A simple, practical course outline for business owners and their teams
This course teaches small business owners and their employees how to protect the business from cyber threats. You will learn simple, affordable steps to keep your customer data, money, and reputation safe.
No technical background is needed. If you use a computer or phone for your business, this course is for you.
Course Duration: 8 modules – self‑paced (about 1–2 hours per module)
Certificate: Certificate of completion after final quiz and project
Protect your business today – one simple step at a time.
Welcome to Module One of the Cybersecurity for Small Businesses course!
Have you ever helped your parents run a small shop? Maybe your mother sells food at the market. Maybe your father has a small computer repair business. Maybe your uncle sells clothes online. These are all small businesses.
Small businesses are important. They help families earn money. They help communities grow. They help countries like Nigeria become stronger.
But small businesses also face dangers. There are bad people on the internet. These people are called hackers. Hackers want to steal money. They want to steal information. They want to cause problems.
Cyber security is the practice of keeping your business safe from hackers. It is like locking the door of your shop at night. It is like keeping your money in a safe place. It is like not telling strangers your secrets.
Imagine you have a small shop. You sell beautiful clothes. You keep your money in a box under the counter. You lock the shop at night. You have a guard at the door. That is security for your physical shop.
Now imagine your shop is online. You sell clothes on your website. You keep customer information on your computer. You use the internet to receive payments. You need security for your online shop too. That is cyber security.
In this module, you will learn what cyber security is. You will learn why it matters for small businesses. You will learn about the dangers that small businesses face. You will learn simple things you can do to stay safe.
You do not need to be a computer expert. You just need to be curious and ready to learn. By the end of this module, you will understand how to protect a small business from cyber threats.
Let us begin this exciting journey together!
After completing this module, you will be able to:
Once upon a time, in the busy city of Onitsha, Nigeria, there lived a woman named Mama Ngozi. Mama Ngozi had a small fashion shop. She sold beautiful clothes, shoes, and bags.
Mama Ngozi's shop was very popular. Many people came to buy from her. She had many customers. She made good money.
One day, Mama Ngozi decided to start selling online. She created a website. She posted pictures of her clothes. She added a payment option so customers could pay with their bank cards.
At first, everything was good. Customers from all over Nigeria bought from her website. Mama Ngozi was very happy.
Then one day, something terrible happened. Mama Ngozi received an email. The email said, "Your website has a problem. Click here to fix it."
Mama Ngozi was worried. She clicked on the link. The link took her to a website that looked like her website. It asked for her username and password. She entered them.
The next day, Mama Ngozi tried to log in to her website. She could not. Her password did not work. She tried again. It still did not work.
Then she received another email. It said, "We have taken over your website. Pay us 500,000 naira, or we will delete everything."
Mama Ngozi started to cry. Her website was gone. All her customer information was gone. All her product photos were gone. She had lost everything.
Her son, Emeka, came to visit. He saw that his mother was crying.
"Mama," he said, "what is wrong?"
Mama Ngozi told him what happened. Emeka listened carefully.
"Mama," Emeka said, "you have been a victim of a phishing attack. The email was fake. The website was fake. They tricked you into giving them your password."
Mama Ngozi was confused. "What is phishing?" she asked.
Emeka explained. "Phishing is when bad people pretend to be someone you trust. They send you a fake email. They try to trick you into giving them your password or money."
Mama Ngozi understood. She had been tricked. She had not been careful.
Emeka helped his mother. They called a cyber security expert. The expert helped them get the website back. They changed all the passwords. They trained Mama Ngozi and her workers about cyber security.
Mama Ngozi learned a very important lesson. Cyber security is important for small businesses. If you are not careful, you can lose everything.
From that day on, Mama Ngozi was very careful. She never clicked on strange links. She used strong passwords. She trained her workers. Her business grew and grew.
And that is exactly what you will learn in this module.
Cyber security is the practice of keeping computers, phones, networks, and data safe from bad people. It is all the things you do to protect your business from hackers.
Cyber security is important because your business holds valuable things. It holds customer information. It holds money. It holds your reputation. If your business is not safe, you can lose all these things.
Think of your business as a house. The house has money, jewelry, and important documents. You lock the doors. You close the windows. You have a guard. That is physical security. Cyber security is the same, but for your computers and your online business.
A small shop uses a computer to track sales. The computer has customer names and phone numbers. If the computer is not secure, hackers can steal the customer information.
Your school has a computer lab. The computers have student grades. If the computers are not secure, hackers can change the grades. Cyber security keeps the grades safe.
Your family has a computer at home. It has photos, documents, and maybe bank information. If the computer is not secure, hackers can steal the information. Cyber security keeps it safe.
A Nigerian online store has a website. Customers enter their bank card details. If the website is not secure, fraudsters can steal the card details. Cyber security keeps the customers safe.
Cyber Security
|
V
+-------------------+
| Your Business |
| (Computer, Data) |
+-------------------+
|
V
+-------------------+
| Cyber Security |
| (The Lock) |
+-------------------+
|
V
+-------------------+
| Your Business |
| is Safe |
+-------------------+
Cyber security is keeping your computers, phones, networks, and data safe from bad people. It protects your business from hackers.
Small businesses need cyber security because they have valuable information and money. They are also easier to attack than big companies.
Many small business owners think, "I am too small to be attacked." This is not true. Hackers attack small businesses because they are easier targets. Small businesses often do not have good security.
Imagine a thief walking down a street. There is a big bank on one side. There is a small shop on the other side. The bank has many guards and cameras. The shop has one old lock. Which one will the thief rob? The shop, because it is easier.
A small restaurant uses a computer for orders. The computer has no antivirus. A hacker breaks in and steals customer credit card information. The restaurant loses customers and money.
A small school uses a computer for student records. The computer has a weak password. A hacker breaks in and changes the records. The school loses trust.
A family runs a small business from home. They use a computer for orders. The computer gets a virus. All the order information is lost.
A Nigerian tailor uses a computer for customer measurements. The computer has no backup. A virus deletes all the measurements. The tailor loses many customers.
Why Small Businesses Need Cyber Security
|
V
+-------------------+
| Small Business |
+-------------------+
|
V
+-------------------+
| Valuable Data |
| and Money |
+-------------------+
|
V
+-------------------+
| Easy Target |
| for Hackers |
+-------------------+
|
V
+-------------------+
| Need Cyber |
| Security |
+-------------------+
Small businesses need cyber security because they have valuable information and are easy targets for hackers.
A hacker is a person who tries to break into computers without permission. They want to steal information, cause damage, or make money.
Hackers are real. They are everywhere. They can be far away, in another country. They use the internet to find weak computers. They attack small businesses because they are easy targets.
Imagine a thief walking around your neighbourhood, checking doors to see which ones are unlocked. A hacker does the same thing online. They check computers to see which ones have weak security.
A hacker broke into a small hotel's computer system. He stole guest information. He sold the information to other criminals.
A hacker broke into a small school's website. He changed the exam results. He demanded money to fix it.
A hacker guessed a family's Wi-Fi password. He used their internet to attack other computers.
A Nigerian fraudster sent fake emails to customers of a small online store. He pretended to be the store owner. He stole the customers' bank details.
Hackers
|
V
+-------------------+
| Bad People |
+-------------------+
|
V
+-------------------+
| Look for Weak |
| Computers |
+-------------------+
|
V
+-------------------+
| Steal, Damage, |
| or Make Money |
+-------------------+
A hacker is a person who tries to break into computers without permission. They want to steal information, cause damage, or make money.
There are many types of cyber threats. Each type is different. Each type can harm your business.
Knowing the types of threats helps you prepare for them. It helps you protect your business.
Here are the main types of cyber threats:
| Type of Threat | What It Means | Example |
|---|---|---|
| Malware | Bad software that harms your computer | A virus that deletes files |
| Phishing | Fake emails or messages that trick you | An email pretending to be from your bank |
| Ransomware | Bad software that locks your files and asks for money | A message saying "Pay 500,000 naira or lose your files" |
| Data Breach | When private information is stolen | Hackers stealing customer names and passwords |
| Insider Threat | When someone inside the business causes harm | An employee stealing company secrets |
| Denial of Service | When a website is flooded with traffic so it stops working | A website that cannot be accessed |
A small business faces many threats. They face malware, phishing, ransomware, data breaches, insider threats, and denial of service attacks.
Your school faces threats. A student might download malware. A teacher might click on a phishing email. A hacker might steal student data.
Your home faces threats. Your phone might get malware. You might receive a phishing message. Your Wi-Fi might be attacked.
A Nigerian business faces threats. Fraudsters might send phishing emails. Hackers might steal customer data. Employees might leak information.
Types of Cyber Threats
|
V
+---------------------------+
| Malware |
+---------------------------+
|
V
+---------------------------+
| Phishing |
+---------------------------+
|
V
+---------------------------+
| Ransomware |
+---------------------------+
|
V
+---------------------------+
| Data Breach |
+---------------------------+
|
V
+---------------------------+
| Insider Threat |
+---------------------------+
|
V
+---------------------------+
| Denial of Service |
+---------------------------+
There are many types of cyber threats: malware, phishing, ransomware, data breaches, insider threats, and denial of service.
Malware is bad software. It is a program that harms your computer. The word "malware" comes from "malicious software." Malicious means wanting to do bad things.
Malware can delete your files. It can slow down your computer. It can steal your information. It can even spy on you. Malware is dangerous for small businesses.
Imagine you have a robot that is supposed to help you clean your shop. But someone changed its program. Now the robot makes a mess instead of cleaning. That is malware. It is software that does bad things instead of good things.
A small shop's computer was infected with malware. The malware deleted all the sales records. The shop owner did not know how much money was made.
A school's computer was infected with malware. The malware deleted all the exam questions. The teachers had to write new questions.
A family's computer was infected with malware. The malware showed pop-up ads all the time. The computer became very slow.
A Nigerian business lost important files because of malware. The malware came from a fake email attachment.
Malware
|
V
+-------------------+
| Bad Software |
+-------------------+
|
V
+-------------------+
| Harms Your |
| Computer |
+-------------------+
|
V
+-------------------+
| Deletes, Steals, |
| Spies |
+-------------------+
Malware is bad software. It harms your computer by deleting files, stealing information, or spying on you.
Phishing is when a bad person pretends to be someone you trust. They send you a fake email or message. They try to trick you into giving them your password or money.
Phishing is one of the most common ways hackers get into businesses. They trick you into opening the door for them. If you know about phishing, you can avoid it.
Imagine a stranger comes to your shop. He says he is a police officer. He says there is an emergency and you must give him money. But he is not a police officer. He is a thief. Phishing is like that. The hacker pretends to be someone you trust.
A hacker sends an email that looks like it is from a bank. The email says, "Your business account is blocked. Click here to fix it." The link takes you to a fake website that steals your password.
A hacker sends an email that looks like it is from your school. The email says, "Click here to see your exam results." The link steals your password.
A hacker sends a text message that looks like it is from your parents. The message says, "Send me your password." The hacker is tricking you.
A fraudster sends an email that looks like it is from a Nigerian bank. The email says, "Your account has a problem. Send your OTP to fix it." The fraudster steals the money.
Phishing
|
V
+-------------------+
| Fake Email |
+-------------------+
|
V
+-------------------+
| Looks Real |
+-------------------+
|
V
+-------------------+
| You Click Link |
+-------------------+
|
V
+-------------------+
| You Lose Data |
+-------------------+
Phishing is when a bad person pretends to be someone you trust. They send fake emails or messages to trick you into giving them your password or money.
Ransomware is a type of malware. It locks your files. Then it asks you to pay money to unlock them. The money is called a ransom.
Ransomware is very dangerous. It can lock all your business files. If you do not pay, you might lose everything. Many small businesses have lost important data to ransomware.
Imagine a thief breaks into your shop. He locks all your goods in a room. He says, "Pay me 500,000 naira, or I will throw away the key." That is ransomware. It locks your files and demands money.
A small clinic was attacked by ransomware. The malware locked all patient records. The clinic had to pay to get them back.
A school was attacked by ransomware. The malware locked all student grades. The school had to restore from a backup.
A family was attacked by ransomware. The malware locked all their photos. The family had to pay to get them back.
A Nigerian business was attacked by ransomware. The malware locked all customer data. The business had to pay a large ransom.
Ransomware
|
V
+-------------------+
| Locks Your Files |
+-------------------+
|
V
+-------------------+
| Asks for Money |
+-------------------+
|
V
+-------------------+
| If You Pay, You |
| Might Get Files |
| Back |
+-------------------+
Ransomware is a type of malware that locks your files and asks for money to unlock them. It is very dangerous.
