NITDA to add domain security checks as cyberattacks hit 4,361 weekly

Nigerian organisations are hit by an average of 4,361 attempted cyberattacks every week, according to Check Point Research figures cited at a cybersecurity webinar on Sunday. The global average is about 2,270, meaning a typical Nigerian organisation faces nearly twice as many attempts.

The figures were shared by Adesola Akinsanya, president of the Nigeria Internet Registration Association (NiRA), which runs the country's .ng domain registry. The webinar focused on the Domain Name System (DNS), the internet's address book, which turns website names into the numerical addresses computers use.

When attackers tamper with that system, a person can type a correct web address and still land on a fake site built to steal passwords or payment details. The protection against this is DNSSEC, short for Domain Name System Security Extensions, which adds digital signatures so a browser can check that a site's address record is genuine.

Why it matters for your money

Akinsanya cited Nigeria Inter-Bank Settlement System (NIBSS) data showing digital payment fraud stood at ₦25.85 billion in 2025. He warned that fewer reported incidents may mean under-reporting rather than better security.

"DNS security is not a technical hobby. It is an economic question," he said.

For everyday Nigerians, a hijacked domain can mean a fake bank or government page that looks real, disrupted access to services, or lost trust in paying online. The National Information Technology Development Agency (NITDA) now plans to include DNS security in the cybersecurity assessments it runs on Ministries, Departments and Agencies (MDAs).

NITDA Director-General Kashifu Inuwa Abdullahi, represented by Oluwasegun Falayan, said owning a government domain is no longer enough on its own.

"It's not enough to just have a domain, but it must be secured and must be signed," he said.

The agency also wants government websites on the .gov.ng domain to adopt DNSSEC.

Adoption still low

Only 15 of Nigeria's 164 accredited registrars have adopted DNSSEC, Akinsanya said, calling the number inadequate. He urged organisations to check who controls their domain accounts, turn on multi-factor authentication and have a clear plan for unauthorised changes to domain records.

He also cautioned that DNSSEC is not a cure-all. It does not encrypt traffic, stop denial-of-service attacks or protect against stolen registrar logins, and a badly configured setup can make a site unreachable for some users.

Daniel Onyekpeze, who heads incident handling at the Nigeria Computer Emergency Response Team (ngCERT) under the Office of the National Security Adviser, proposed an Executive Order giving DNSSEC Critical National Information Infrastructure status, covering banks as well as government.

SP Kuma Ikyereve of the Nigeria Police Force National Cybercrime Centre said phishing is the leading category of cases reported, while Lateef Hamzat of CyberPlural said attacks are shifting from individuals to whole systems.

What happens next: NITDA says DNS security will now form part of its assessments of government agencies. NiRA is targeting 30 per cent growth in .ng registrations but says it will not expand without adequate security standards.