Follow Us on Google
By Chinenye Anuforo
[email protected]
The National Information Technology Development Agency (NITDA) and cybersecurity experts have called for wider adoption of Domain Name System Security Extensions (DNSSEC) to protect Nigeria’s digital infrastructure against cyberattacks, phishing, domain hijacking and other online threats.
They also urged government institutions, internet service providers, domain registrars and businesses to strengthen security measures as cybercriminals increasingly exploit artificial intelligence (AI), vulnerable digital systems and stolen personal information to perpetrate fraud.
The call was made at a cybersecurity awareness webinar organised by the Nigeria Internet Registration Association (NiRA), themed “Securing Nigeria’s Digital Foundation: DNSSEC, the .ng Domain, and the Future of National Cyber Resilience.”
Speaking on behalf of NITDA Director-General, Inuwa Kashifu, Olusegun Funmi Folayan said signing Nigeria’s .ng domain zone was an important step towards strengthening the country’s digital security but warned that its effectiveness would depend on widespread adoption by registrars, domain owners, network operators and government institutions.
He described the .ng domain as a critical national asset that required collective protection, stressing that the responsibility for securing it extended beyond the registry.
DNSSEC is a security extension that enables DNS resolvers to verify the authenticity and integrity of information used to direct internet users to websites and other online services. It helps prevent certain attacks in which criminals manipulate DNS responses to redirect unsuspecting users to fraudulent destinations.
However, DNSSEC does not encrypt internet traffic or independently prevent domain-account hijacking, making additional cybersecurity measures necessary.
Figures presented during the webinar indicated that only 9.15 per cent of accredited domain registrars offered DNSSEC-enabled domain management as of July 2026, despite the signing of the .ng zone in February 2026 and its public unveiling in April.
The speakers called for urgent efforts to expand adoption, particularly among government institutions and businesses operating in critical sectors such as banking, fintech, telecommunications and e-commerce.
They warned that weak domain security could expose organisations and their customers to phishing, website impersonation, data theft and financial fraud.
Onyinye Daniel Onyekpeze, Head of the Incident Handling Department at the Nigeria Computer Emergency Response Team (ngCERT), identified social engineering, ransomware and data exposure arising from security misconfigurations among the major cybersecurity concerns facing the country.
He said cybercriminals were becoming increasingly sophisticated in their methods, with artificial intelligence providing additional capabilities for carrying out attacks.
Onyekpeze explained that DNS-related incidents did not always come to the attention of incident-response teams as DNS problems because affected organisations often initially attributed service disruptions to hosting providers or network failures.
For instance, a government website becoming unavailable, emails failing to arrive or users being redirected to suspicious websites could indicate DNS compromise or misconfiguration.
He said incident-response teams received reports through affected organisations, security alerts, intelligence-sharing arrangements with international partners and monitoring platforms.
He stressed the need for improved awareness, investigation and coordination among organisations and service providers to identify the root causes of cyber incidents.
Other News
From the law-enforcement perspective, a representative of the Nigeria Police Force National Cybercrime Centre identified phishing campaigns and website impersonation as significant threats, particularly to customers of financial institutions.
The police representative said criminals used fraudulent websites to trick victims into disclosing sensitive information and cited a case in which artificial intelligence was reportedly used to develop phishing links designed to bypass certain one-time password authentication mechanisms.
The development, he said, demonstrated how emerging technologies were increasing the sophistication of cybercrime.
Meanwhile, Abubakar Mahmud, an IT and cybersecurity officer with the Nigeria Data Protection Commission (NDPC), warned that large-scale data theft could expose Nigerians to identity theft and financial fraud.
He said personally identifiable information had become a valuable target as more services became connected to digital identity systems and financial platforms.
Mahmud urged organisations to strengthen the protection of personal information and comply with applicable breach-reporting obligations under the Nigeria Data Protection Act 2023.
He also emphasised the need to educate Nigerians about the risks associated with exposing personal information, including phone numbers, dates of birth and other identifying details that criminals could exploit.
The private-sector perspective was provided by Hamzah ‘Lateef, Founder and Chief Operating Officer of CyberPlural MSSP and CISO of Nigeria.
Lateef said cybercriminals were increasingly targeting digital systems to gain access to sensitive information and achieve financial objectives.
He noted that many organisations operated internet-facing websites, servers and applications without adequate visibility into activities across their systems, leaving them vulnerable to attacks that might only be detected after external parties raised the alarm.
He added that criminals were exploiting vulnerable legacy applications and impersonating government agencies and financial institutions to distribute phishing messages and steal personal information.
According to him, the consequences of cyberattacks extended beyond technical disruptions to include financial losses, identity theft and cases in which unsuspecting individuals discovered financial obligations they had not incurred.
Lateef called for stronger security monitoring, intelligence-sharing and coordinated responses among private cybersecurity firms, government agencies and other stakeholders.
The webinar also urged ministries, departments and agencies to conduct regular risk assessments and vulnerability tests, fix identified weaknesses, strengthen identity and access controls, and report cybersecurity incidents promptly.
Participants called for DNS security to become a standard component of organisational cybersecurity assessments, with government domains, particularly those under .gov.ng, prioritised for DNSSEC deployment.
They also urged internet service providers to implement DNSSEC validation so that forged or altered DNS responses could be detected and rejected.
The speakers stressed that signing the .ng zone was only the first step and that effective protection would require broader adoption, proper configuration, continuous monitoring and stronger security practices across the digital ecosystem.
They maintained that securing Nigeria’s digital infrastructure was a shared responsibility involving government institutions, regulators, registrars, network operators, businesses and individual users.