Hackers target small businesses because they are easier to attack. Small businesses often do not have good security.
If you know why hackers target small businesses, you can protect yourself. You can make your business a harder target.
Here are reasons why hackers target small businesses:
A hacker attacked a small accounting firm. The firm had client financial data. The hacker stole the data and sold it.
A hacker attacked a small school. The school had student and parent information. The hacker stole the information.
A hacker attacked a family's home business. The business had customer orders. The hacker stole the orders and demanded money.
A fraudster attacked a small Nigerian online store. The store had customer bank details. The fraudster stole the details and took money.
Why Hackers Target Small Businesses
|
V
+-------------------+
| Less Security |
+-------------------+
|
V
+-------------------+
| Valuable Data |
+-------------------+
|
V
+-------------------+
| Less Attention |
+-------------------+
|
V
+-------------------+
| Easy to Trick |
+-------------------+
|
V
+-------------------+
| Supply Chain |
+-------------------+
Hackers target small businesses because they have less security, valuable data, less attention, are easy to trick, and can be used to attack bigger companies.
The cost of a cyber attack is the damage it causes. It includes money lost, data lost, and trust lost.
Many small businesses do not recover from a cyber attack. They lose money. They lose customers. They close down. Knowing the cost helps you understand why security is important.
Here are the costs of a cyber attack:
A small business lost 5 million naira to a cyber attack. They also lost customers. They had to close for two weeks.
A small school lost student data to a cyber attack. Parents were angry. Many students left the school.
A family business lost all its customer orders. They could not fulfill orders. They lost money and trust.
A Nigerian business lost 10 million naira to a cyber attack. They also lost customer data. They were fined by NITDA for not protecting the data.
The Cost of a Cyber Attack
|
V
+-------------------+
| Money Lost |
+-------------------+
|
V
+-------------------+
| Data Lost |
+-------------------+
|
V
+-------------------+
| Downtime |
+-------------------+
|
V
+-------------------+
| Reputation |
| Damage |
+-------------------+
|
V
+-------------------+
| Legal Fees |
+-------------------+
|
V
+-------------------+
| Recovery Costs |
+-------------------+
The cost of a cyber attack includes money lost, data lost, downtime, reputation damage, legal fees, and recovery costs.
Simple cyber security habits are things you do every day to keep your business safe. They are easy to do. They do not cost much money.
You do not need to be a computer expert to protect your business. Simple habits can stop most attacks.
Here are simple cyber security habits:
A small shop uses strong passwords and antivirus. They back up their files every week. They have not had a cyber attack.
A small school trains its teachers about phishing. They use strong passwords. They have not had a data breach.
A family business uses two-factor authentication. They update their software. They have not had a virus.
A Nigerian online store uses strong passwords and backs up customer data. They have not lost any data to hackers.
Simple Cyber Security Habits
|
V
+-------------------+
| Strong Passwords |
+-------------------+
|
V
+-------------------+
| No Strange Links |
+-------------------+
|
V
+-------------------+
| Antivirus |
+-------------------+
|
V
+-------------------+
| Updates |
+-------------------+
|
V
+-------------------+
| Backups |
+-------------------+
|
V
+-------------------+
| Training |
+-------------------+
Simple cyber security habits include using strong passwords, avoiding strange links, installing antivirus, updating software, backing up files, and training staff.
Cyber security is important for small businesses all over the world, including in Nigeria. Here are some Nigerian examples.
Seeing examples from Nigeria helps you understand how cyber security works in your own country.
Here are some Nigerian examples:
A Nigerian online store uses strong passwords and antivirus. They train their staff about phishing. They have not had a cyber attack.
A Nigerian school uses cyber security to protect student grades. They back up their files every week. They have not lost any data.
A Nigerian family business uses two-factor authentication. They update their software. They have not had a virus.
A Nigerian tailor uses a computer for customer measurements. He backs up his files every week. He has not lost any measurements.
Nigerian Cyber Security for Small Businesses
+------------------------------------------+
| Online Stores: Protect customer data |
| Banks: Protect money, train staff |
| Schools: Protect student data |
| Businesses: Protect customer data |
| Government: Help small businesses |
+------------------------------------------+
Nigerian online stores, banks, schools, businesses, and government agencies all use cyber security to stay safe.
Cyber security can be explained using fun examples that children understand.
When you use fun examples, learning becomes easier and more enjoyable.
Here are some fun examples:
Imagine you are playing a game. You have a shield that blocks enemy attacks. Cyber security is like that shield for your business.
Your school has a security guard at the gate. He stops bad people from entering. Cyber security is like that guard for your business.
Your family has a mosquito net over the bed. It keeps mosquitoes away. Cyber security is like that net for your business.
In a Nigerian football match, the goalkeeper stops the ball. Cyber security stops hackers.
Fun Cyber Security
+------------------------------------------+
| Video Game: Shield against enemies |
| Football: Goalkeeper stops ball |
| Social Media: Block bad posts |
| School: Lock your locker |
| Cooking: Cover keeps flies away |
+------------------------------------------+
Cyber security is everywhere. It is in video games, football, social media, school, and cooking. It protects your business like armor or a guard.
Cyber security is not just for computers. It is like things in everyday life.
When you understand cyber security in everyday life, you can use the ideas to protect your business.
Here are everyday examples:
You lock your shop at night. You also lock your computer with a password.
You keep your money in a safe. You also keep your data in a secure computer.
You use a mosquito net to keep mosquitoes away. You use antivirus to keep malware away.
A Nigerian family locks their shop at night. They also lock their computer with a strong password.
Everyday Cyber Security
+------------------------------------------+
| Lock Shop: Keep thieves out |
| Use Safe: Keep money safe |
| Check Visitors: Antivirus checks |
| Keep Secrets: Do not share passwords |
| Seatbelt: Stay safe |
+------------------------------------------+
Cyber security is like locking your shop, using a safe, checking visitors, keeping secrets, and wearing a seatbelt.
A cyber security checklist is a list of things you should do to keep your business safe.
A checklist helps you remember what to do. It helps you stay safe.
Here is a simple cyber security checklist for your business:
A small shop uses a cyber security checklist. They check it every month. They have not had a cyber attack.
A small school uses a cyber security checklist. They check it every term. They have not had a data breach.
A family business uses a cyber security checklist. They check it every month. They have not had a virus.
A Nigerian online store uses a cyber security checklist. They check it every week. They have not lost any data.
Cyber Security Checklist
|
V
+-------------------+
| Strong Passwords |
+-------------------+
|
V
+-------------------+
| 2FA |
+-------------------+
|
V
+-------------------+
| Antivirus |
+-------------------+
|
V
+-------------------+
| Updates |
+-------------------+
|
V
+-------------------+
| Backups |
+-------------------+
|
V
+-------------------+
| Training |
+-------------------+
A cyber security checklist includes using strong passwords, 2FA, antivirus, updates, backups, training, locking computers, avoiding strange links, and securing Wi-Fi.
A case study is a real-life example that helps us learn. Let us look at a Nigerian small business.
Case studies help us see how cyber security works in real life.
A Nigerian small business called "Chidi's Electronics" sold phones and laptops. The owner, Chidi, learned about cyber security.
Here is what Chidi did:
One day, a hacker sent a phishing email to Chidi's business. The email said, "Your order has a problem. Click here to fix it."
Chidi's staff member saw the email. She remembered the training. She did not click the link. She reported the email to Chidi.
Chidi was happy. His business was safe because he had prepared.
Chidi learned that cyber security saves businesses.
Chidi shared his success with other small businesses. They all started improving their cyber security.
Your school can use the same approach. Use strong passwords. Train staff. Back up files.
Your family business can use the same approach. Use 2FA. Update software. Back up files.
Nigerian small businesses like Chidi's Electronics use cyber security to stay safe.
Case Study: Chidi's Electronics
|
V
+-------------------+
| Problem: Phishing|
| Email |
+-------------------+
|
V
+-------------------+
| Solution: Cyber |
| Security |
+-------------------+
|
V
+-------------------+
| Strong Passwords,|
| 2FA, Antivirus, |
| Updates, Backups,|
| Training |
+-------------------+
|
V
+-------------------+
| Result: Business |
| Safe |
+-------------------+
Chidi's Electronics used cyber security to stay safe from a phishing attack. They used strong passwords, 2FA, antivirus, updates, backups, and training.
| Word | Simple Definition |
|---|---|
| Cyber Security | Keeping computers, phones, networks, and data safe from bad people |
| Hacker | A person who tries to break into computers without permission |
| Malware | Bad software that harms your computer |
| Phishing | Fake emails or messages that try to steal your information |
| Ransomware | Bad software that locks your files and asks for money |
| Data Breach | When private information is stolen |
| Insider Threat | When someone inside the business causes harm |
| Denial of Service | When a website is flooded with traffic so it stops working |
| Antivirus | Software that protects your computer from malware |
| Two-Factor Authentication (2FA) | An extra layer of security that requires two things to log in |
| Backup | A copy of your files kept in a safe place |
| Firewall | Software or hardware that blocks bad connections |
| WPA2 | A type of Wi-Fi encryption |
| WPA3 | A newer type of Wi-Fi encryption |
| OTP | One Time Password - a special code for one use |
A small shop in Lagos uses strong passwords and antivirus. They back up their files every week. They train their staff about phishing. They have not had a cyber attack.
A small school in Abuja uses two-factor authentication. They update their software. They back up student data. They have not had a data breach.
A family business in Port Harcourt uses a cyber security checklist. They check it every month. They have not had a virus.
Stores like Jumia and Konga use cyber security to protect customer data. Small online stores should do the same.
Banks like GTBank, Zenith, and Access Bank use cyber security to protect customer money. They also train their staff.
Schools like Covenant University and University of Lagos use cyber security to protect student data.
Companies like MTN, Glo, and Airtel use cyber security to protect customer data.
Agencies like NITDA help small businesses learn about cyber security.
In a video game, you protect your character with armor. Cyber security is like armor for your business.
In football, the goalkeeper protects the goal. Cyber security is like a goalkeeper for your business.
On social media, you block people who post bad things. Cyber security blocks hackers from your business.
In school, you lock your locker. Cyber security is like locking your business.
You lock your shop at night to keep thieves out. You lock your computer to keep hackers out.
You keep your money in a safe. You keep your data in a secure computer.
You check who comes to your shop. Antivirus checks what comes to your computer.
You do not tell strangers your secrets. You do not share your passwords.
You wear a seatbelt to stay safe in a car. You use cyber security to stay safe online.
+-------------------+
| Your Business |
+-------------------+
|
V
+-------------------+
| Cyber Security |
+-------------------+
|
V
+-------------------+
| Strong Passwords |
+-------------------+
|
V
+-------------------+
| Antivirus |
+-------------------+
|
V
+-------------------+
| Updates |
+-------------------+
|
V
+-------------------+
| Backups |
+-------------------+
|
V
+-------------------+
| Training |
+-------------------+
|
V
+-------------------+
| Business Safe |
+-------------------+
Day 1: Hacker sends phishing email
|
V
Day 2: Employee clicks link
|
V
Day 3: Hacker steals password
|
V
Day 4: Hacker accesses business accounts
|
V
Day 5: Hacker steals money and data
|
V
Day 6: Business detects the attack
|
V
Day 7: Business responds and recovers
|
V
Day 8: Business learns and improves
| Security Task | Done? |
|---|---|
| Strong passwords on all accounts | Yes / No |
| Two-factor authentication turned on | Yes / No |
| Antivirus installed and updated | Yes / No |
| Software updated | Yes / No |
| Files backed up | Yes / No |
| Staff trained about phishing | Yes / No |
| Computers locked when away | Yes / No |
| Wi-Fi secured with WPA2/WPA3 | Yes / No |
| Feature | Small Business | Big Business |
|---|---|---|
| Security budget | Small | Large |
| Security staff | Few or none | Many |
| Target for hackers | Easy target | Harder target |
| Recovery ability | Limited | Stronger |
| Need for cyber security | High | High |
| Type | What It Means |
|---|---|
| Malware | Bad software that harms your computer |
| Phishing | Fake emails or messages that try to steal your information |
| Ransomware | Bad software that locks your files and asks for money |
| Data Breach | When private information is stolen |
| Insider Threat | When someone inside the business causes harm |
| Denial of Service | When a website is flooded with traffic so it stops working |
Cyber security is keeping your computers, phones, networks, and data safe from bad people. It protects your business from hackers.
