involved working remotely. Also, periodically businesses cybersecurity team should audit employers’ devices to ensure it satisfy security policies.

How Nigerian Businesses Can Navigate The New Wave Of Cyber Threats

Supply Chain Attacks

One of the most common attack vectors on which attackers rely is targeting a company’s partners or suppliers to gain access to their system. Such an attack can be hard to spot, and it can destroy an entire network of businesses.

To minimise supply chain attacks, businesses need to evaluate the process of their partners regarding cybersecurity.

Regular vendor risk assessment and mandates from third parties to comply with security standards can prevent vulnerabilities.

The supplier must also be contractually obligated to inform the business immediately of any breaches that might affect the business.

To minimize the impact of supply chain attacks, it is important for Nigeria business reduced dependence on a single vendor because it helps minimizing the impact of a single breach from a supplier software from crippling the entire business operation.

READ ALSO: Cybersecurity Levy: FG Heaps Another Burden on Nigerians

Advanced Persistent Threats (APTs)

An Advanced Persistent Threats (APT) attack is a long term, targeted attack in which cybercriminals are able to infiltrate a network and stay undetected for a relatively long time.

They want to steal sensitive data, or disrupt operations, of which the usual targets are finance industries such as banks, energy companies, hospitals, government agencies or telecommunications company.

However, as attackers get more sophisticated, Nigerian businesses continue to become more vulnerable. To combat APTs, businesses need to focus on continuous network monitoring and anomaly detection.

Endpoint detection and response (EDR) systems are sophisticated tools that are able to detect unusual behavior, before an actual attack, and prevent attackers. Business can stay protected against APTs by regular update, patching  of the software.

Participating in threat intelligence sharing platforms and collaborating with the cybersecurity researchers would be good source of information about what tactics APT operates on.

Businesses need to also conduct red team exercises to test what it would take to emulate APT scenarios to improve their defenses and incident response.