Cybersecurity for Businesses

• • Why Nigerian businesses are prime targets for cybercrime
• • The most common attacks in Nigeria: phishing, ransomware, BEC, and account takeover
• • How attackers find and select targets — and what makes your business attractive to them
• • High-profile Nigerian cyber incidents and what we can learn from them
• • The cost of a breach: financial, reputational, and legal consequences
• • NDPA 2023 overview — your obligations as a data controller or data processor
• • The difference between cybersecurity, privacy, and compliance — and why you need all three

Exercise: Complete a business risk self-assessment to identify your most exposed areas

• • Why WordPress sites are the most attacked platforms in the world — and how to protect yours
• • The security plugin stack: Wordfence, Sucuri, and iThemes Security
• • Keeping WordPress, themes, and plugins updated — the single biggest security action
• • Secure login: strong passwords, two-factor authentication, and login attempt limiting
• • Hiding your WordPress login page and admin URL
• • Database prefixes, file permissions, and disabling XML-RPC
• • Backups: the UpdraftPlus setup that protects you from ransomware and server failures
• • SSL/HTTPS: how it works, why it's mandatory, and how to enforce it

Exercise: Security audit and hardening of a WordPress site using a Brela security checklist

• • Why password reuse is the most common reason accounts get compromised
• • Password managers: what they are, how they work, and which to use (Bitwarden for businesses)
• • Creating and enforcing a password policy for your organisation
• • Two-factor authentication (2FA): setting it up on email, social media, banking, and hosting
• • Principle of least privilege: who should have access to what — and why not everyone needs admin
• • Offboarding security: revoking access when staff leave
• • Shared accounts: why they are a security risk and how to eliminate them

Exercise: Conduct an access audit of your business accounts and identify vulnerabilities

• • What phishing is and why it succeeds even against smart people
• • Types of phishing: email phishing, SMS phishing (smishing), WhatsApp phishing, and voice phishing (vishing)
• • Business email compromise (BEC): the attack that has cost Nigerian companies billions
• • How to recognise a phishing email: the red flags checklist
• • Pretexting and impersonation: how attackers pose as your CEO, bank, or FIRS
• • Safe practices for wire transfers and payment instruction changes
• • What to do if you click a suspicious link or enter your credentials on a fake page
• • Training your staff to be your first line of defence — not your weakest link

Exercise: Phishing simulation exercise — can you and your team spot the fakes?

• • What the Nigeria Data Protection Act 2023 requires of businesses
• • Data controllers vs data processors: which are you and what does it mean
• • Lawful bases for processing personal data under NDPA 2023
• • Data subject rights: access, correction, deletion, and portability
• • Data Protection Impact Assessments (DPIA): when they are required and how to conduct one
• • Privacy notices and consent collection: what your website, forms, and systems need
• • Cross-border data transfers under NDPA 2023 and GAID 2025
• • Breach notification: what to do and when to report to NDPC
• • Appointing a Data Protection Officer (DPO): who needs one and what they do

Exercise: Audit your current data practices against the NDPA 2023 checklist

• • What to do in the first 24 hours after a cyber incident
• • Building a simple incident response plan for an SME
• • Communication during an incident: internal, external, and regulatory notifications
• • Business continuity: keeping operations running during and after an attack
• • Recovery: restoring from backups and getting back online safely
• • Post-incident review: what went wrong and how to prevent recurrence
• • Building a security-first culture: training, policies, and ongoing awareness
• • Security tools every Nigerian SME should be using (and most aren't)
• • Course close: certificate information, your personalised security action plan, and next steps