Small businesses need cyber security because they have valuable information and are easy targets for hackers.
A hacker is a person who tries to break into computers without permission. They want to steal information, cause damage, or make money.
There are many types of cyber threats: malware, phishing, ransomware, data breaches, insider threats, and denial of service.
Malware is bad software. It harms your computer by deleting files, stealing information, or spying on you.
Phishing is when a bad person pretends to be someone you trust. They send fake emails or messages to trick you into giving them your password or money.
Ransomware is a type of malware that locks your files and asks for money to unlock them. It is very dangerous.
Hackers target small businesses because they have less security, valuable data, less attention, are easy to trick, and can be used to attack bigger companies.
The cost of a cyber attack includes money lost, data lost, downtime, reputation damage, legal fees, and recovery costs.
Simple cyber security habits include using strong passwords, avoiding strange links, installing antivirus, updating software, backing up files, and training staff.
Nigerian online stores, banks, schools, businesses, and government agencies all use cyber security to stay safe.
Cyber security is everywhere. It is in video games, football, social media, school, and cooking. It protects your business like armor or a guard.
Cyber security is like locking your shop, using a safe, checking visitors, keeping secrets, and wearing a seatbelt.
A cyber security checklist includes using strong passwords, 2FA, antivirus, updates, backups, training, locking computers, avoiding strange links, and securing Wi-Fi.
Chidi's Electronics used cyber security to stay safe from a phishing attack. They used strong passwords, 2FA, antivirus, updates, backups, and training.
Congratulations! You have completed Module One: Introduction to Cyber Security for Small Businesses.
In this module, you learned that cyber security is the practice of keeping computers, phones, networks, and data safe from bad people.
You learned why small businesses need cyber security. They have valuable information and are easy targets for hackers.
You learned about hackers. They are people who try to break into computers without permission.
You learned about the types of cyber threats: malware, phishing, ransomware, data breaches, insider threats, and denial of service.
You learned what malware is. It is bad software that harms your computer.
You learned what phishing is. It is when a bad person pretends to be someone you trust.
You learned what ransomware is. It is bad software that locks your files and asks for money.
You learned why hackers target small businesses.
You learned the cost of a cyber attack.
You learned simple cyber security habits for small businesses.
You learned about Nigerian examples of cyber security for small businesses.
You learned about fun examples and everyday examples.
You learned how to build a cyber security checklist for your business.
You learned from a case study of a Nigerian small business that stayed safe.
You are now a Cyber Security for Small Businesses expert in training!
Cyber security is keeping your computers, phones, networks, and data safe from bad people.
Small businesses need cyber security because they have valuable information and are easy targets for hackers.
Hackers are people who try to break into computers without permission. They want to steal information, cause damage, or make money.
Types of cyber threats include malware, phishing, ransomware, data breaches, insider threats, and denial of service.
Malware is bad software. It harms your computer by deleting files, stealing information, or spying on you.
Phishing is when a bad person pretends to be someone you trust. They send fake emails or messages to trick you into giving them your password or money.
Ransomware is a type of malware that locks your files and asks for money to unlock them.
Hackers target small businesses because they have less security, valuable data, less attention, are easy to trick, and can be used to attack bigger companies.
The cost includes money lost, data lost, downtime, reputation damage, legal fees, and recovery costs.
Simple cyber security habits include using strong passwords, avoiding strange links, installing antivirus, updating software, backing up files, and training staff.
| Word | Definition |
|---|---|
| 1. Cyber Security | A. A person who tries to break into computers |
| 2. Hacker | B. Bad software that harms your computer |
| 3. Malware | C. Keeping your business safe from hackers |
| 4. Phishing | D. Bad software that locks your files and asks for money |
| 5. Ransomware | E. Fake emails or messages that try to steal your information |
| 6. Data Breach | F. When someone inside the business causes harm |
| 7. Insider Threat | G. When private information is stolen |
Answers: 1-C, 2-A, 3-B, 4-E, 5-D, 6-G, 7-F
You receive an email that says, "Your business account is blocked. Click here to fix it." The email address looks strange.
Question: What should you do?
Answer: Do not click the link. This is phishing. Delete the email. Call your bank if you are worried.
Your employee uses the password "123456" for the business account.
Question: What should you tell your employee?
Answer: Tell your employee that "123456" is a weak password. Hackers can guess it in one second. Your employee should use a strong password.
Your business computer is very slow. It shows pop-up ads all the time.
Question: What might be wrong?
Answer: Your computer might have malware. You should run an antivirus scan. You should also update your software.
Instructions:
Time: 30 minutes
Instructions:
Goal: Create a dashboard that shows how well your class understands cyber security for small businesses.
Steps:
Time: 2 weeks
Instructions:
In Module Two, you will learn about Passwords and Access Control.
You will learn:
To prepare for Module Two, think about these questions:
See you in Module Two!
End of Module One
Welcome to Module One of the Cybersecurity for Small Businesses course!
Have you ever helped your parents run a small shop? Maybe your mother sells food at the market. Maybe your father has a small computer repair business. Maybe your uncle sells clothes online. These are all small businesses.
Small businesses are important. They help families earn money. They help communities grow. They help countries like Nigeria become stronger.
But small businesses also face dangers. There are bad people on the internet. These people are called hackers. Hackers want to steal money. They want to steal information. They want to cause problems.
Cyber security is the practice of keeping your business safe from hackers. It is like locking the door of your shop at night. It is like keeping your money in a safe place. It is like not telling strangers your secrets.
Imagine you have a small shop. You sell beautiful clothes. You keep your money in a box under the counter. You lock the shop at night. You have a guard at the door. That is security for your physical shop.
Now imagine your shop is online. You sell clothes on your website. You keep customer information on your computer. You use the internet to receive payments. You need security for your online shop too. That is cyber security.
In this module, you will learn what cyber security is. You will learn why it matters for small businesses. You will learn about the dangers that small businesses face. You will learn simple things you can do to stay safe.
You do not need to be a computer expert. You just need to be curious and ready to learn. By the end of this module, you will understand how to protect a small business from cyber threats.
Let us begin this exciting journey together!
After completing this module, you will be able to:
Once upon a time, in the busy city of Onitsha, Nigeria, there lived a woman named Mama Ngozi. Mama Ngozi had a small fashion shop. She sold beautiful clothes, shoes, and bags.
Mama Ngozi's shop was very popular. Many people came to buy from her. She had many customers. She made good money.
One day, Mama Ngozi decided to start selling online. She created a website. She posted pictures of her clothes. She added a payment option so customers could pay with their bank cards.
At first, everything was good. Customers from all over Nigeria bought from her website. Mama Ngozi was very happy.
Then one day, something terrible happened. Mama Ngozi received an email. The email said, "Your website has a problem. Click here to fix it."
Mama Ngozi was worried. She clicked on the link. The link took her to a website that looked like her website. It asked for her username and password. She entered them.
The next day, Mama Ngozi tried to log in to her website. She could not. Her password did not work. She tried again. It still did not work.
Then she received another email. It said, "We have taken over your website. Pay us 500,000 naira, or we will delete everything."
Mama Ngozi started to cry. Her website was gone. All her customer information was gone. All her product photos were gone. She had lost everything.
Her son, Emeka, came to visit. He saw that his mother was crying.
"Mama," he said, "what is wrong?"
Mama Ngozi told him what happened. Emeka listened carefully.
"Mama," Emeka said, "you have been a victim of a phishing attack. The email was fake. The website was fake. They tricked you into giving them your password."
Mama Ngozi was confused. "What is phishing?" she asked.
Emeka explained. "Phishing is when bad people pretend to be someone you trust. They send you a fake email. They try to trick you into giving them your password or money."
Mama Ngozi understood. She had been tricked. She had not been careful.
Emeka helped his mother. They called a cyber security expert. The expert helped them get the website back. They changed all the passwords. They trained Mama Ngozi and her workers about cyber security.
Mama Ngozi learned a very important lesson. Cyber security is important for small businesses. If you are not careful, you can lose everything.
From that day on, Mama Ngozi was very careful. She never clicked on strange links. She used strong passwords. She trained her workers. Her business grew and grew.
And that is exactly what you will learn in this module.
Cyber security is the practice of keeping computers, phones, networks, and data safe from bad people. It is all the things you do to protect your business from hackers.
Cyber security is important because your business holds valuable things. It holds customer information. It holds money. It holds your reputation. If your business is not safe, you can lose all these things.
Think of your business as a house. The house has money, jewelry, and important documents. You lock the doors. You close the windows. You have a guard. That is physical security. Cyber security is the same, but for your computers and your online business.
A small shop uses a computer to track sales. The computer has customer names and phone numbers. If the computer is not secure, hackers can steal the customer information.
Your school has a computer lab. The computers have student grades. If the computers are not secure, hackers can change the grades. Cyber security keeps the grades safe.
Your family has a computer at home. It has photos, documents, and maybe bank information. If the computer is not secure, hackers can steal the information. Cyber security keeps it safe.
A Nigerian online store has a website. Customers enter their bank card details. If the website is not secure, fraudsters can steal the card details. Cyber security keeps the customers safe.
Cyber Security
|
V
+-------------------+
| Your Business |
| (Computer, Data) |
+-------------------+
|
V
+-------------------+
| Cyber Security |
| (The Lock) |
+-------------------+
|
V
+-------------------+
| Your Business |
| is Safe |
+-------------------+
Cyber security is keeping your computers, phones, networks, and data safe from bad people. It protects your business from hackers.
Small businesses need cyber security because they have valuable information and money. They are also easier to attack than big companies.
Many small business owners think, "I am too small to be attacked." This is not true. Hackers attack small businesses because they are easier targets. Small businesses often do not have good security.
Imagine a thief walking down a street. There is a big bank on one side. There is a small shop on the other side. The bank has many guards and cameras. The shop has one old lock. Which one will the thief rob? The shop, because it is easier.
A small restaurant uses a computer for orders. The computer has no antivirus. A hacker breaks in and steals customer credit card information. The restaurant loses customers and money.
A small school uses a computer for student records. The computer has a weak password. A hacker breaks in and changes the records. The school loses trust.
A family runs a small business from home. They use a computer for orders. The computer gets a virus. All the order information is lost.
A Nigerian tailor uses a computer for customer measurements. The computer has no backup. A virus deletes all the measurements. The tailor loses many customers.
Why Small Businesses Need Cyber Security
|
V
+-------------------+
| Small Business |
+-------------------+
|
V
+-------------------+
| Valuable Data |
| and Money |
+-------------------+
|
V
+-------------------+
| Easy Target |
| for Hackers |
+-------------------+
|
V
+-------------------+
| Need Cyber |
| Security |
+-------------------+
Small businesses need cyber security because they have valuable information and are easy targets for hackers.
A hacker is a person who tries to break into computers without permission. They want to steal information, cause damage, or make money.
Hackers are real. They are everywhere. They can be far away, in another country. They use the internet to find weak computers. They attack small businesses because they are easy targets.
Imagine a thief walking around your neighbourhood, checking doors to see which ones are unlocked. A hacker does the same thing online. They check computers to see which ones have weak security.
A hacker broke into a small hotel's computer system. He stole guest information. He sold the information to other criminals.
A hacker broke into a small school's website. He changed the exam results. He demanded money to fix it.
A hacker guessed a family's Wi-Fi password. He used their internet to attack other computers.
A Nigerian fraudster sent fake emails to customers of a small online store. He pretended to be the store owner. He stole the customers' bank details.
Hackers
|
V
+-------------------+
| Bad People |
+-------------------+
|
V
+-------------------+
| Look for Weak |
| Computers |
+-------------------+
|
V
+-------------------+
| Steal, Damage, |
| or Make Money |
+-------------------+
A hacker is a person who tries to break into computers without permission. They want to steal information, cause damage, or make money.
There are many types of cyber threats. Each type is different. Each type can harm your business.
Knowing the types of threats helps you prepare for them. It helps you protect your business.
Here are the main types of cyber threats:
| Type of Threat | What It Means | Example |
|---|---|---|
| Malware | Bad software that harms your computer | A virus that deletes files |
| Phishing | Fake emails or messages that trick you | An email pretending to be from your bank |
| Ransomware | Bad software that locks your files and asks for money | A message saying "Pay 500,000 naira or lose your files" |
| Data Breach | When private information is stolen | Hackers stealing customer names and passwords |
| Insider Threat | When someone inside the business causes harm | An employee stealing company secrets |
| Denial of Service | When a website is flooded with traffic so it stops working | A website that cannot be accessed |
A small business faces many threats. They face malware, phishing, ransomware, data breaches, insider threats, and denial of service attacks.
