The Director General of the National Information Technology Development Agency (NITDA), Kashifu Inuwa Abdullahi CCIE, made significant contributions to discussions on Africa’s digital transformation at the 79th session of the United Nations General Assembly (UNGA 79) in New York.

Participating in a series of high-profile events, the DG emphasized Nigeria’s efforts in digital transformation, cybersecurity, and public-private partnerships.

At a panel titled “Digital Transformation in Africa: Jumping Ten Years in One,” hosted by the Consulate of Denmark in New York, the UNDP, and cBrain, Abdullahi highlighted how government-led initiatives, private-sector collaboration, and digital technologies can drive Africa’s future growth.

He shared insights from NITDA’s own digital initiatives, offering valuable lessons for other African nations in their pursuit of sustainable digital growth. The panel underscored Africa’s role as the next global workforce frontier.

Also, during the “Summit of the Future” held at the UN headquarters, the DG participated in a session focused on “The Power of the Commons: Digital Public Goods for a More Secure, Inclusive, and Resilient World.”

The panel explored the importance of Digital Public Goods (DPGs) and Digital Public Infrastructure (DPI) in social and economic development. The NITDA boss emphasized the crucial role of academia in advancing digital commons and stressed the significance of safeguarding digital infrastructure for global security.

In a bilateral meeting with Doreen Bogdan-Martin, Secretary-General of the International Telecommunication Union (ITU), Abdullahi also discussed strategic collaboration in capacity building, cybersecurity, and digital transformation. He highlighted NITDA’s efforts to align with ITU’s goals in fostering Nigeria’s IT development, highlighting the importance of international cooperation in achieving mutual digital growth objectives.

On the sidelines of the assembly, the NITDA DG met with Cisco Vice President Fran Katsoudas to review the progress of the Cisco Country Digital Acceleration (CDA) programme. The CDA programme is a key initiative in Nigeria’s digital transformation, aiming to stimulate economic growth and promote innovation. The DG also explored potential collaborations in enhancing cybersecurity to support Nigeria’s long-term development goals under President Bola Ahmed Tinubu’s Renewed Hope Agenda.

Additionally, the NITDA boss was a key participant in the launch of the Universal Digital Public Infrastructure (DPI) Safeguards Framework. This new framework offers guidelines for the design and implementation of DPI, prioritising public interest and promoting safe, inclusive, and interoperable digital infrastructure. He shared Nigeria’s experience in building a resilient and secure DPI, reinforcing the nation’s commitment to leveraging technology for sustainable development.

Through these engagements, the NITDA DG showcased Nigeria’s leadership in digital transformation, positioning the country as a key player in Africa’s digital future.

Data Protection and People’s Rights Under Nigeria’s Data Protection Regulations (NDPR): Know Your Rights

In a time where private information is more and more important and at risk of being exploited, safeguarding people’s privacy is now a significant priority. The implementation of the Nigeria Data Protection Regulation (NDPR) in 2019 in Nigeria is a major move in protecting citizens’ personal information and ensuring organizations follow legal and ethical guidelines when handling data. As the number of Nigerians participating in digital activities like online banking, e-commerce, and social media increases, the NDPR is fundamental in influencing the collection, processing, and protection of data. This article examines the main provisions of the NDPR, the privileges it provides to people, and its influence on companies and the digital environment in Nigeria.

What Is NDPR?

The National Information Technology Development Agency (NITDA) introduced the Nigeria Data Protection Regulation (NDPR) in January 2019. The NDPR was created to tackle the increasing concerns about personal data misuse in both private and public sectors. It is in line with worldwide data protection trends, like the European Union’s General Data Protection Regulation (GDPR), while also meeting the unique requirements of Nigeria’s digital environment.

The goal of the regulation is to safeguard Nigerian citizens’ data from unauthorized access, exposure, or exploitation. It includes a range of industries like finance, telecom, education, health, and online shopping, which commonly involve gathering and handling personal data.

