E-Business
Experts Ring Fear as Cyber Thieves Exploit Security Lapses
Experts in IT security have warned of a possible cyber racket insurgence in Nigeria, unless controls needed to protect sensitive data and critical infrastructure from abuse by insiders are firmly installed, Nigeria CommunicationsWeek can report. The independent Oracle users’ group survey, which first revealed that attackers exploited legitimate database access through SQL injection and stolen credentials, said laxity in the industry remains since the 2011 report. The Independent Oracle Users Group had more than 300 database and information security professionals recently surveyed on their data security practices with disturbing results. 60 per cent of respondents say data breach was most likely. Hamilton Iyoha, pre-sales consultant, Oracle Corporation, Nigeria, said over one billion records have been breached from database serves over the past six years. Iyoha said at a one-day ‘Data Security and Optimisation Summit’ hosted by Computer Warehouse Group (CWG), that the figure doubles every two years. He noted that ICT revolution in Nigeria would spur latent hullabaloo and cyber crime owing to porous nature of companies’ database in the country. Iyoha said hackers usually deploy SQL injection technique to attack databases through a website usually carried out by including portions of SQL statements in a web form entry field in an attempt to get the website to pass a newly formed rogue SQL command to the database. SQL injection is a code injection technique that exploits a-security vulnerability in a website’s software. The vulnerability happens when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. Thus, unprotected site oftentimes dump the database contents to the attacker. Iyoha said: “With the fast growth in data generation, demand for data security will also increase in manifold. Actually, 48 per cent of data breaches are caused by insiders, 89 per cent records stolen using SQL injections. Hackers use stolen credentials; all this call for stringent security applications. “As it is now, existing IT security is not addressing database security, because only 20 per cent of companies that participated in the survey have a kind of forecast estimate,” he noted. Iyoha said CWG/Oracle partnership has provided the society with a preventive and detective control security solution that demands authentication, access control and auditing capable of blocking threats. “About 75 percent of organizations genuinely doing business encrypt their database traffic. Another 22 per cent encrypt only their database backup files; however, Oracle Advanced Security (OAS) was produced in such a way that it protects data from unauthorized users, particularly on enterprise solution base,” said Iyoha. Peter Boglo, the senior technology pre-sales consultant, Oracle, despite huge spends on IT security by Nigeria financial institutions, and operators in the oil and gas sector, tangible results are hard to come by because of inappropriate spend. “Nigerian companies, banks, IT firms, those in oil and gas spend more money on information security management and they have not gotten maximum result. So, the Oracle database 11g is an epoch-making event that spans the full range of customers need. Information security is a prerequisite for growth, confidence building and protection of stakeholders in the digital economy,” said Boglo. He notes that the “National Identity Management Scheme requires user provisioning, role management, entitlement management, and risk based access control virtual directive. Therefore, our database must be protected to avoid the impending cyber attacks.” Christy Elendu, manager, Oracle Channels Analyst representing the country manager, said that the company spent about $4.3 billion in 2011 on research and development aimed at producing best software to tackle global security threats. “Oracle has been there since 1971 which we started with proprietary system to open and standard systems and CWG has been a worthy partner. And we are committed to hardware engineering, new opportunities for partners, better solution for customers.
E-Business
NDPC to Begin Prosecution of Data Privacy Offenders from 2025
Nigeria Data Protection Commission (NDPC) will start prosecuting data privacy offenders from the beginning of 2025, according to Babatunde Bamigboye, head of the Legal Enforcement and Regulation Department of the commission.
This move is part of its efforts to enforce regulations and promote responsible data handling in Nigeria.
Bamigboye, disclosed this during a one-day cybersecurity awareness campaign with the theme “Utilising AI-Powered Services for Proactive Cybersecurity” in Abuja.
The event was organised by SOPHOS UK in collaboration with SPOKES Network and Net-Trix Solutions to foster networking with industry experts on how AI is shaping the future of cybersecurity.