Your school faces threats. A student might download malware. A teacher might click on a phishing email. A hacker might steal student data.
Your home faces threats. Your phone might get malware. You might receive a phishing message. Your Wi-Fi might be attacked.
A Nigerian business faces threats. Fraudsters might send phishing emails. Hackers might steal customer data. Employees might leak information.
Types of Cyber Threats
|
V
+---------------------------+
| Malware |
+---------------------------+
|
V
+---------------------------+
| Phishing |
+---------------------------+
|
V
+---------------------------+
| Ransomware |
+---------------------------+
|
V
+---------------------------+
| Data Breach |
+---------------------------+
|
V
+---------------------------+
| Insider Threat |
+---------------------------+
|
V
+---------------------------+
| Denial of Service |
+---------------------------+
There are many types of cyber threats: malware, phishing, ransomware, data breaches, insider threats, and denial of service.
Malware is bad software. It is a program that harms your computer. The word "malware" comes from "malicious software." Malicious means wanting to do bad things.
Malware can delete your files. It can slow down your computer. It can steal your information. It can even spy on you. Malware is dangerous for small businesses.
Imagine you have a robot that is supposed to help you clean your shop. But someone changed its program. Now the robot makes a mess instead of cleaning. That is malware. It is software that does bad things instead of good things.
A small shop's computer was infected with malware. The malware deleted all the sales records. The shop owner did not know how much money was made.
A school's computer was infected with malware. The malware deleted all the exam questions. The teachers had to write new questions.
A family's computer was infected with malware. The malware showed pop-up ads all the time. The computer became very slow.
A Nigerian business lost important files because of malware. The malware came from a fake email attachment.
Malware
|
V
+-------------------+
| Bad Software |
+-------------------+
|
V
+-------------------+
| Harms Your |
| Computer |
+-------------------+
|
V
+-------------------+
| Deletes, Steals, |
| Spies |
+-------------------+
Malware is bad software. It harms your computer by deleting files, stealing information, or spying on you.
Phishing is when a bad person pretends to be someone you trust. They send you a fake email or message. They try to trick you into giving them your password or money.
Phishing is one of the most common ways hackers get into businesses. They trick you into opening the door for them. If you know about phishing, you can avoid it.
Imagine a stranger comes to your shop. He says he is a police officer. He says there is an emergency and you must give him money. But he is not a police officer. He is a thief. Phishing is like that. The hacker pretends to be someone you trust.
A hacker sends an email that looks like it is from a bank. The email says, "Your business account is blocked. Click here to fix it." The link takes you to a fake website that steals your password.
A hacker sends an email that looks like it is from your school. The email says, "Click here to see your exam results." The link steals your password.
A hacker sends a text message that looks like it is from your parents. The message says, "Send me your password." The hacker is tricking you.
A fraudster sends an email that looks like it is from a Nigerian bank. The email says, "Your account has a problem. Send your OTP to fix it." The fraudster steals the money.
Phishing
|
V
+-------------------+
| Fake Email |
+-------------------+
|
V
+-------------------+
| Looks Real |
+-------------------+
|
V
+-------------------+
| You Click Link |
+-------------------+
|
V
+-------------------+
| You Lose Data |
+-------------------+
Phishing is when a bad person pretends to be someone you trust. They send fake emails or messages to trick you into giving them your password or money.
Ransomware is a type of malware. It locks your files. Then it asks you to pay money to unlock them. The money is called a ransom.
Ransomware is very dangerous. It can lock all your business files. If you do not pay, you might lose everything. Many small businesses have lost important data to ransomware.
Imagine a thief breaks into your shop. He locks all your goods in a room. He says, "Pay me 500,000 naira, or I will throw away the key." That is ransomware. It locks your files and demands money.
A small clinic was attacked by ransomware. The malware locked all patient records. The clinic had to pay to get them back.
A school was attacked by ransomware. The malware locked all student grades. The school had to restore from a backup.
A family was attacked by ransomware. The malware locked all their photos. The family had to pay to get them back.
A Nigerian business was attacked by ransomware. The malware locked all customer data. The business had to pay a large ransom.
Ransomware
|
V
+-------------------+
| Locks Your Files |
+-------------------+
|
V
+-------------------+
| Asks for Money |
+-------------------+
|
V
+-------------------+
| If You Pay, You |
| Might Get Files |
| Back |
+-------------------+
Ransomware is a type of malware that locks your files and asks for money to unlock them. It is very dangerous.
Hackers target small businesses because they are easier to attack. Small businesses often do not have good security.
If you know why hackers target small businesses, you can protect yourself. You can make your business a harder target.
Here are reasons why hackers target small businesses:
A hacker attacked a small accounting firm. The firm had client financial data. The hacker stole the data and sold it.
A hacker attacked a small school. The school had student and parent information. The hacker stole the information.
A hacker attacked a family's home business. The business had customer orders. The hacker stole the orders and demanded money.
A fraudster attacked a small Nigerian online store. The store had customer bank details. The fraudster stole the details and took money.
Why Hackers Target Small Businesses
|
V
+-------------------+
| Less Security |
+-------------------+
|
V
+-------------------+
| Valuable Data |
+-------------------+
|
V
+-------------------+
| Less Attention |
+-------------------+
|
V
+-------------------+
| Easy to Trick |
+-------------------+
|
V
+-------------------+
| Supply Chain |
+-------------------+
Hackers target small businesses because they have less security, valuable data, less attention, are easy to trick, and can be used to attack bigger companies.
The cost of a cyber attack is the damage it causes. It includes money lost, data lost, and trust lost.
Many small businesses do not recover from a cyber attack. They lose money. They lose customers. They close down. Knowing the cost helps you understand why security is important.
Here are the costs of a cyber attack:
A small business lost 5 million naira to a cyber attack. They also lost customers. They had to close for two weeks.
A small school lost student data to a cyber attack. Parents were angry. Many students left the school.
A family business lost all its customer orders. They could not fulfill orders. They lost money and trust.
A Nigerian business lost 10 million naira to a cyber attack. They also lost customer data. They were fined by NITDA for not protecting the data.
The Cost of a Cyber Attack
|
V
+-------------------+
| Money Lost |
+-------------------+
|
V
+-------------------+
| Data Lost |
+-------------------+
|
V
+-------------------+
| Downtime |
+-------------------+
|
V
+-------------------+
| Reputation |
| Damage |
+-------------------+
|
V
+-------------------+
| Legal Fees |
+-------------------+
|
V
+-------------------+
| Recovery Costs |
+-------------------+
The cost of a cyber attack includes money lost, data lost, downtime, reputation damage, legal fees, and recovery costs.
Simple cyber security habits are things you do every day to keep your business safe. They are easy to do. They do not cost much money.
You do not need to be a computer expert to protect your business. Simple habits can stop most attacks.
Here are simple cyber security habits:
A small shop uses strong passwords and antivirus. They back up their files every week. They have not had a cyber attack.
A small school trains its teachers about phishing. They use strong passwords. They have not had a data breach.
A family business uses two-factor authentication. They update their software. They have not had a virus.
A Nigerian online store uses strong passwords and backs up customer data. They have not lost any data to hackers.
Simple Cyber Security Habits
|
V
+-------------------+
| Strong Passwords |
+-------------------+
|
V
+-------------------+
| No Strange Links |
+-------------------+
|
V
+-------------------+
| Antivirus |
+-------------------+
|
V
+-------------------+
| Updates |
+-------------------+
|
V
+-------------------+
| Backups |
+-------------------+
|
V
+-------------------+
| Training |
+-------------------+
Simple cyber security habits include using strong passwords, avoiding strange links, installing antivirus, updating software, backing up files, and training staff.
Cyber security is important for small businesses all over the world, including in Nigeria. Here are some Nigerian examples.
Seeing examples from Nigeria helps you understand how cyber security works in your own country.
Here are some Nigerian examples:
A Nigerian online store uses strong passwords and antivirus. They train their staff about phishing. They have not had a cyber attack.
A Nigerian school uses cyber security to protect student grades. They back up their files every week. They have not lost any data.
A Nigerian family business uses two-factor authentication. They update their software. They have not had a virus.
A Nigerian tailor uses a computer for customer measurements. He backs up his files every week. He has not lost any measurements.
Nigerian Cyber Security for Small Businesses
+------------------------------------------+
| Online Stores: Protect customer data |
| Banks: Protect money, train staff |
| Schools: Protect student data |
| Businesses: Protect customer data |
| Government: Help small businesses |
+------------------------------------------+
Nigerian online stores, banks, schools, businesses, and government agencies all use cyber security to stay safe.
Cyber security can be explained using fun examples that children understand.
When you use fun examples, learning becomes easier and more enjoyable.
Here are some fun examples:
Imagine you are playing a game. You have a shield that blocks enemy attacks. Cyber security is like that shield for your business.
Your school has a security guard at the gate. He stops bad people from entering. Cyber security is like that guard for your business.
Your family has a mosquito net over the bed. It keeps mosquitoes away. Cyber security is like that net for your business.
In a Nigerian football match, the goalkeeper stops the ball. Cyber security stops hackers.
Fun Cyber Security
+------------------------------------------+
| Video Game: Shield against enemies |
| Football: Goalkeeper stops ball |
| Social Media: Block bad posts |
| School: Lock your locker |
| Cooking: Cover keeps flies away |
+------------------------------------------+
Cyber security is everywhere. It is in video games, football, social media, school, and cooking. It protects your business like armor or a guard.
Cyber security is not just for computers. It is like things in everyday life.
When you understand cyber security in everyday life, you can use the ideas to protect your business.
Here are everyday examples:
You lock your shop at night. You also lock your computer with a password.
You keep your money in a safe. You also keep your data in a secure computer.
You use a mosquito net to keep mosquitoes away. You use antivirus to keep malware away.
A Nigerian family locks their shop at night. They also lock their computer with a strong password.
Everyday Cyber Security
+------------------------------------------+
| Lock Shop: Keep thieves out |
| Use Safe: Keep money safe |
| Check Visitors: Antivirus checks |
| Keep Secrets: Do not share passwords |
| Seatbelt: Stay safe |
+------------------------------------------+
Cyber security is like locking your shop, using a safe, checking visitors, keeping secrets, and wearing a seatbelt.
A cyber security checklist is a list of things you should do to keep your business safe.
A checklist helps you remember what to do. It helps you stay safe.
Here is a simple cyber security checklist for your business:
A small shop uses a cyber security checklist. They check it every month. They have not had a cyber attack.
A small school uses a cyber security checklist. They check it every term. They have not had a data breach.
A family business uses a cyber security checklist. They check it every month. They have not had a virus.
A Nigerian online store uses a cyber security checklist. They check it every week. They have not lost any data.
Cyber Security Checklist
|
V
+-------------------+
| Strong Passwords |
+-------------------+
|
V
+-------------------+
| 2FA |
+-------------------+
|
V
+-------------------+
| Antivirus |
+-------------------+
|
V
+-------------------+
| Updates |
+-------------------+
|
V
+-------------------+
| Backups |
+-------------------+
|
V
+-------------------+
| Training |
+-------------------+
A cyber security checklist includes using strong passwords, 2FA, antivirus, updates, backups, training, locking computers, avoiding strange links, and securing Wi-Fi.
A case study is a real-life example that helps us learn. Let us look at a Nigerian small business.
Case studies help us see how cyber security works in real life.
A Nigerian small business called "Chidi's Electronics" sold phones and laptops. The owner, Chidi, learned about cyber security.
Here is what Chidi did:
One day, a hacker sent a phishing email to Chidi's business. The email said, "Your order has a problem. Click here to fix it."
Chidi's staff member saw the email. She remembered the training. She did not click the link. She reported the email to Chidi.
Chidi was happy. His business was safe because he had prepared.
Chidi learned that cyber security saves businesses.
Chidi shared his success with other small businesses. They all started improving their cyber security.
Your school can use the same approach. Use strong passwords. Train staff. Back up files.
Your family business can use the same approach. Use 2FA. Update software. Back up files.
Nigerian small businesses like Chidi's Electronics use cyber security to stay safe.
