Nigeria’s digital economy faces growing cybersecurity risks as organisations experience an average of 4,361 attempted cyberattacks weekly, exposing weaknesses in the country’s internet infrastructure and strengthening calls for tougher protection of the systems that direct users to government, financial and business websites.
The warning comes as the National Information Technology Development Agency (NITDA) moves to make Domain Name System Security Extensions (DNSSEC) implementation part of its cybersecurity assessment of all Ministries, Departments and Agencies (MDAs), in a bid to prevent attackers from exploiting weaknesses in the internet’s domain-name infrastructure.
Speaking at a cybersecurity awareness webinar organised by the Nigeria Internet Registration Association (NiRA), Kashifu Inuwa Abdullahi, director-general of NITDA, said the agency would include DNS security in its cybersecurity assessment protocol and push for government-owned .gov.ng domains to adopt DNSSEC.
Read also: Nigeria’s oil sector faces AI cyberattacks as smaller firms become entry points
Represented by Oluwasegun Falayan, the NITDA chief said having a government domain was no longer sufficient without security mechanisms to protect it against manipulation and other cyber threats.
“So we must lead, we must ensure that every .gov.ng is signed as much as possible, and we provide DNS as an inclusion in every security assessment that we do. So it’s not enough to just have a domain, but it must be secured and must be signed,” he said.
The directive highlights a less visible but increasingly important vulnerability in Nigeria’s digital transformation: the security of the infrastructure that connects internet users to online services.
The Domain Name System (DNS) functions as the internet’s address book, translating website names into numerical internet addresses that computers use to communicate. When attackers manipulate this process, users can be redirected to fraudulent websites even when they enter what appears to be a legitimate web address.
DNSSEC adds a layer of protection through digital signatures that allow internet resolvers to verify whether DNS responses are authentic and have not been altered.
However, its adoption remains a challenge across Nigeria’s digital ecosystem, where government institutions, businesses, internet providers and domain registrars have different responsibilities for securing the infrastructure.
Adesola Akinsanya, president of NiRA, said Check Point Research reported that the average Nigerian organisation faced about 4,361 attempted attacks weekly in June, compared with a global average of approximately 2,270.
The figures underscore the pressure on organisations as digital services expand and cybercriminals increasingly exploit vulnerabilities in online systems.
Akinsanya also cited Nigeria Inter-Bank Settlement System (NIBSS) figures showing that digital-payment fraud amounted to N25.85 billion in 2025, despite a decline in reported incidents. He cautioned that the reduction could reflect under-reporting rather than an improvement in security.
“DNS security is not a technical hobby. It is an economic question,” he said.
The economic implications extend beyond the theft of funds. Compromised domain infrastructure can undermine trust in digital payment platforms, expose customers to phishing attacks, disrupt access to essential services and damage the credibility of Nigerian businesses operating online.
For a country seeking to expand digital financial services, electronic government platforms and technology-driven businesses, weaknesses in the internet’s naming infrastructure could create risks that extend across multiple sectors.
Akinsanya, however, cautioned against treating DNSSEC adoption as a standalone solution, noting that the technology does not encrypt internet traffic, prevent distributed denial-of-service attacks or protect against compromised domain registrar credentials.
He warned that improperly configured DNSSEC could also make domains inaccessible to users whose internet resolvers validate digital signatures.
This means that adoption must be accompanied by technical competence, proper implementation and coordination among the organisations responsible for managing domain records and internet infrastructure.
NiRA operates Nigeria’s .ng domain registry, but individual organisations remain responsible for managing their DNS infrastructure, registrar accounts and service providers.
Akinsanya disclosed that only 15 of Nigeria’s 164 accredited registrars had adopted DNSSEC, describing the figure as inadequate and calling for stronger implementation across the ecosystem.
He urged government institutions to review who controls their domain credentials, activate multi-factor authentication and establish clear procedures for responding to unauthorised changes to domain records.
He also called on internet service providers to enable DNSSEC validation, while urging regulators to incorporate the naming layer into Nigeria’s forthcoming cybersecurity framework and critical infrastructure planning.
The concerns received further attention during a panel session where Daniel Onyekpeze, head of incident handling at the Nigeria Computer Emergency Response Team (ngCERT), operating under the Office of the National Security Adviser, proposed an Executive Order to give DNSSEC Critical National Information Infrastructure status.
He argued that implementation should extend beyond government institutions to include the financial sector, given the importance of secure internet infrastructure to digital transactions and national resilience.
Other participants highlighted the changing nature of cyber threats. SP Kuma Ikyereve of the Nigeria Police Force National Cybercrime Centre identified phishing as the leading category of cybersecurity cases, while Lateef Hamzat, founder and chief executive officer of CyberPlural, said attacks were gradually shifting from individuals towards systems.
The shift raises the stakes for organisations whose digital infrastructure supports large numbers of customers and interconnected services. A vulnerability in a central system can potentially affect more users than an attack directed at an individual account.
For Nigeria, the challenge is therefore not simply to increase the number of secured domain names but to ensure that the underlying infrastructure is properly configured, monitored and protected.
NiRA has maintained that expanding the .ng domain should not come at the expense of security. Akinsanya said Nigeria had roughly one registered .ng domain for every 1,000 citizens, compared with approximately two per 1,000 in Kenya and 20 per 1,000 in South Africa.
Read also: AI is about to make cyberattacks faster, cheaper and almost impossible to stop
He said the association was targeting 30 percent growth but would not pursue expansion without adequate security standards.
The broader policy challenge is ensuring that NITDA’s new assessment requirement translates into measurable improvements rather than another compliance exercise.
DNSSEC can help prevent attackers from manipulating DNS responses, but its effectiveness depends on organisations securing their registrar credentials, maintaining their systems, enabling validation and responding quickly to incidents.
As cyberattacks become more sophisticated and Nigeria’s economy becomes increasingly dependent on digital infrastructure, securing the internet’s underlying systems is emerging as an important part of protecting financial transactions, public services and business confidence.
Royal Ibeh is a senior journalist with years of experience reporting on Nigeria’s technology and health sectors. She currently covers the Technology and Health beats for BusinessDay newspaper, where she writes in-depth stories on digital innovation, telecom infrastructure, healthcare systems, and public health policies.
