Nigeria Cybersecurity Outlook for 2016

A cyber-attack hit the main website of the British Broadcasting Corporation (BBC) and its iPlayer Streaming service on New Year’s Eve. The BBC’s websites were unavailable for several hours as a result of the attack. This was the first widely reported cyber-attack of the year 2016.
Whilst it is bad enough to hear such news at the start of the year, what should be of main concern is the number of unreported or stealth cyber-attacks that have and will occur in 2016. As the Internet and technology continues to evolve, the world becomes more connected and no one is immune to these threats. 2015 was an incredible year for cybersecurity in Nigeria and the world.

In May 2015, the cybercrime bill was signed into law in Nigeria by thr former President Goodluck Jonathan. The implications of this to individuals and corporations is that cybercrime is now properly defined and legal consequences are attached to any defiance of this law. At the start of last year, an annual forecast of Nigeria’s cybersecurity landscape was detailed in our 2015 Nigeria Cybersecurity Outlook. This included forecasts that the likelihood of cybersecurity issues were expected to reduce towards the last quarter of the year due to the successful implementation of the Bank Verification Number (BVN) exercise; an initiative powered by the Central Bank of Nigeria (CBN). 

This prediction was confirmed in a report presented by the Chairman of the Nigeria Electronic Fraud Forum (NEFF) who is also Director, Banking and Payment System Department, CBN; Mr. Dipo Fatokun during the forum’s annual dinner. He stated that the loss arising from electronic payment fraud had fallen by 63% and there had been a reduction of 45.98% in attempted online fraud by the end of 2015 as against the beginning of the same year. This drop could be partly attributed to the successful implementation of the BVN; a commendable initiative implemented to secure Nigeria’s payment system in 2015. 

During the course of the year, forensic specialists were kept busy as several companies had to engage digital forensic specialists to investigate cybercrime perpetrated by various suspects who are largely made up of employees and former employees of the victim organizations. The forecast further highlighted the fact that there would be an increase in cyber-attacks of websites and information technology (IT) infrastructure of political organizations and public institutions, and these would appear as headlines in local dailies. The prediction became a reality and at various points during the year, there were several allegations of hacking attempts on the websites of public institutions and political parties. Some worthy mentions are; the reported hack and de-facing of the Independent National Electoral Commission (INEC) website in March 2015 and also that of the Lagos state government in December 2015. 

This year, there is undeniably a high likelihood these threats and countermeasures will take the following dimensions: Sophisticated phishing techniques will be on the rise. This has been a recurring theme in years past but in 2016, there is a likelihood of more sophisticated use of these attacks with the aim to cause havoc. Typically most of the phishing mails are poorly crafted oftentimes containing spelling and grammar errors, however we are likely to get to the era where the mails are properly crafted and the messages more targeted to the victims. Targeted messages might leverage prior information about the victims from social media, Internet or earlier compromises. 

It is envisaged that there will be more collaboration between the public sector, private sector and academia in promoting user awareness in identifying phishing and social engineering attempts. In 2016, there will be more focus on the growth of local home grown hackers. Both ethical and unethical sects will gain more recognition. In addition, Nigerian teams is expected to represent Africa at the Global Cyberlympics Finals Competition. The Cyberlympics is a worldwide international hacking competition to increase education and ethics in information security. Nigeria will be recognized as the hub of the best cyber defense team in Africa. As there will be more recognition for the ethical hackers in 2016, the unethical sect will also rise in popularity. 

The cybercrime act passed into law in 2015 is a welcome development but many key stakeholders such as the judiciary and law enforcement agencies are yet to come up to speed in understanding and implementing the Act. We should expect the enforcement of the cybercrime act to be more pronounced in 2016 and the office of the National Security Adviser will play a more active and leading role in the campaign.