Case Study: Chidi's Electronics
|
V
+-------------------+
| Problem: Phishing|
| Email |
+-------------------+
|
V
+-------------------+
| Solution: Cyber |
| Security |
+-------------------+
|
V
+-------------------+
| Strong Passwords,|
| 2FA, Antivirus, |
| Updates, Backups,|
| Training |
+-------------------+
|
V
+-------------------+
| Result: Business |
| Safe |
+-------------------+
Chidi's Electronics used cyber security to stay safe from a phishing attack. They used strong passwords, 2FA, antivirus, updates, backups, and training.
| Word | Simple Definition |
|---|---|
| Cyber Security | Keeping computers, phones, networks, and data safe from bad people |
| Hacker | A person who tries to break into computers without permission |
| Malware | Bad software that harms your computer |
| Phishing | Fake emails or messages that try to steal your information |
| Ransomware | Bad software that locks your files and asks for money |
| Data Breach | When private information is stolen |
| Insider Threat | When someone inside the business causes harm |
| Denial of Service | When a website is flooded with traffic so it stops working |
| Antivirus | Software that protects your computer from malware |
| Two-Factor Authentication (2FA) | An extra layer of security that requires two things to log in |
| Backup | A copy of your files kept in a safe place |
| Firewall | Software or hardware that blocks bad connections |
| WPA2 | A type of Wi-Fi encryption |
| WPA3 | A newer type of Wi-Fi encryption |
| OTP | One Time Password - a special code for one use |
A small shop in Lagos uses strong passwords and antivirus. They back up their files every week. They train their staff about phishing. They have not had a cyber attack.
A small school in Abuja uses two-factor authentication. They update their software. They back up student data. They have not had a data breach.
A family business in Port Harcourt uses a cyber security checklist. They check it every month. They have not had a virus.
Stores like Jumia and Konga use cyber security to protect customer data. Small online stores should do the same.
Banks like GTBank, Zenith, and Access Bank use cyber security to protect customer money. They also train their staff.
Schools like Covenant University and University of Lagos use cyber security to protect student data.
Companies like MTN, Glo, and Airtel use cyber security to protect customer data.
Agencies like NITDA help small businesses learn about cyber security.
In a video game, you protect your character with armor. Cyber security is like armor for your business.
In football, the goalkeeper protects the goal. Cyber security is like a goalkeeper for your business.
On social media, you block people who post bad things. Cyber security blocks hackers from your business.
In school, you lock your locker. Cyber security is like locking your business.
You lock your shop at night to keep thieves out. You lock your computer to keep hackers out.
You keep your money in a safe. You keep your data in a secure computer.
You check who comes to your shop. Antivirus checks what comes to your computer.
You do not tell strangers your secrets. You do not share your passwords.
You wear a seatbelt to stay safe in a car. You use cyber security to stay safe online.
+-------------------+
| Your Business |
+-------------------+
|
V
+-------------------+
| Cyber Security |
+-------------------+
|
V
+-------------------+
| Strong Passwords |
+-------------------+
|
V
+-------------------+
| Antivirus |
+-------------------+
|
V
+-------------------+
| Updates |
+-------------------+
|
V
+-------------------+
| Backups |
+-------------------+
|
V
+-------------------+
| Training |
+-------------------+
|
V
+-------------------+
| Business Safe |
+-------------------+
Day 1: Hacker sends phishing email
|
V
Day 2: Employee clicks link
|
V
Day 3: Hacker steals password
|
V
Day 4: Hacker accesses business accounts
|
V
Day 5: Hacker steals money and data
|
V
Day 6: Business detects the attack
|
V
Day 7: Business responds and recovers
|
V
Day 8: Business learns and improves
| Security Task | Done? |
|---|---|
| Strong passwords on all accounts | Yes / No |
| Two-factor authentication turned on | Yes / No |
| Antivirus installed and updated | Yes / No |
| Software updated | Yes / No |
| Files backed up | Yes / No |
| Staff trained about phishing | Yes / No |
| Computers locked when away | Yes / No |
| Wi-Fi secured with WPA2/WPA3 | Yes / No |
| Feature | Small Business | Big Business |
|---|---|---|
| Security budget | Small | Large |
| Security staff | Few or none | Many |
| Target for hackers | Easy target | Harder target |
| Recovery ability | Limited | Stronger |
| Need for cyber security | High | High |
| Type | What It Means |
|---|---|
| Malware | Bad software that harms your computer |
| Phishing | Fake emails or messages that try to steal your information |
| Ransomware | Bad software that locks your files and asks for money |
| Data Breach | When private information is stolen |
| Insider Threat | When someone inside the business causes harm |
| Denial of Service | When a website is flooded with traffic so it stops working |
Cyber security is keeping your computers, phones, networks, and data safe from bad people. It protects your business from hackers.
Small businesses need cyber security because they have valuable information and are easy targets for hackers.
A hacker is a person who tries to break into computers without permission. They want to steal information, cause damage, or make money.
There are many types of cyber threats: malware, phishing, ransomware, data breaches, insider threats, and denial of service.
Malware is bad software. It harms your computer by deleting files, stealing information, or spying on you.
Phishing is when a bad person pretends to be someone you trust. They send fake emails or messages to trick you into giving them your password or money.
Ransomware is a type of malware that locks your files and asks for money to unlock them. It is very dangerous.
Hackers target small businesses because they have less security, valuable data, less attention, are easy to trick, and can be used to attack bigger companies.
The cost of a cyber attack includes money lost, data lost, downtime, reputation damage, legal fees, and recovery costs.
Simple cyber security habits include using strong passwords, avoiding strange links, installing antivirus, updating software, backing up files, and training staff.
Nigerian online stores, banks, schools, businesses, and government agencies all use cyber security to stay safe.
Cyber security is everywhere. It is in video games, football, social media, school, and cooking. It protects your business like armor or a guard.
Cyber security is like locking your shop, using a safe, checking visitors, keeping secrets, and wearing a seatbelt.
A cyber security checklist includes using strong passwords, 2FA, antivirus, updates, backups, training, locking computers, avoiding strange links, and securing Wi-Fi.
Chidi's Electronics used cyber security to stay safe from a phishing attack. They used strong passwords, 2FA, antivirus, updates, backups, and training.
Congratulations! You have completed Module One: Introduction to Cyber Security for Small Businesses.
In this module, you learned that cyber security is the practice of keeping computers, phones, networks, and data safe from bad people.
You learned why small businesses need cyber security. They have valuable information and are easy targets for hackers.
You learned about hackers. They are people who try to break into computers without permission.
You learned about the types of cyber threats: malware, phishing, ransomware, data breaches, insider threats, and denial of service.
You learned what malware is. It is bad software that harms your computer.
You learned what phishing is. It is when a bad person pretends to be someone you trust.
You learned what ransomware is. It is bad software that locks your files and asks for money.
You learned why hackers target small businesses.
You learned the cost of a cyber attack.
You learned simple cyber security habits for small businesses.
You learned about Nigerian examples of cyber security for small businesses.
You learned about fun examples and everyday examples.
You learned how to build a cyber security checklist for your business.
You learned from a case study of a Nigerian small business that stayed safe.
You are now a Cyber Security for Small Businesses expert in training!
Cyber security is keeping your computers, phones, networks, and data safe from bad people.
Small businesses need cyber security because they have valuable information and are easy targets for hackers.
Hackers are people who try to break into computers without permission. They want to steal information, cause damage, or make money.
Types of cyber threats include malware, phishing, ransomware, data breaches, insider threats, and denial of service.
Malware is bad software. It harms your computer by deleting files, stealing information, or spying on you.
Phishing is when a bad person pretends to be someone you trust. They send fake emails or messages to trick you into giving them your password or money.
Ransomware is a type of malware that locks your files and asks for money to unlock them.
Hackers target small businesses because they have less security, valuable data, less attention, are easy to trick, and can be used to attack bigger companies.
The cost includes money lost, data lost, downtime, reputation damage, legal fees, and recovery costs.
Simple cyber security habits include using strong passwords, avoiding strange links, installing antivirus, updating software, backing up files, and training staff.
| Word | Definition |
|---|---|
| 1. Cyber Security | A. A person who tries to break into computers |
| 2. Hacker | B. Bad software that harms your computer |
| 3. Malware | C. Keeping your business safe from hackers |
| 4. Phishing | D. Bad software that locks your files and asks for money |
| 5. Ransomware | E. Fake emails or messages that try to steal your information |
| 6. Data Breach | F. When someone inside the business causes harm |
| 7. Insider Threat | G. When private information is stolen |
Answers: 1-C, 2-A, 3-B, 4-E, 5-D, 6-G, 7-F
You receive an email that says, "Your business account is blocked. Click here to fix it." The email address looks strange.
Question: What should you do?
Answer: Do not click the link. This is phishing. Delete the email. Call your bank if you are worried.
Your employee uses the password "123456" for the business account.
Question: What should you tell your employee?
Answer: Tell your employee that "123456" is a weak password. Hackers can guess it in one second. Your employee should use a strong password.
Your business computer is very slow. It shows pop-up ads all the time.
Question: What might be wrong?
Answer: Your computer might have malware. You should run an antivirus scan. You should also update your software.
Instructions:
Time: 30 minutes
Instructions:
Goal: Create a dashboard that shows how well your class understands cyber security for small businesses.
Steps:
Time: 2 weeks
Instructions:
In Module Two, you will learn about Passwords and Access Control.
You will learn:
To prepare for Module Two, think about these questions:
See you in Module Two!
End of Module One
Welcome to Module Two of the Cybersecurity for Small Businesses course!
In Module One, you learned what cyber security is and why it matters for small businesses. You learned about hackers, malware, phishing, and ransomware. You learned that small businesses are targets for bad people.
Now, in Module Two, you are going to learn about passwords and access control.
What is a password?
A password is a secret word or phrase that you use to lock your computer or your accounts. It is like a key to your shop. Only you should have the key.
What is access control?
Access control is deciding who can enter your shop and who cannot. It is deciding who can see your business information and who cannot. It is like having a guard at the door who checks everyone.
Imagine you have a small shop. You have a front door. You have a back door. You have a store room. You have a cash box. You do not let everyone go everywhere. You give keys only to people you trust. That is access control.
In cyber security, access control is the same. You do not give everyone the same password. You do not let everyone see all your files. You give access only to people who need it.
Why are passwords and access control important for small businesses?
Your business has valuable things. It has money. It has customer information. It has business secrets. If your passwords are weak, hackers can guess them. If your access control is poor, anyone can see your information.
Think about it this way. If you leave your shop keys on the table, anyone can take them. If you give a key to everyone, anyone can enter. Passwords and access control are like keeping your keys safe and giving them only to people you trust.
In this module, you will learn all about passwords and access control. You will learn how to create strong passwords. You will learn how to use a password manager. You will learn about two-factor authentication. You will learn how to control who sees what.
By the end of this module, you will be a passwords and access control expert. You will know how to keep your business safe.
Let us begin this exciting journey together!
After completing this module, you will be able to:
Once upon a time, in the busy city of Onitsha, Nigeria, there lived a woman named Mama Ngozi. Mama Ngozi had a small fashion shop. She sold beautiful clothes, shoes, and bags.
Mama Ngozi's shop had one key. She kept the key in her bag. Only she could open the shop. She also had a small safe inside the shop. The safe held her money. The safe had a combination lock.
One day, Mama Ngozi was very busy. She had many customers. She needed help. She hired a young man named Emeka to work in the shop.
Emeka was a good worker. He was polite. He was hardworking. Mama Ngozi liked him. She decided to give him a key to the shop.
But Mama Ngozi made a mistake. She also told Emeka the combination to the safe. She trusted him too much.
A few weeks later, Mama Ngozi noticed that money was missing from the safe. She checked the safe. Some money was gone.
She called Emeka. "Emeka," she said, "did you take money from the safe?"
Emeka looked scared. "No, Mama," he said. "I did not take any money."
But Mama Ngozi did not believe him. She checked the safe again. More money was gone.
Finally, Emeka admitted. "I am sorry, Mama," he said. "I took the money. I needed it for my family."
Mama Ngozi was very sad. She had trusted Emeka. She had given him too much access. She had given him the key to the shop and the combination to the safe.
Mama Ngozi's son, Chidi, came to visit. He saw that his mother was sad.
"Mama," he said, "what is wrong?"
Mama Ngozi told him what happened. Chidi listened carefully.
"Mama," Chidi said, "you gave Emeka too much access. He did not need to know the safe combination. He only needed to sell clothes. You should have given him only the access he needed."
Mama Ngozi understood. She had made a mistake. She had not used access control.
Chidi explained. "Access control means giving people only the access they need. It means not giving everyone the same key. It means not telling everyone the safe combination."
