The short answer
If you do nothing else, stop these ten mistakes:
- Passwords alone
- Delayed updates, unsupported software
- Antivirus as enough
- Backups never restored
- Everyone an administrator
- "The cloud provider handles security"
- No incident response plan
- Once-a-year training
- Forgotten suppliers
- "Too small to be a target"
The internationally recognised NIST Cybersecurity Framework addresses almost all of them and gives any Nigerian organisation a sensible structure. ngCERT publishes advisories on threats affecting Nigeria.
The ten mistakes, and what to do instead
| Mistake | Why it hurts | Do instead |
|---|---|---|
| 1. Passwords alone | Phished, guessed, reused; SMS codes alone invite SIM-swap fraud | MFA on email, remote access, cloud apps and admins; a password manager; security keys, passkeys or authenticator apps for important accounts |
| 2. Delayed updates, unsupported software | Attackers move fast once a flaw is public; unsupported software will never be patched; pirated copies cannot update safely and may carry malware | Automatic updates where practical, internet-facing first; track end-of-support dates, budget replacements in time |
| 3. Antivirus as enough | It finds known malware; many attacks use legitimate tools and stolen credentials | EDR, which records behaviour and can isolate devices, with someone acting on alerts, ideally around the clock (EDR vs antivirus) |
| 4. Backups never restored | An untested backup is a hope, not a plan; ransomware targets connected backups | 3-2-1 (three copies, two media types, one off site), an offline or immutable copy, scheduled restore tests, a known full recovery time (backup vs recovery plan) |
| 5. Everyone an administrator | One bad click can compromise the device or network | Least privilege: few admins, separate admin accounts, access reviewed on role changes and departures |
| 6. "The cloud provider handles security" | Providers secure their infrastructure; under SaaS you still manage access and data, and stay accountable for your information | Secure settings in Microsoft 365, Google Workspace and other SaaS; audit logging on; critical SaaS data backed up separately |
| 7. No incident response plan | The first hours are lost to confusion | A short plan naming who decides, investigates, communicates and calls your legal adviser and insurer, with breach assessment and reporting; kept offline, rehearsed yearly |
| 8. Once-a-year training | One annual video changes little | Short, regular training and phishing simulations on real threats; easy reporting; thank reporters (training programme guide) |
| 9. Forgotten suppliers | IT providers, vendors and contractors often have remote access or your data | List suppliers with access; contract for MFA and security commitments; remove unneeded access; ask how they would report an incident to you |
| 10. "Too small to be a target" | Automated attacks scan for any exposed system or stolen password; smaller firms are easier, and a route into larger customers | Use a recognised baseline as a checklist and fix gaps in order of risk |
Quick self-assessment
- MFA is required for email, remote access, cloud apps and admins.
- Updates install automatically or within an agreed window.
- We know which systems reach end of support within 18 months.
- EDR is deployed and alerts are monitored.
- Offline or immutable backup exists; a restore was tested this quarter.
- Daily work is done without administrator rights.
- SaaS security settings and audit logs have been reviewed.
- We have a written, rehearsed incident response plan.
- Staff receive regular training and can report phishing easily.
- Supplier access is listed and reviewed.
Limitations and next step
This is a starting point, not a full security programme: regulated sectors (health, finance, education) and holders of sensitive data usually need more, such as formal risk assessments, network segmentation and centralised logging, and may have sector rules (for example from the Central Bank of Nigeria for banks and payment service providers). General information, not legal advice.
A security assessment shows which gaps apply to you and which to fix first. Our cybersecurity services then help close them, with 24/7 monitoring and support for managed-service clients.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Cybersecurity Framework, National Institute of Standards and Technology (NIST)
- #StopRansomware, Cybersecurity and Infrastructure Security Agency (CISA)
- ngCERT, Nigeria Computer Emergency Response Team
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.