Bamigboye explained that, due to the significant implications of data privacy breaches in Nigeria, the commission has embarked on awareness programmes to educate individuals on their data protection rights and inform data processors and controllers of their obligations.
To this end, he announced that beginning next year, the commission would prosecute any data controllers or processors found in breach of the law.
“At this moment, we have investigated quite a number of cases, and in terms of prosecution—as you know, as a lawyer, this means going to court—but we haven’t taken any matters to court yet.
“This is the formative stage; we understand the implications for the country as a whole. And usually, when you talk about prosecution, it also involves some criminal activities. So, at this moment, our focus has been on creating awareness.
“But from next year, we will step up enforcement in this area. What we have done so far is to take remedial actions against certain data controllers and processors who defaulted under the Act,” he noted.
He assured investors that Nigeria’s cyberspace is secure for digital transactions.
“Nigerian cyberspace is safe; otherwise, we wouldn’t be experiencing the smooth flow of digital transactions in Nigeria. It is safe but not without threats, and we are doing our best as a country to combat these threats.”
Christopher Odutola, a sales engineer at SOPHOS UK, noted in his presentation that 100% cybersecurity cannot be guaranteed, hence the need for proactive measures.
“A lot of people will come to you and say, ‘We can give you 99.9% or 100% cybersecurity.’ It’s not true.
“Nobody can provide 100% security anywhere in the world. What they can do, as I mentioned earlier, is reduce the risk for you. However, determining the extent of risk reduction is difficult.
“It’s impossible to eliminate 100% of risks anywhere in the world. What we provide is what we call a cybersecurity breach protection warranty. This warranty covers incidents such as data breaches or ransomware attacks. For instance, if you lose your files while we manage your SOC as a service, we will reimburse up to one million dollars in response costs.”
Odutola further stressed the importance of organisations reducing cyber threat risks to secure cyberspace.
“There are risks to businesses, risks from downtime, attackers, scammers, and the rest, trying to infiltrate networks.
“The risk is always high. As cybersecurity professionals, we are doing as much as possible to reduce these risks.
“The various security controls we implement—antivirus software, firewalls, email security, cloud security, network security, and others—are aimed at reducing risks. We must focus on minimising risks. For instance, we currently see risks originating from third-party suppliers and vendors.”
According to him, “We have a process called risk assessment, which helps to evaluate vendors to ensure they do not introduce risks into our environment. This is why these security controls are crucial.
“We have them in place. It’s equally important to involve senior management in the discussion, as this is often where the gap lies. Unfortunately, cybersecurity is often perceived as a cost centre.”
Harrison Oloye, chief executive officer (CEO) of Net-Trix Solutions, said the event aimed to raise awareness about cyber threats and equip users to manage potential attacks.
“What we did, as Net-Trix Solutions Limited in conjunction with Spokes Network, is to create awareness and educate the public and private sectors on how to use Artificial Intelligence (AI) to combat cyber threats.”
Speaking further on achievements in creating awareness, he said: “As part of our Corporate Social Responsibility (CSR), we educate and train as many people as possible on the dangers of cyber threats and cyber-related crimes.”
Ms. Sifon Ufot, head of Business at SPOKES Network, emphasised the need to take proactive measures against cyber threats.
“We need to stay cyber-safe because hackers working behind the scenes are not joking—they work 24/7. For us, staying proactive is essential. With the help of AI, we can stay proactive; it provides information beforehand and even prevents some attacks from reaching us.”
E-Business
Nigeria, Others Confront Flood of Cyber-Attacks
Check Point, a cyber security company has reported that Nigeria, South Africa, Kenya, and Morocco are seeing targeted cyber-attacks on government, education, and financial institutions.
In its just released 2024 African Perspectives on Cyber security report, Check Point, said that the cyber security sector is growing by 20-25% annually, fuelled by investments in infrastructure and Artificial Intelligence-driven solutions.
