A cyber-attack hit the main website of the British Broadcasting Corporation (BBC) and its iPlayer Streaming
service on New Year’s Eve. The BBC’s websites were unavailable for several hours as a result of the attack.
This was the first widely reported cyber-attack of the year 2016. Whilst it is bad enough to hear such news at
the start of the year, what should be of main concern is the number of unreported or stealth cyber-attacks that
have and will occur in 2016. As the Internet and technology continues to evolve, the world becomes more
connected and no one is immune to these threats.
2015 was an incredible year for cybersecurity in Nigeria. In May 2015, the cybercrime bill was signed into law
in Nigeria by erstwhile President Goodluck Jonathan. The implications of this to individuals and corporations is
that cybercrime is now properly defined and legal consequences are attached to any defiance of this law.
At the start of last year, an annual forecast of Nigeria’s cybersecurity landscape was detailed in our 2015
Nigeria Cybersecurity Outlook. This included forecasts that the likelihood of cybersecurity issues were
expected to reduce towards the last quarter of the year due to the successful implementation of the Bank
Verification Number (BVN) exercise; an initiative powered by the Central Bank of Nigeria (CBN). This
prediction was confirmed in a report presented by the Chairman of the Nigeria Electronic Fraud Forum (NEFF)
who is also Director, Banking and Payment System Department, CBN; Mr. Dipo Fatokun during the forum’s
annual dinner. He stated that the loss arising from electronic payment fraud had fallen by 63% and there had
been a reduction of 45.98% in attempted online fraud by the end of 2015 as against the beginning of the same
year. This drop could be partly attributed to the successful implementation of the BVN; a commendable
initiative implemented to secure Nigeria’s payment system in 2015.
The 2015 forecast also indicated higher risk of current and former employees or contractors resorting to
cybercrime as a means to maintain their standard of living. During the course of the year, forensic specialists
were kept busy (hopefully with pockets full) as several companies had to engage digital forensic specialists to
investigate cybercrime perpetrated by various suspects who are largely made up of employees and former
employees of the victim organizations.
The forecast further highlighted the fact that there would be an increase in cyber-attacks of websites and
information technology (IT) infrastructure of political organizations and public institutions, and these would
appear as headlines in local dailies. The prediction became a reality and at various points during the year,
there were several allegations of hacking attempts on the websites of public institutions and political parties.
Some worthy mentions are; the reported hack and de-facing of the Independent National Electoral
Commission (INEC) website in March 2015 and also that of the Lagos state government in December 2015.
2015 segued into 2016 and the cybersecurity journey of hacks, attacks and triumphs still continue. In 2016,
there is undeniably a high likelihood these threats and countermeasures will take the following dimensions:
Sophisticated phishing techniques will be on the rise
With a lens on Nigeria, phishing mails which is a type of social engineering has become the attack of first
choice. This has been a recurring theme in years past but in 2016, there is a likelihood of more sophisticated
use of these attacks with the aim to cause havoc. Typically most of the phishing mails are poorly crafted
oftentimes containing spelling and grammar errors, however we are likely to get to the era where the mails are
properly crafted and the messages more targeted to the victims. Targeted messages might leverage prior
information about the victims from social media, Internet or earlier compromises. It is envisaged that there will
be more collaboration between the public sector, private sector and academia in promoting user awareness in
identifying phishing and social engineering attempts.
Rise of local hacktivism and recognition of Nigerian Hackers
In 2016, there will be more focus on the growth of local home grown hackers. Both ethical and unethical sects
will gain more recognition. Two (2) Nigerian teams represented Africa at the 2015 Global Cyberlympics Finals
Competition and it is expected that more Nigerian teams will participate at the 2016 edition. The Cyberlympics
is a worldwide international hacking competition to increase education and ethics in information security.
Nigeria will be recognized as the hub of the best cyber defense team in Africa. As there will be more
recognition for the ethical hackers in 2016, the unethical sect will also rise in popularity. Western style hack
attempts by terrorists may grow in Nigeria as local hacktivists are likely to take it a notch higher to make hack
will gain more recognition. Two (2) Nigerian teams represented Africa at the 2015 Global Cyberlympics Finals
Competition and it is expected that more Nigerian teams will participate at the 2016 edition. The Cyberlympics
is a worldwide international hacking competition to increase education and ethics in information security.
Nigeria will be recognized as the hub of the best cyber defense team in Africa. As there will be more
recognition for the ethical hackers in 2016, the unethical sect will also rise in popularity. Western style hack
attempts by terrorists may grow in Nigeria as local hacktivists are likely to take it a notch higher to make hack
attempts on government and private institution infrastructures.