Mama Ngozi learned a very important lesson. Access control is important for small businesses. If you give too much access, people can steal from you. If you give the right access, your business is safe.
From that day on, Mama Ngozi used access control. She gave Emeka only the key to the shop. She did not tell him the safe combination. She changed the safe combination. She also changed the shop key.
Mama Ngozi's business grew and grew. And she never had a problem with theft again.
And that is exactly what you will learn in this module.
A password is a secret word or phrase that you use to lock your computer or your accounts. It is like a key. Only you should have the key.
Passwords keep bad people out. If your password is strong, hackers cannot get in. If your password is weak, hackers can steal your information.
Think about your shop. You lock the door at night. You have a key. Only you have the key. A password is like that key. It locks your computer or your online accounts.
A small business uses passwords to protect its computer. Only the owner and trusted staff know the passwords.
Your school uses passwords to protect student grades. Only teachers and students know their passwords.
Your family uses a password to protect the Wi-Fi. Only family members know the password.
A Nigerian online store uses passwords to protect customer accounts. Customers use passwords to log in and place orders.
What is a Password?
|
V
+-------------------+
| Secret Word |
+-------------------+
|
V
+-------------------+
| Locks Your |
| Computer/Account |
+-------------------+
|
V
+-------------------+
| Only You Know It |
+-------------------+
|
V
+-------------------+
| Keeps Bad People |
| Out |
+-------------------+
A password is a secret word or phrase that locks your computer or accounts. It is like a key. Only you should have the key.
Passwords matter for small businesses because they protect money, customer data, and business secrets.
If your business password is weak, hackers can guess it. They can steal your money. They can steal customer information. They can pretend to be you. Passwords keep your business safe.
Imagine you have a small shop. You keep your money in a cash box. The cash box has a lock. The key to the lock is your password. If the key is weak, anyone can open the box. If the key is strong, only you can open it.
A small shop uses the same password for everything. A hacker guesses the password. He steals money and customer information.
A school uses a weak password for its website. A hacker guesses the password. He changes the exam results.
A family uses a weak Wi-Fi password. A neighbour guesses the password. He uses the internet for free.
A Nigerian online store uses "password123" for its admin account. A fraudster guesses the password. He steals customer bank details.
Why Passwords Matter
|
V
+-------------------+
| Protect Money |
+-------------------+
|
V
+-------------------+
| Protect Customer |
| Data |
+-------------------+
|
V
+-------------------+
| Protect Business |
| Secrets |
+-------------------+
|
V
+-------------------+
| Keep Business |
| Safe |
+-------------------+
Passwords matter for small businesses because they protect money, customer data, and business secrets.
A strong password is hard to guess. A weak password is easy to guess.
If your password is weak, hackers can guess it quickly. If your password is strong, it will take them many years to guess it.
Here is what makes a password strong:
Here is what makes a password weak:
A strong password: "MySh0p!sB1g&Happy!"
A weak password: "shop123"
A strong password: "Sch00l!sFun2024#"
A weak password: "school"
A strong password: "Fam1ly@Home!2024"
A weak password: "home123"
A strong password: "N1ger1a!L0ve#"
A weak password: "nigeria"
Strong vs Weak Passwords
|
V
+-------------------+ +-------------------+
| STRONG | | WEAK |
+-------------------+ +-------------------+
| - Long | | - Short |
| - Mixed case | | - Common word |
| - Numbers | | - Name |
| - Symbols | | - Birthday |
+-------------------+ +-------------------+
| |
V V
+-------------------+ +-------------------+
| Hackers cannot | | Hackers can |
| guess | | guess quickly |
+-------------------+ +-------------------+
Strong passwords are long, mixed, and include numbers and symbols. Weak passwords are short, common, and easy to guess.
Creating a strong password means making a password that is hard to guess but easy for you to remember.
If you know how to create strong passwords, you can protect all your business accounts.
Here is a simple way to create a strong password:
This password is long, mixed, and has numbers and symbols. It is strong.
A small business uses the sentence "We sell the best clothes!" to create the password "WstBc!2024".
A student uses the sentence "My school is the best!" to create the password "MsItB!2024".
A family uses the sentence "Our home is safe and happy!" to create the password "OhIsAh!2024".
A Nigerian business uses the sentence "Nigeria is a great country!" to create the password "NiAgC!2024".
Creating a Strong Password
|
V
+-------------------+
| Think of a |
| Sentence |
+-------------------+
|
V
+-------------------+
| Take First |
| Letters |
+-------------------+
|
V
+-------------------+
| Add Numbers and |
| Symbols |
+-------------------+
|
V
+-------------------+
| Mix Capital and |
| Small Letters |
+-------------------+
|
V
+-------------------+
| Strong Password |
+-------------------+
To create a strong password, think of a sentence, take the first letters, add numbers and symbols, and mix capital and small letters.
Password mistakes are things people do that make their passwords weak or unsafe.
If you know the mistakes, you can avoid them. You can keep your business accounts safe.
Here are common password mistakes:
| Mistake | Why It Is Bad |
|---|---|
| Using "password" or "123456" | These are the first passwords hackers try |
| Using your name or birthday | Hackers can find this information |
| Using the same password everywhere | If one is stolen, all are stolen |
| Writing your password on paper | Someone can find the paper |
| Sharing your password with friends | Friends can accidentally leak it |
| Using short passwords | Short passwords are easy to guess |
| Using common words | Hackers have lists of common words |
A business owner used "password" as the password. A hacker guessed it in one second.
A student used their birthday as their password. A friend guessed it and changed their grades.
A family used "home123" as their Wi-Fi password. A neighbour guessed it and used their internet.
A Nigerian business owner used "nigeria" as their password. A fraudster guessed it and stole money.
Password Mistakes
|
V
+-------------------+
| Weak Password |
+-------------------+
|
V
+-------------------+
| Hackers Guess It |
+-------------------+
|
V
+-------------------+
| You Lose Data |
+-------------------+
Common password mistakes include using common words, using personal information, using the same password everywhere, and sharing passwords. Avoid these mistakes.
Access control is deciding who can enter your business and who cannot. It is deciding who can see your business information and who cannot.
If you do not control access, anyone can see your information. Anyone can change your data. Anyone can steal from you. Access control keeps your business safe.
Imagine you have a shop. You have a front door. You have a store room. You have a cash box. You do not let everyone go everywhere. You give keys only to people you trust. That is access control.
A small business gives the manager access to all files. But it gives the salesperson access only to sales files. That is access control.
Your school gives teachers access to student grades. But it gives students access only to their own grades. That is access control.
Your family gives parents access to the bank account. But it gives children access only to the TV. That is access control.
A Nigerian online store gives the owner access to all customer data. But it gives delivery staff access only to delivery addresses. That is access control.
Access Control
|
V
+-------------------+
| Who Can Enter? |
+-------------------+
|
V
+-------------------+
| Who Can See? |
+-------------------+
|
V
+-------------------+
| Who Can Change? |
+-------------------+
|
V
+-------------------+
| Give Only What |
| They Need |
+-------------------+
Access control is deciding who can enter your business and who can see your information. It means giving people only the access they need.
The principle of least privilege says: give people only the access they need to do their job. Do not give them more.
If you give too much access, people can make mistakes. They can steal from you. They can accidentally delete files. Least privilege keeps your business safe.
Imagine you have a shop. You hire a salesperson. The salesperson needs to sell clothes. The salesperson does not need to open the safe. So you give the salesperson a key to the shop, but not the safe combination. That is least privilege.
A small business gives the accountant access to financial files. But it does not give the accountant access to customer data. That is least privilege.
Your school gives the principal access to all student records. But it gives teachers access only to their own class records. That is least privilege.
Your family gives parents access to the bank account. But it gives children access only to the TV. That is least privilege.
A Nigerian online store gives the owner access to all customer data. But it gives delivery staff access only to delivery addresses. That is least privilege.
Principle of Least Privilege
|
V
+-------------------+
| Give Only What |
| They Need |
+-------------------+
|
V
+-------------------+
| Do Not Give |
| Extra Access |
+-------------------+
|
V
+-------------------+
| Business Safe |
+-------------------+
The principle of least privilege says: give people only the access they need to do their job. Do not give them more.
Two-factor authentication (2FA) is an extra layer of security. It means you need two things to log in: something you know (your password) and something you have (your phone or a code).
2FA makes it much harder for hackers to get in. Even if they steal your password, they still need your phone or code.
Imagine you have a safe with two locks. You need two keys to open it. One key is your password. The other key is your phone. A hacker might steal one key, but they still cannot open the safe without the second key.
A small business uses 2FA for its bank account. The owner types the password. Then the bank sends a code to the owner's phone. Only then can the owner log in.
Your school uses 2FA for teacher accounts. Teachers type their password and then a code from their phone.
Your family uses 2FA for email accounts. You type your password and then a code from your phone.
A Nigerian bank uses 2FA for online banking. You type your password and then an OTP sent to your phone.
Two-Factor Authentication (2FA)
|
V
+-------------------+
| Step 1: Password |
+-------------------+
|
V
+-------------------+
| Step 2: Code |
| from Phone |
+-------------------+
|
V
+-------------------+
| You Are Logged |
| In |
+-------------------+
Two-factor authentication (2FA) is an extra layer of security. It means you need two things to log in: your password and something you have, like your phone.
There are different types of 2FA. Each type uses a different second factor.
Knowing the types helps you choose the best 2FA for your business accounts.
Here are the main types of 2FA:
| Type | What It Means | Example |
|---|---|---|
| SMS Code | A code sent to your phone by text message | Bank sends OTP by SMS |
| Authenticator App | An app that generates codes | Google Authenticator, Authy |
| Hardware Token | A small device that generates codes | RSA SecurID token |
| Biometrics | Your fingerprint or face | Fingerprint scanner on phone |
| Email Code | A code sent to your email | Some websites send codes by email |
A small business uses SMS codes for its bank account. The owner types the password and then the code sent to the phone.
Your school uses authenticator apps for teacher accounts. Teachers type their password and then a code from the app.
Your family uses email codes for social media accounts. You type your password and then a code sent to your email.
A Nigerian bank uses SMS codes for online banking. You type your password and then the OTP sent to your phone.
Types of 2FA
|
V
+-------------------+
| SMS Code |
+-------------------+
|
V
+-------------------+
| Authenticator App|
+-------------------+
|
V
+-------------------+
| Hardware Token |
+-------------------+
|
V
+-------------------+
| Biometrics |
+-------------------+
|
V
+-------------------+
| Email Code |
+-------------------+
Types of 2FA include SMS codes, authenticator apps, hardware tokens, biometrics, and email codes.
A password manager is a special program that stores all your passwords in one safe place. You only need to remember one master password.
Password managers help you use strong, different passwords for every account. You do not have to remember them all. The password manager remembers them for you.
Imagine you have many keys for many doors. You keep them all on one keychain. The keychain is locked with one special key. That is a password manager. It holds all your passwords and locks them with one master password.
A small business uses a password manager for all employees. Each employee has one master password. The manager stores all other passwords.
Your school uses a password manager for teacher accounts. Teachers only need to remember one master password.
Your family uses a password manager. Everyone has one master password. The manager stores all other passwords.
A Nigerian business uses a password manager. Employees only need to remember one master password.
Password Manager
|
V
+-------------------+
| One Master |
| Password |
+-------------------+
|
V
+-------------------+
| Stores All Other |
| Passwords |
+-------------------+
|
V
+-------------------+
| You Only Remember|
| One |
+-------------------+
A password manager is a program that stores all your passwords in one safe place. You only need to remember one master password.
Keeping your passwords safe means protecting them from hackers and other people.
If your password is not safe, hackers can steal it. They can access your business accounts. They can steal your money and your information.
Here are ways to keep your passwords safe:
A business owner shared their password with an employee. The employee accidentally told someone else. The business account was hacked.
A student wrote their password on a piece of paper. Another student found the paper and used the password.
A family used the same password for everything. When one account was hacked, all accounts were hacked.
A Nigerian business owner used the same password for email and banking. A hacker stole the password from the email and used it to steal money.
Keeping Passwords Safe
|
V
+-------------------+
| Do Not Share |
+-------------------+
|
V
+-------------------+
| Do Not Write |
| Down |
+-------------------+
|
V
+-------------------+
| Use Different |
| Passwords |
+-------------------+
|
V
+-------------------+
| Use 2FA |
+-------------------+
Keep your passwords safe by not sharing them, not writing them down, using different passwords, and using 2FA.