The report said that South Africa has seen 3,312 attacks on government institutions every week and a 90% increase in ransomware, with cybercrime costing the country nearly 1% of GDP.
Kenya, in East Africa, sees 4,719 attacks on the government sector each week, indicating an urgent need for enhanced defenses.
According to the report, Nigeria sees 4,718 attacks every week, which is one of the highest in Africa.
In a recent incident, the report states that a banking trojan assault affected 100,000 customer accounts, resulting in a $3 million loss.
Morocco is one of Africa’s most targeted countries, with 8,733 attacks on government entities reported each week, the report said.
According to Check Point, the Moroccan government recently faced a state-sponsored cyberattack that compromised classified communications, raising significant national security concerns.
“Organisations in Africa are attacked roughly 3300 times per week, if we look at the global average it is about 1 800, it is almost double the attacks,” said Hendrik de Bruin, head of security consulting at Check Point SADC during the presentation.
Check Point noted that the continent’s GDP is predicted to exceed $4 trillion by 2027, and digital infrastructure has emerged as a key driver of economic growth. However, rapid digitisation has resulted in increased vulnerability.
De Bruin explained: “We are slowly, but surely digitalising our industries, we are digitising our governments, private sectors are digitising themselves, so we have got an expanding digital attack footprint.
“We also have cloud adoption, which is not new, but picking up pace in Africa. That is another way that these attackers are using to gain access to organisations, and we also see a large uptake on cloud specific attacks as well.”
E-Business
NITDA Alerts Businesses to Rising Ymir Ransomware Threat
National Information Technology Development Agency (NITDA) has warned organisations about Ymir ransomware, describing it as a highly sophisticated cyber threat targeting corporate networks.
In an advisory released yesterday, NITDA outlined the ransomware’s advanced tactics, including memory-based execution designed to evade detection by traditional security tools.
The malware not only encrypts critical data but also exfiltrates sensitive information before encryption, demanding substantial ransoms in cryptocurrency.
“This ransomware is highly advanced and poses a significant threat to organisations, especially those in industries like healthcare, finance, and IT services that handle sensitive data,” NITDA said.
The agency warned that victims face severe operational disruptions, financial losses, and reputational damage. “Ymir’s ability to evade antivirus programs allows attackers to dwell longer in networks, expanding their reach and deepening the damage,” the advisory added.
To counter the threat, the agency urged organisations to take proactive measures, including deploying advanced endpoint detection and response solutions, updating all systems and applications with the latest security patches, and segmenting critical systems into separate network zones.
“Implementing multi-factor authentication across critical systems is crucial to preventing unauthorized access, especially for administrative accounts,” NITDA noted.
The agency also stressed the importance of a robust backup strategy. “Organisations should regularly test their backups for integrity and ensure offline copies are securely stored to avoid total data loss in the event of an attack,” it said.
NITDA emphasised the need for organisations to prioritise cybersecurity in light of evolving threats like Ymir ransomware. It encouraged businesses to seek expert guidance to strengthen their defenses against such attacks.
- News1 day ago
ALX Organises First-ever Business Showcase for its Community Entrepreneurs
- Telecom2 days ago
UNDP and Anambra State Foster Innovation with New Marketplace
- E-Financial2 days ago
CBN Issues Scam Alert, Warns of Fake SWIFT Messages Linked to Transfer Claim
- Telecom2 days ago
MTN Plans Satellite-Internet Rollout
- E-Business2 days ago
Kaspersky, AFRIPOL Strengthen Partnership in Combating Cybercrime
- E-Financial2 days ago
Moniepoint Crowned Financial Inclusion Champion by CBN
- Broadcasting2 days ago
Betland’s Impact: Dotun Ajegbile Drives Change in Underserved Areas
- E-Financial2 days ago
FG to Establish National Youth Development Bank to Support Young Nigerians