Enforcement of the Cybercrime Act
The cybercrime act passed into law in 2015 is a welcome development but many key stakeholders such as the
judiciary and law enforcement agencies are yet to come up to speed in understanding and implementing the
Act. We should expect the enforcement of the cybercrime act to be more pronounced in 2016 and the office of
the National Security Adviser will play a more active and leading role in the campaign.
Anyone or organization that violates any of the laws should expect to suffer the consequences. Companies will
need to share and report threats to the National Computer Emergency Response Team (National CERT)
Coordination Center in accordance with the Act. Individuals/organizations that need to prosecute violators will
need digital forensics services to preserve data in a manner that is admissible in the court of law. Specialists
would also be required to analyse digital data to answer key questions such as “where did the data go?”, “who
had access to it?” and “has it been modified?” etc. Consequently, there will be a rise in the demand for
computer forensic professionals.
Biometric Data Harmonization
A presidential order was issued in 2015 to all Ministries, Departments and Agencies (MDAs) that request and
retain biometric data, to expeditiously harmonize their biometric databases. It is expected that the data
harmonization will effectively link all MDA databases. The Vice President, Professor Yemi Osinbajo explained
that government’s interest in the citizens’ data harmonization is to assist the government in its quest to improve
the socio-economic landscape of Nigeria, particularly targeting the poorest and most vulnerable persons, as
well as to issue unique identification numbers to every Nigerian and legal resident for the improvement of
national security, among others.
Upon successful completion of the data harmonization process, it is expected that the government will be
properly positioned to track and investigate cyber criminals. As it would be able to accurately tell for most
citizens who they are, their age, home address, work place, phone numbers, bank details and a whole other
information in just one database.
Cyber Insurance
Organizations in Nigeria will begin to explore cyber insurance. This will likely begin in the financial services
industry which is the major target of cyber-attacks in Nigeria. Cyber insurance is designed to mitigate losses
from a variety of cyber incidents, including data breaches, business interruption, and network damage. This
should hedge a firm from cyber losses and curtail recovery costs in the event of a cyber-attack. The coverage
also protects against third party liabilities a business might suffer as a result of a failure of system security.
Cyber insurance has not been a popular insurance policy in Nigeria but in 2016, there is a high possibility that
insurance companies will see this as a premium policy to deliver once clients start requesting for it.
Outsourcing of Information Security services
Information Security specialist skills are limited in many companies. With the ever-changing threat landscape
and the need for 24/7 monitoring and response on technological platforms especially in financial institutions,
organizations will need to continually invest more in implementing additional security infrastructure, security
training for their personnel and active recruitment for currently skilled professionals. There is a high likelihood
that more organizations may choose to outsource their information security function rather than investing
heavily in a cyber-intelligence center. For companies that are willing to keep things in-house they will be
constrained to explore tools and techniques that have capabilities for machine learning/artificial intelligence to
prevent, detect, predict and respond to cyber threats in order to improve their cyber incident response
capabilities.
The unending battle in cyberspace continues, criminal actors, policy makers, ethical hackers, innocent
bystanders have all been drawn into a battle. Each second lays the plane for a new battle field. Let’s see what
2016 brings.
I wish you a cyber-prosperous New Year.
Comment
OLUWAGBOHUNMI KAYODE
Good post.. Indeed a perfect one…Nigeria’s issue with cyber-attacks cannot be eradicated for now because Nigeria needs to first of all fix there own issue. Enron was a something USA will never forget and that was why they had to come up with Sarbanes Oxley Act of 2002 where Section 404 emphasizes the need for Organizations to report the efficiency of there internal Controls to SEC during audits. Management assessing internal controls is a medium to check for inadequacies and flaws on controls placed on business processes: at this stage, Information systems will come in because they serve all most every organization. Let’s take for example. SAGE (Peachtree) ERP assists with books and accounts and when auditors asses these to check for its efficiency it will lead them to checking other aspect of organization’s transactions to present a true and fair state of the organization to facilitate accurate report back to the SEC. But here in Nigeria, cases of companies trying to evade tax; where by they join hands with auditors & tax officials who are suppose to work with due diligence and integrity. This is a very big challenge. Auditors (all inclusive of Information systems, finance, operations, process) that are expected to work in a professional manner in line with generally accepted policies and standards for the performance of audit are sometimes corrupt and would neglect the major areas of focus to be examined in other to protect the firm from Fraud. “CYBER CRIME ACT”, signed into law would be effective if people in charge of sanctions on corporations who do not abide by the act are ready to carry out tasks with utmost sincerity. On the other hand: there is also the need for all corporations to recognize the act as a Law binding on every individual organisations