Key Provisions of the NDPR

The NDPR outlines specific guidelines on how organizations should handle personal data. Some of the provision as outlines in NDPR guidelines are:

Data Collection and Consent: Organizations must obtain explicit consent from individuals before collecting their personal data. This ensures that data subjects are fully aware of what information is being collected, the purpose of its collection, and how it will be used.

Data Processing: The regulation mandates that personal data should only be processed for legitimate and specified purposes. Organizations must ensure that the data is accurate and kept up to date. Processing personal data for purposes other than those originally specified is not permitted without further consent from the individual.

Data Security: One of the core elements of the NDPR is the requirement for organizations to implement adequate security measures to protect personal data. This includes safeguarding data from unauthorized access, data breaches, or any form of manipulation.

Third-Party Sharing: If personal data is to be shared with third parties, the organization must inform the data subject and obtain their consent. The third party must also adhere to the same level of data protection as stipulated by the NDPR.

Data Breach Notifications: In the event of a data breach, organizations are required to notify the affected individuals and NITDA within a specified period. This provision ensures that individuals can take action to mitigate the effects of a breach.

People’s Rights Under The NDPR

The acknowledgement of people’s rights regarding their personal data is a key aspect of the NDPR. The rule gives Nigerians various rights to manage how their data is treated. Some of the right are:

1. Right to be Informed: Individuals have the right to be informed about the collection and use of their personal data. Organizations are required to provide transparent information on the types of data collected, the purpose of the collection, and how long the data will be retained.
2. Right to Access: Data subjects have the right to request access to their personal data held by an organization. This means they can inquire about the specific data collected, the reasons for its collection, and whether it has been shared with third parties.
3. Right to Rectification: If an individual’s personal data is inaccurate or incomplete, they have the right to request that the organization correct or update the information.
4. Right to Erasure (Right to be Forgotten): Under certain circumstances, individuals can request that their personal data be deleted. This is particularly relevant if the data is no longer necessary for the purpose it was originally collected or if the individual withdraws their consent for its processing.
5. Right to Data Portability: This allows individuals to obtain and reuse their personal data across different services. They have the right to request that their data be transferred from one service provider to another in a commonly used, machine-readable format.
6. Right to Object: Individuals have the right to object to the processing of their personal data in cases where the processing is based on legitimate interests or public tasks, direct marketing, or scientific/historical research.

Rights Of Individuals In Cases Of Data Misuse, Breaches, Or Use Without Consent

The NDPR grants the data subject particular rights and solutions if their data is mismanaged, disclosed, or utilized without authorization. These rights give individuals the ability to find a solution and shield themselves from additional damage. Some important rights in such situations include:

1. Right to lodge a complaint:

According to Section 3.1.1(e) of the NDPR, individuals have the option to file a complaint with NITDA or other authorized regulatory entities if they suspect their data has been mishandled, processed illegally, or exposed. This privilege allows people to seek legal recourse in cases of mishandling of their information by a company.

2. Right to Compensation

The NDPR acknowledges the entitlement to receive compensation for harm caused by data breaches or unauthorized data handling. Individuals can request compensation from the data controller under section 2.10 of the NDPR if they can prove that their data rights violation resulted in harm. This clause guarantees that individuals affected by data breaches can receive compensation for any financial losses, emotional distress, or harm to their reputation.

3. Right to withdraw consent

Individuals can revoke their consent for the processing of their personal data whenever they choose. As per Section 2.8 of the NDPR, organizations must respect these requests and stop processing the individual’s data unless there are strong legitimate reasons for the processing. This right is important when data is utilized without permission, enabling individuals to take back control of their personal information.

4. Right to Data Erasure

If personal data is breached or used without authorization, individuals have the right to request erasure. According to Section 3.1.2(f) of the NDPR, individuals have the right to ask for the deletion of their personal data if it has been used without permission or if the reason for collecting the data is no longer valid. This right, sometimes referred to as the “right to be forgotten,” guarantees that unauthorized data use is stopped and eliminated from any future handling.