Hackers have many ways to steal passwords. Knowing these ways helps you protect yourself.
If you know how hackers steal passwords, you can avoid the tricks.
Here are common ways hackers steal passwords:
| Method | How It Works | How to Protect Yourself |
|---|---|---|
| Phishing | Fake emails or messages that ask for your password | Do not click on strange links. Do not reply. |
| Guessing | Hackers try common passwords like "123456" | Use strong passwords. |
| Brute Force | Hackers use computers to try many passwords | Use long, complex passwords. |
| Shoulder Surfing | Hackers watch you type your password | Cover your screen. Do not type in public. |
| Malware | Bad software records your keystrokes | Use antivirus. Do not download strange files. |
| Data Breach | Hackers steal passwords from a website | Use different passwords. Change them if a site is hacked. |
A hacker sent a fake email that looked like it was from a bank. The email asked for the password. The business owner replied with the password. The hacker stole money.
A hacker guessed a student's password because it was "password123". The hacker changed the student's grades.
A hacker watched a family member type the Wi-Fi password at a cafe. The hacker used the Wi-Fi without permission.
A fraudster called a bank customer and said, "I am from the bank. Please tell me your OTP." The customer shared the OTP. The fraudster stole money.
How Hackers Steal Passwords
|
V
+-------------------+
| Phishing |
+-------------------+
|
V
+-------------------+
| Guessing |
+-------------------+
|
V
+-------------------+
| Brute Force |
+-------------------+
|
V
+-------------------+
| Shoulder Surfing |
+-------------------+
|
V
+-------------------+
| Malware |
+-------------------+
Hackers steal passwords through phishing, guessing, brute force, shoulder surfing, malware, and data breaches. Know these methods to protect yourself.
Password and access control are used all over the world, including in Nigeria. Here are some Nigerian examples.
Seeing examples from Nigeria helps you understand how password and access control work in your own country.
Here are some Nigerian examples:
A Nigerian bank customer uses a strong password and 2FA. A fraudster tries to log in but cannot because they do not have the OTP.
A Nigerian school uses 2FA for teacher accounts. A hacker tries to log in but cannot because they do not have the code.
A Nigerian family uses a strong Wi-Fi password. A neighbour cannot guess it.
A Nigerian business uses a password manager. Employees only need to remember one master password.
Nigerian Password and Access Control
+------------------------------------------+
| Banks: Strong passwords, 2FA, OTP |
| Telecoms: Passwords, 2FA |
| Government: Strong passwords, 2FA |
| Schools: Passwords, 2FA |
| Businesses: Password managers, 2FA |
+------------------------------------------+
Nigerian banks, telecoms, government agencies, schools, and businesses all use strong passwords and 2FA to stay safe.
Password and access control can be explained using fun examples that children understand.
When you use fun examples, learning becomes easier and more enjoyable.
Here are some fun examples:
Imagine you are playing a game where you have to protect a castle. The password is the key to the castle. If the key is weak, enemies can enter. If the key is strong, the castle is safe.
Your school has a computer lab. Each computer has a password. Only students who know the password can use the computer. That is password security.
Your phone has a password. Only you know it. That is password security.
In a Nigerian football match, the captain has a secret play. Only the team knows it. That is like a password. If the other team knows it, they can stop the play.
Fun Password and Access Control
+------------------------------------------+
| Video Game: Protect account |
| Football: Goalkeeper stops goals |
| Social Media: Protect your posts |
| School: Lock your locker |
| Cooking: Secret recipe |
+------------------------------------------+
Password and access control are everywhere. They are in video games, football, social media, school, and cooking.
A password policy is a set of rules about passwords. It says what makes a good password and how to keep it safe.
A password policy helps everyone in your business follow the same rules. It keeps your business safe.
A password policy has these parts:
A small business creates a password policy. All employees must use strong passwords and 2FA. The business is safe.
Your school creates a password policy. All teachers and students must use strong passwords. The school is safe.
Your family creates a password policy. Everyone must use strong passwords and 2FA. The family is safe.
A Nigerian business creates a password policy. All employees must use strong passwords and a password manager. The business is safe.
Password Policy
|
V
+-------------------+
| Length |
+-------------------+
|
V
+-------------------+
| Complexity |
+-------------------+
|
V
+-------------------+
| Uniqueness |
+-------------------+
|
V
+-------------------+
| Storage |
+-------------------+
|
V
+-------------------+
| 2FA |
+-------------------+
|
V
+-------------------+
| No Sharing |
+-------------------+
|
V
+-------------------+
| Changing |
+-------------------+
A password policy is a set of rules about passwords. It says what makes a good password and how to keep it safe.
| Word | Simple Definition |
|---|---|
| Password | A secret word or phrase that locks your computer or accounts |
| Access Control | Deciding who can enter your business and who can see your information |
| Least Privilege | Give people only the access they need to do their job |
| Two-Factor Authentication (2FA) | An extra layer of security that requires two things to log in |
| Password Manager | A program that stores all your passwords in one safe place |
| Master Password | The one password you use to unlock your password manager |
| OTP | One Time Password - a special code for one use |
| SMS Code | A code sent to your phone by text message |
| Authenticator App | An app that generates codes for 2FA |
| Biometrics | Using your fingerprint or face to log in |
| Phishing | Fake emails or messages that try to steal your password |
| Brute Force | When hackers use computers to try many passwords |
| Shoulder Surfing | When hackers watch you type your password |
| Malware | Bad software that can steal your password |
| Password Policy | A set of rules about passwords |
A small shop in Lagos uses strong passwords and 2FA. They use a password manager. They train their staff about password safety. They have not had a cyber attack.
A small school in Abuja uses strong passwords and 2FA for teacher accounts. They teach students about password safety. They have not had a data breach.
A family business in Port Harcourt uses a strong Wi-Fi password and 2FA for email. They do not share passwords. They have not had a virus.
Banks like GTBank, Zenith, and Access Bank use strong passwords and 2FA to protect customer accounts. They send OTPs by SMS.
Companies like MTN, Glo, and Airtel use passwords and 2FA to protect customer accounts.
NITDA uses strong passwords and 2FA to protect government systems.
Schools like Covenant University and University of Lagos use passwords and 2FA for student and staff accounts.
Companies like Jumia and Konga use strong passwords and 2FA to protect customer data.
In a video game, you have a password to protect your account. If your password is weak, someone can steal your account. If it is strong, your account is safe.
In football, the goalkeeper protects the goal. A strong password is like a good goalkeeper. It stops hackers from scoring.
On social media, you use a password to protect your account. If you share it, anyone can post as you. If you keep it secret, your account is safe.
In school, you lock your locker. A password is like the lock on your locker. It keeps your things safe.
Your house key is like a password. You do not give it to strangers. You do not leave it on the table. You keep it safe.
Your locker combination is like a password. You do not share it with friends. You do not write it where people can see it.
Your ATM PIN is like a password. You do not share it with anyone. You cover the keypad when you type it.
Your phone passcode is like a password. You do not share it. You use a strong one.
Your diary lock is like a password. You keep the key safe. You do not leave it lying around.
+-------------------+
| Create Password |
+-------------------+
|
V
+-------------------+
| Is It Strong? |
+-------------------+
|
+----+----+
| |
Yes No
| |
V V
+-------+ +-------+
| Use | | Make |
| It | | Strong|
+-------+ +-------+
| |
V V
+-------------------+
| Use 2FA |
+-------------------+
|
V
+-------------------+
| Use Password |
| Manager |
+-------------------+
|
V
+-------------------+
| Apply Least |
| Privilege |
+-------------------+
|
V
+-------------------+
| Business Safe |
+-------------------+
Weak Medium Strong
| | |
V V V
+----------------+ +----------------+ +----------------+
| "123456" | | "Password1" | | "MySh0p!sB1g& |
| | | | | Happy!" |
+----------------+ +----------------+ +----------------+
| | |
V V V
+----------------+ +----------------+ +----------------+
| Guessed in | | Guessed in | | Guessed in |
| 1 second | | 1 day | | Millions of |
| | | | | years |
+----------------+ +----------------+ +----------------+
| Security Task | Done? |
|---|---|
| Strong password on all accounts | Yes / No |
| Different password for each account | Yes / No |
| Two-factor authentication (2FA) turned on | Yes / No |
| Password manager installed | Yes / No |
| Passwords not written down | Yes / No |
| Passwords not shared with anyone | Yes / No |
| Least privilege applied | Yes / No |
| Password policy created | Yes / No |
| Feature | Strong Password | Weak Password |
|---|---|---|
| Length | 12+ characters | Less than 8 characters |
| Letters | Capital and small | All small or all capital |
| Numbers | Yes | No |
| Symbols | Yes | No |
| Personal Info | No | Name, birthday |
| Guess Time | Millions of years | Seconds or minutes |
| Type | What It Means | Example |
|---|---|---|
| Something You Know | A secret only you know | Password, PIN |
| Something You Have | A physical object you have | Phone, token |
| Something You Are | A part of your body | Fingerprint, face |
| Somewhere You Are | Your location | GPS, IP address |
A password is a secret word or phrase that locks your computer or accounts. It is like a key. Only you should have the key.
Passwords matter for small businesses because they protect money, customer data, and business secrets.
Strong passwords are long, mixed, and include numbers and symbols. Weak passwords are short, common, and easy to guess.
To create a strong password, think of a sentence, take the first letters, add numbers and symbols, and mix capital and small letters.
Common password mistakes include using common words, using personal information, using the same password everywhere, and sharing passwords. Avoid these mistakes.
Access control is deciding who can enter your business and who can see your information. It means giving people only the access they need.
The principle of least privilege says: give people only the access they need to do their job. Do not give them more.
Two-factor authentication (2FA) is an extra layer of security. It means you need two things to log in: your password and something you have, like your phone.
Types of 2FA include SMS codes, authenticator apps, hardware tokens, biometrics, and email codes.
A password manager is a program that stores all your passwords in one safe place. You only need to remember one master password.
Keep your passwords safe by not sharing them, not writing them down, using different passwords, and using 2FA.
Hackers steal passwords through phishing, guessing, brute force, shoulder surfing, malware, and data breaches. Know these methods to protect yourself.
Nigerian banks, telecoms, government agencies, schools, and businesses all use strong passwords and 2FA to stay safe.
Password and access control are everywhere. They are in video games, football, social media, school, and cooking.
A password policy is a set of rules about passwords. It says what makes a good password and how to keep it safe.
Congratulations! You have completed Module Two: Passwords and Access Control.
In this module, you learned that a password is a secret word or phrase that locks your computer or accounts. You learned that it is like a key.
You learned why passwords matter for small businesses. They protect money, customer data, and business secrets.
You learned about strong passwords and weak passwords. Strong passwords are long, mixed, and include numbers and symbols.
You learned how to create a strong password using a sentence.
You learned about common password mistakes and how to avoid them.
You learned about access control. It is deciding who can enter your business and who can see your information.
You learned about the principle of least privilege. It says: give people only the access they need.
You learned about two-factor authentication (2FA). It is an extra layer of security.
You learned about the types of 2FA: SMS codes, authenticator apps, hardware tokens, biometrics, and email codes.
You learned about password managers. They store all your passwords in one safe place.
You learned how to keep your passwords safe.
You learned how hackers steal passwords.
You learned about Nigerian examples of password and access control.
You learned about fun examples and everyday examples.
You learned how to build a password policy for your business.
You are now a Passwords and Access Control expert in training!
A password is a secret word or phrase that locks your computer or accounts. It is like a key.
Passwords are important because they protect money, customer data, and business secrets.
A strong password is long (12+ characters), mixed (capital and small letters), and includes numbers and symbols. It does not use personal information.
Access control is deciding who can enter your business and who can see your information. It means giving people only the access they need.
The principle of least privilege says: give people only the access they need to do their job. Do not give them more.
2FA is an extra layer of security. It means you need two things to log in: your password and something you have, like your phone.
A password manager is a program that stores all your passwords in one safe place. You only need to remember one master password.
Hackers steal passwords through phishing, guessing, brute force, shoulder surfing, malware, and data breaches.
Nigerian banks use strong passwords and 2FA. They send OTPs by SMS.
