The data of many Nigerians entrusted with organisations and individuals are daily compromised. This has increased worries about the security of Nigeria’s cyber space. NAN reports.
OFTEN Nigerians are inundated with messages on their telephone sets and e-mails asking them to subscribe to goods and services.
The recipients, especially public service workers, are encouraged to apply for loans from micro-credit outfits on very liberal conditions, including not providing securities for the facilities.
Repayments for such loans, which can be obtained within 24 hours, are cheap with interests on single digit.
Others request prospective subscribers to buy household goods on credit and the repayment plan spread overtime.
Prospective subscribers are asked not to worry about the mode of repayment since the vendors can access their payroll information from their employers.
This has often been the case with Federal Government employees enrolled in the Integrated Personnel Payroll Integrated System (IPPIS).
While the promoters of the services claim they work with IPPIS, the agency under the Office of Accountant-General of the Federation, denies knowledge of the transactions. Meanwhile, the workers on the receiving end moan.
Apart from public sector workers, bank customers receive similar solicitations from banks which they do not bank with. The banks ask them to apply for loans.
For instance, in 2015, Amecom investment, a marketing company based in Abuja approached staff of a government agency to solicit patronage for its goods. In spite of not supplying goods, IPPIS deducted sums from the salaries of persons who showed interest. 
Mr Livinus Ugochukwu, a former employee of News Agency of Nigeria (NAN) said that in August 2018, IPPIS deducted N10,158.33 from his salary and credited Full Range Micro-Finance company, an organisation he did not know.
Ugochukwu said IPPIS also deducted N8,784 from his salary in May and credited Brain Integrated System, another organisation he did not know.
Another public sector worker, Mrs Hadiza Aliyu, said she received a text message from CreditWallet, a micro-credit company, telling her that she had been pre-qualified for N500,000 loan.
On enquiry about how the loan would be re-paid, a desk officer with the company said the group was working with IPPIS.
In all cases, the data of the prospective subscribers are compromised by organisations and individuals they had been entrusted. And so many worry about the security of Nigeria’s cyber space.
This is more so as Nigeria works toward establishing a digital economy with the re-christening of Ministry of Communications as Ministry of Communications and Digital Economy.
Cyber security or information technology security is the body of technologies, processes and practices designed to protect networks, devices, programmes and data from attack, damage or unauthorised access.
Highly beneficial to government, the military, corporate institutions who store unprecedented, sensitive information on computers and other platforms, such data require protection.
According to Deloitte, a multinational network company that provides audit, tax, consulting, enterprise risk and financial advisory services, countries, including Nigeria, are facing cyber security breaches.
The most recent case was the Facebook data scandal that affected up to 87 million users, while there were cases of phishing attacks, malicious software embedded at the point of payment and ransomware that affected unsusceptible citizens.
Central Bank of Nigeria’s Cyber Security Framework and the European Union’s General Data Protection Regulation (GDPR) raised awareness on cyber security in the country in 2018.
An ICT security expert, Mr Kenneth Okereafor, said there were serious cyber attacks on public, private sector targeting vital operations and assets.
Okereakor said the attacks were organised, disciplined, aggressive, well resourced with perpetrators as nations, terrorist groups, criminals, hackers or people with intention to compromising internet security.
“Currently, there is effective deployment of malicious software causing significant potential disruption of critical information systems and services, as well as over commercialisation of cyber security skills and the exploitation of citizens’ ignorance.”
The expert said a survey reported that 60 per cent of Nigerian firms suffered cyber attack yearly.
He claimed the Federal Government lacked guidelines and standards for the acquisition of technology infrastructure and solutions across systems as well as risk management processes.
“The mechanism for cyber incident response is not standardised in agencies, government enforcement of compliance to existing cyber security legislations is weak and there is no prioritisation of cyber security capacity development in federal agencies.”
Okereafor urged government to adopt a single Technology Risk Management Framework supported by legislation to incorporate internet security as part of information system acquisition and implementation.
“As an oversight, the Federal Government can create a single Technology Risk Body to provide a consistent framework for protecting information at all levels.”
He said with cyber risk management framework, citizens and the country would have enabled strategic, long- term and short-term cyber security and consistent management of technology supply chains.
The expert said the framework would bridge the gap between technology and business and provide realistic support for existing, future regulation requirements.
Dr Vincent Olatunji, the Chairman, Data Implementation Committee, National Information Technology Development Agency (NITDA), also acknowledges the threat to Nigeria’s cyber space.
Olatunji said: “Individuals own their information. Data collected on a consumer cannot be sold to third parties.
“Companies must protect an individual’s Internet Protocol (IP) address or cookie data with the same rigor as a name, address, national identity number and bank verification numbers and also request for data transfer.”
He said if cyber security must be applicable to systems in the country, privacy of data must be designed in respect of the data subject and policies and procedures for managing security breaches put in place.
“Businesses need to review their data protection policies, technology for compliancy; they should encrypt data in their possession and be up to date with security solutions.
“Personally obtained data and collected by a data controller with consent from the subject should be used for the specific purpose and not for the promotion of businesses or distributed without authorisation,” Olatunji said.