5. Right to Restriction of Processing

If someone believes their data has been mishandled or misused, they can ask for processing restrictions under Section 2.10.2. This right enables people to halt additional data processing during ongoing investigations. It serves as a protection, making sure no additional damage occurs during the resolution of the problem.

Benefits To Individuals

When individuals’ rights are breached under the NDPR, they are eligible for certain benefits.

• Reclaiming Privacy: Through exercising the right to be forgotten or limiting additional data processing, individuals can take back authority over their personal information and reduce the consequences of its unauthorized exploitation.
• Financial Compensation: If individuals experience financial loss or emotional distress due to a data breach or misuse, they have the right to request financial compensation from the organization at fault. This serves as a deterrent for careless data handlers and compensates for the damages they cause.
• Legal Remedy: By utilizing the NDPR’s complaint procedures and regulatory supervision, people have the opportunity to take legal measures or regulatory actions to hold those responsible for data misuse or breaches accountable.
• Public Trust: The NDPR’s protections promote trust in the digital world, inspiring people to engage in online activities knowing their data rights are secure.

Compliance Requirements For Organizations

In order to comply with the NDPR, organizations must meet various obligations related to compliance. Some of these items are:

• Appointment of Data Protection Officers (DPOs): Organizations that process a large volume of personal data must appoint a DPO to oversee compliance with the NDPR and ensure the organization’s data practices are in line with the regulation.
• Annual Data Protection Audit: Organizations are required to conduct annual data protection audits and submit the reports to NITDA. This process helps organizations identify potential risks and ensure that they are taking the necessary steps to protect personal data.
• Fines for Non-Compliance: Failure to comply with the NDPR can result in significant penalties, including fines of up to 10 million Naira or 2% of an organization’s annual revenue, depending on the nature and severity of the breach.

Challenges and Gaps in NDPR Implementation

Even though the NDPR has created a strong foundation for safeguarding data in Nigeria, there are still obstacles in its execution. An important obstacle is the lack of public awareness and  law enforcement. A large number of Nigerian citizens are still not completely informed about their data rights or the responsibilities that organizations have under the NDPR. Raising public education and awareness is essential in order to give citizens the power to safeguard their privacy.

Another difficulty that must be addressed is ensuring compliance. While NITDA has made progress in encouraging adherence, there are doubts about the agency’s ability to ensure proper enforcement of regulations, especially with major international companies, government agencies and smaller domestic enterprises.

Conclusions

The NDPR in Nigeria sets up rules for data protection and gives individuals rights to safeguard their personal information. The regulation offers various solutions, such as compensation and erasure rights, in situations where there is data misuse, breaches, or unauthorized processing. These safeguards are essential for establishing confidence in Nigeria’s fast-developing digital economy and guaranteeing the preservation of privacy in the era of digital technology. As the public becomes more aware of their data rights and enforcement becomes more rigorous, the NDPR will remain vital in influencing Nigeria’s digital future.

Written By Ibrahim Abuh Sani, Co-Founder, Eybrids.

Abu Ibrahim Sani, Co-Founder, Eybrids

Introduction

The Internet of Things (IoT) has revolutionized the way we interact with technology, seamlessly integrating smart devices into our daily routines. From smart thermostats and wearable fitness trackers to home security cameras and voice assistants, IoT devices offer unparalleled convenience and connectivity. However, their rapid proliferation and extensive network connectivity also present significant security challenges. As more devices become interconnected, they create a broader attack surface for cybercriminals. This article aims to delve into the most common security vulnerabilities found in IoT devices, examining how these weaknesses can be exploited by hackers. Furthermore, it will provide practical strategies to defend against these risks, ensuring that your IoT ecosystem remains secure. Understanding these vulnerabilities and implementing effective defences is crucial for safeguarding personal and organizational data in an increasingly connected world.

What are IoT Devices?

IoT devices are interconnected objects that communicate over the internet, allowing them to send and receive data to and from other devices. These devices range from everyday items like smart thermostats and security cameras to advanced wearable technology such as fitness trackers and smartwatches. By integrating sensors, software, and network connectivity, IoT devices enhance functionality and user convenience. For example, a smart thermostat adjusts home temperatures based on real-time data and user preferences, while a security camera offers remote monitoring capabilities for enhanced safety.

In modern life, IoT devices play a crucial role in both personal and professional settings. They streamline everyday tasks, improve efficiency, and provide valuable insights through data collection and analysis. In personal settings, IoT devices contribute to home automation, energy management, and health monitoring. Professionally, they facilitate enhanced operational efficiency, predictive maintenance, and smarter decision-making. The pervasive adoption of IoT technology is reshaping industries by offering innovative solutions and creating new opportunities for businesses and individuals alike. However, as their influence grows, addressing the associated security challenges becomes increasingly essential to ensure their benefits are fully realized without compromising safety.

Common Vulnerabilities in IoT Devices

• Weak or Default Passwords: Many IoT devices come with weak or default passwords, such as “admin” or “123456,” which are rarely changed by users. This vulnerability allows attackers to easily gain unauthorized access, compromising the device and potentially the entire network it is connected to. These default credentials are often publicly known and exploited in automated attacks, leading to breaches that can affect both personal and organizational security.
• Lack of Encryption: Insufficient data encryption is another significant vulnerability in IoT devices. Without robust encryption, data transmitted between devices or from a device to the cloud can be intercepted and accessed by unauthorized parties. This lack of encryption exposes sensitive information, such as personal details or operational data, to tampering and theft, compromising user privacy and security.
• Insecure Communication Protocols: Insecure communication protocols also pose a major risk. Many IoT devices use outdated or poorly secured protocols for data transmission, which can be intercepted by attackers. These unprotected communication channels allow cybercriminals to eavesdrop on or manipulate data, potentially leading to unauthorized control of the device or leakage of sensitive information.
• Outdated Firmware and Software: Outdated firmware and software contribute to security vulnerabilities by leaving known flaws unpatched. Manufacturers may not regularly update their devices, leading to unaddressed security issues. This neglect creates opportunities for attackers to exploit these vulnerabilities, gaining control over the device or leveraging it as a gateway to other parts of the network.
• Insecure Interfaces: Insecure web and mobile interfaces are another point of attack. Many IoT devices are controlled through apps or web interfaces that may lack proper security measures. Attackers can exploit weaknesses in these interfaces to gain unauthorized access, control the device, or disrupt its functionality. Poorly designed interfaces can thus serve as gateways for broader cyberattacks, undermining device security and user safety.

Exploitation of IoT Vulnerabilities

The exploitation of IoT vulnerabilities can have significant and far-reaching consequences. One major method attackers use is the creation of botnets, which are networks of compromised devices controlled remotely by cybercriminals. By exploiting vulnerabilities in IoT devices—such as weak passwords or outdated firmware—attackers can hijack these devices and enlist them into a botnet. Once in control, the botnet can be used to launch distributed denial-of-service (DDoS) attacks, overwhelming targeted websites or online services with traffic and causing them to become inaccessible (as shown in fig. 2). Such attacks can disrupt business operations, damage reputations, and incur substantial financial losses.

Another critical risk is data theft and privacy breaches. Many IoT devices collect and transmit sensitive personal or business data, including health metrics, financial information, or proprietary business information. When these devices lack proper encryption or have insecure communication protocols, attackers can intercept and access this data.

For instance, a compromised smart home security camera might reveal private footage, or a hacked wearable fitness tracker might expose health records. The theft or manipulation of such data not only violates privacy but can also be used for identity theft, financial fraud, or corporate espionage. Also, exploited vulnerabilities can lead to unauthorized control of IoT devices. Attackers gaining control over a smart thermostat could disrupt heating or cooling, while compromised industrial IoT systems could lead to operational failures or even safety hazards. This unauthorized control can be used to cause physical damage, disrupt operations, or manipulate critical systems, posing severe risks to both individuals and organizations.

Strategies for Defending Against IoT Vulnerabilities

Defending against IoT vulnerabilities requires a proactive and multi-layered approach to ensure the security and integrity of connected devices. Implementing strong security practices can significantly mitigate the risks associated with IoT devices.

Change Default Passwords: One of the most fundamental steps is to change default passwords. Many IoT devices come with factory-set passwords that are often weak and widely known. These default credentials can easily be exploited by attackers if not changed. Users should create strong, unique passwords for each device, incorporating a mix of letters, numbers, and special characters. This practice prevents unauthorized access and enhances the overall security of the IoT network. It is crucial for both individuals and organizations to establish password policies and enforce regular password changes to maintain device security.

Implement Encryption: Implementing strong encryption is another vital strategy. Encryption protects data by converting it into an unreadable format that can only be deciphered with the correct decryption key. For IoT devices, it is essential to use robust encryption protocols for data in transit and at rest. This means ensuring that all data transmitted between devices, as well as stored data, is encrypted to prevent interception and unauthorized access. Encryption helps safeguard sensitive information such as personal data, operational details, and business intelligence, reducing the risk of data breaches and privacy violations.

Regular Software Updates and Patches: Regular software updates and patches are crucial for addressing known vulnerabilities. IoT device manufacturers periodically release updates to fix security flaws and improve functionality. Users should regularly check for and install these updates to ensure that their devices are protected against newly discovered threats. Outdated firmware and software can be exploited by attackers to gain unauthorized access or disrupt device operations. By keeping devices up to date, users can benefit from the latest security enhancements and minimize the risk of exploitation.

Secure Communication Protocols: Secure communication protocols are also essential in protecting IoT devices. Many devices use communication protocols that may not be adequately protected. Implementing secure protocols, such as Transport Layer Security (TLS) or Secure Socket Layer (SSL), ensures that data exchanged between devices and servers is encrypted and protected from eavesdropping or tampering. Users should verify that their IoT devices support modern security standards and employ protocols that offer robust protection against potential attacks.

Device and Network Segmentation: Device and network segmentation is a strategic approach to limiting the impact of potential breaches. By isolating IoT devices on separate networks from critical systems and data, users can contain any security incidents that may occur. For example, creating a separate network for IoT devices, distinct from the main business network, helps prevent a compromised device from affecting other sensitive areas. Additionally, network segmentation can help manage and monitor device traffic more effectively, making it easier to detect and respond to suspicious activities.

Let me leave you with this final note

IoT devices, while offering substantial benefits through their connectivity and automation capabilities, present significant security vulnerabilities that need to be addressed. Common issues include weak or default passwords, lack of encryption, insecure communication protocols, outdated firmware, and insecure interfaces. These vulnerabilities can lead to serious consequences, such as unauthorized access, data breaches, and operational disruptions.

To effectively defend against these risks, adopting a proactive approach is crucial. Changing default passwords to strong, unique ones is a fundamental step in preventing unauthorized access. Implementing robust encryption for data both in transit and at rest ensures that sensitive information remains protected from interception and tampering. Regularly updating firmware and software is essential to patch known vulnerabilities and mitigate security risks. Using secure communication protocols, such as TLS or SSL, helps protect data exchanges between devices. Finally, segmenting devices and networks limits the potential impact of breaches by isolating IoT devices from critical systems.

Authors Name: Ahmed Olabisi Olajide (Co-founder Eybrids)
LinkedIn: Olabisi Olajide | LinkedIn