Yes! You can use password and access control to protect your house key, locker combination, ATM PIN, phone passcode, and diary lock.
| Word | Definition |
|---|---|
| 1. Password | A. A code sent to your phone by text message |
| 2. Access Control | B. An extra layer of security that requires two things |
| 3. Least Privilege | C. A secret word or phrase that locks your computer |
| 4. Two-Factor Authentication (2FA) | D. Deciding who can enter your business |
| 5. Password Manager | E. Using your fingerprint or face to log in |
| 6. SMS Code | F. A program that stores all your passwords |
| 7. Biometrics | G. Give people only the access they need |
Answers: 1-C, 2-D, 3-G, 4-B, 5-F, 6-A, 7-E
You receive an email that says, "Your business account is blocked. Click here to reset your password." The email address looks strange.
Question: What should you do?
Answer: Do not click the link. This is phishing. Delete the email. Call your bank if you are worried.
Your employee uses the password "123456" for the business account.
Question: What should you tell your employee?
Answer: Tell your employee that "123456" is a weak password. Hackers can guess it in one second. Your employee should use a strong password.
Your employee asks for the password to the business bank account so they can check something.
Question: What should you do?
Answer: Do not share the password. Even with employees. You can help them another way. Sharing passwords is dangerous.
Instructions:
Time: 30 minutes
Instructions:
Goal: Create a dashboard that shows how well your class protects their passwords and access.
Steps:
Time: 2 weeks
Instructions:
In Module Three, you will learn about Phishing, Scams, and Social Engineering.
You will learn:
To prepare for Module Three, think about these questions:
See you in Module Three!
End of Module Two
Welcome to Module Three of the Cybersecurity for Small Businesses course!
In Module One, you learned what cyber security is and why it matters for small businesses. You learned about hackers, malware, phishing, and ransomware.
In Module Two, you learned about passwords and access control. You learned how to create strong passwords and how to control who sees what.
Now, in Module Three, you are going to learn about phishing, scams, and social engineering.
What is phishing?
Phishing is when a bad person pretends to be someone you trust. They send you a fake email or message. They try to trick you into giving them your password or money.
What is a scam?
A scam is a trick that someone uses to steal from you. Scams can come by email, by phone, by text message, or even in person.
What is social engineering?
Social engineering is when a bad person tricks you into doing something or giving them information. They do not use computers to break in. They use words. They use tricks. They use your trust.
Imagine a stranger comes to your shop. He says he is a new customer. He asks to see your products. While you are showing him products, another thief enters the shop and steals from the cash box. That is a trick. That is social engineering.
In cyber security, social engineering is the same. A hacker might call you on the phone. He says he is from your bank. He asks for your password. He is tricking you. He is using social engineering.
Why are phishing, scams, and social engineering dangerous for small businesses?
Because they work. They trick people. They use trust. They use fear. They use urgency. Many small businesses have lost money and data because of these tricks.
Think about it this way. Your business is like a house. You have locks on the doors. You have windows. You have a gate. But if someone knocks on the door and says, "I am a friend of the owner. Let me in," and you open the door, the locks do not matter. Social engineering is like that. It tricks you into opening the door.
In this module, you will learn all about phishing, scams, and social engineering. You will learn how they work. You will learn how to spot them. You will learn how to protect your business.
By the end of this module, you will be a phishing and social engineering expert. You will know how to keep your business safe from these tricks.
Let us begin this exciting journey together!
After completing this module, you will be able to:
Once upon a time, in the city of Lagos, Nigeria, there lived a man named Mr. Adewale. Mr. Adewale had a small business. He sold office supplies to schools and companies.
Mr. Adewale worked very hard. He had many customers. He had a few employees. He was doing well.
One day, Mr. Adewale received an email. The email said, "Invoice for office supplies. Please pay 500,000 naira to this account." The email looked like it was from one of his suppliers.
Mr. Adewale was busy. He did not check the email carefully. He did not call the supplier. He just paid the money.
A few days later, Mr. Adewale received a call from his real supplier. "Mr. Adewale," the supplier said, "you have not paid for the last order."
Mr. Adewale was confused. "But I paid 500,000 naira two days ago," he said.
The supplier was also confused. "I did not send you an invoice," he said. "I did not receive any money."
Mr. Adewale checked the email again. He looked at the email address. It was not from his supplier. It was from a fake email address. The email was a scam. The money was gone.
Mr. Adewale was very upset. He had lost 500,000 naira. He had been tricked by a fake invoice.
His friend, Mrs. Bello, came to visit. She saw that Mr. Adewale was sad.
"Mr. Adewale," she said, "what is wrong?"
Mr. Adewale told her what happened. Mrs. Bello listened carefully.
"Mr. Adewale," Mrs. Bello said, "you have been a victim of a phishing scam. The email was fake. The invoice was fake. They tricked you into paying money to the wrong account."
Mr. Adewale was confused. "What is phishing?" he asked.
Mrs. Bello explained. "Phishing is when bad people pretend to be someone you trust. They send you a fake email. They try to trick you into giving them your password or money."
Mr. Adewale understood. He had been tricked. He had not been careful.
Mrs. Bello helped him. They called the bank. They reported the scam. They also trained Mr. Adewale and his employees about phishing.
Mr. Adewale learned a very important lesson. Phishing is dangerous for small businesses. If you are not careful, you can lose money.
From that day on, Mr. Adewale was very careful. He checked every email. He called suppliers before paying. He trained his employees. His business grew and grew.
And that is exactly what you will learn in this module.
Phishing is when a bad person pretends to be someone you trust. They send you a fake email or message. They try to trick you into giving them your password or money.
Phishing is one of the most common ways hackers get into businesses. They trick you into opening the door for them. If you know about phishing, you can avoid it.
Imagine a stranger comes to your shop. He says he is a police officer. He says there is an emergency and you must give him money. But he is not a police officer. He is a thief. Phishing is like that. The hacker pretends to be someone you trust.
A hacker sends an email that looks like it is from a bank. The email says, "Your business account is blocked. Click here to fix it." The link takes you to a fake website that steals your password.
A hacker sends an email that looks like it is from your school. The email says, "Click here to see your exam results." The link steals your password.
A hacker sends a text message that looks like it is from your parents. The message says, "Send me your password." The hacker is tricking you.
A fraudster sends an email that looks like it is from a Nigerian bank. The email says, "Your account has a problem. Send your OTP to fix it." The fraudster steals the money.
Phishing
|
V
+-------------------+
| Fake Email |
+-------------------+
|
V
+-------------------+
| Looks Real |
+-------------------+
|
V
+-------------------+
| You Click Link |
+-------------------+
|
V
+-------------------+
| You Lose Data |
+-------------------+
Phishing is when a bad person pretends to be someone you trust. They send fake emails or messages to trick you into giving them your password or money.
Phishing works in steps. The hacker plans the attack. They send the fake message. They wait for you to click. They steal your information.
Knowing how phishing works helps you spot it. You can see the steps and stop the attack.
Here is how phishing works:
A hacker sends 1,000 fake emails to a small business. Ten employees click the link. Five employees enter their information. The hacker steals from those five employees.
A hacker sends fake emails to students. The email says, "Your grades are ready. Click here." Some students click and enter their passwords. The hacker changes their grades.
A hacker sends fake text messages to a family. The message says, "Your package is delayed. Click here." Some family members click and enter their information. The hacker steals their data.
A fraudster sends fake emails to bank customers. The email says, "Your account is blocked. Click here." Some customers click and enter their passwords. The fraudster steals their money.
How Phishing Works
|
V
+-------------------+
| 1. Pick Target |
+-------------------+
|
V
+-------------------+
| 2. Create Fake |
| Message |
+-------------------+
|
V
+-------------------+
| 3. Send Message |
+-------------------+
|
V
+-------------------+
| 4. Victim Clicks |
+-------------------+
|
V
+-------------------+
| 5. Victim Enters |
| Info |
+-------------------+
|
V
+-------------------+
| 6. Hacker Steals |
+-------------------+
Phishing works in six steps: pick a target, create a fake message, send the message, victim clicks, victim enters information, hacker steals information.
There are many types of phishing. Each type uses a different way to trick you.
Knowing the types of phishing helps you spot them. You can avoid the tricks.
Here are the main types of phishing:
| Type | What It Means | Example |
|---|---|---|
| Email Phishing | Fake emails that look real | Fake bank email asking for password |
| Spear Phishing | Fake emails sent to a specific person | Fake email to a business owner |
| Smishing | Fake text messages (SMS) | Fake bank text asking for OTP |
| Vishing | Fake phone calls | Fake bank call asking for PIN |
| Pharming | Fake websites that look real | Fake bank website that steals password |
| Clone Phishing | A copy of a real email with a bad link | Copy of a real email with a fake link |
A hacker sends a fake text message that looks like it is from a bank. The text says, "Your account is blocked. Click here." This is smishing.
A hacker sends a fake email to a teacher. The email says, "Your paycheck is ready. Click here." This is spear phishing.
A hacker calls a family member. The caller says, "I am from the bank. Please tell me your PIN." This is vishing.
A fraudster sends a fake text message that looks like it is from a Nigerian bank. The text says, "Your account is blocked. Send your OTP." This is smishing.
Types of Phishing
|
V
+-------------------+
| Email Phishing |
+-------------------+
|
V
+-------------------+
| Spear Phishing |
+-------------------+
|
V
+-------------------+
| Smishing |
+-------------------+
|
V
+-------------------+
| Vishing |
+-------------------+
|
V
+-------------------+
| Pharming |
+-------------------+
|
V
+-------------------+
| Clone Phishing |
+-------------------+
Types of phishing include email phishing, spear phishing, smishing, vishing, pharming, and clone phishing. Each type uses a different way to trick you.
Spotting phishing means noticing when an email or message is fake. It means being careful.
If you can spot phishing, you can avoid it. You can protect your business and your money.
Here are signs of phishing:
An email says, "You won 1 million naira! Click here to claim." This is phishing. You did not win anything.
An email says, "Your exam results are ready. Click here." But the email address is not from your school. This is phishing.
A text says, "Your package is delayed. Click here to track." But you did not order anything. This is phishing.
A text says, "Your bank account is blocked. Send your PIN to unblock." This is phishing. Real banks never ask for your PIN.
Spotting Phishing
|
V
+-------------------+
| Asks for Password|
+-------------------+
|
V
+-------------------+
| Says "Urgent" |
+-------------------+
|
V
+-------------------+
| Has Mistakes |
+-------------------+
|
V
+-------------------+
| Do Not Click! |
+-------------------+
You can spot phishing by looking for signs like requests for passwords, urgent language, spelling mistakes, and strange email addresses. Do not click on suspicious links.
Social engineering is when a bad person tricks you into doing something or giving them information. They do not use computers to break in. They use words. They use tricks. They use your trust.
Social engineering is dangerous because it tricks people. It uses trust. It uses fear. It uses urgency. Many small businesses have lost money and data because of social engineering.
Imagine a stranger comes to your shop. He says he is a new customer. He asks to see your products. While you are showing him products, another thief enters the shop and steals from the cash box. That is a trick. That is social engineering.
A hacker calls a small business. He says he is from the IT department. He says there is a problem with the computer. He asks for the password. The employee gives the password. The hacker steals data.
A stranger calls a school. He says he is a parent. He says he needs to pick up his child. He asks for the child's class. The school gives the information. The stranger is not a parent.
A stranger calls a family. He says he is from the bank. He says there is a problem with the account. He asks for the PIN. The family gives the PIN. The stranger steals money.
A fraudster calls a business owner. He says he is from the bank. He says there is a problem with the account. He asks for the OTP. The business owner gives the OTP. The fraudster steals money.
Social Engineering
|
V
+-------------------+
| Bad Person |
+-------------------+
|
V
+-------------------+
| Uses Words and |
| Tricks |
+-------------------+
|
V
+-------------------+
| You Give Info |
+-------------------+
|
V
+-------------------+
| You Lose Money |
| or Data |
+-------------------+
Social engineering is when a bad person tricks you into doing something or giving them information. They use words, tricks, and your trust.
There are many types of social engineering. Each type uses a different trick.
Knowing the types of social engineering helps you spot them. You can avoid the tricks.
Here are the main types of social engineering:
| Type | What It Means | Example |
|---|---|---|
| Pretexting | Creating a fake story to trick you | "I am from the bank. I need your PIN." |
| Baiting | Offering something to trick you | Leaving a USB drive for you to pick up |
| Quid Pro Quo | Offering a service in exchange for information | "I will fix your computer if you give me your password." |
| Tailgating | Following you into a secure area | Following you into the office |
| Shoulder Surfing | Watching you type your password | Standing behind you at the ATM |
| Phishing | Fake emails or messages | Fake bank email asking for password |
A hacker leaves a USB drive in a company parking lot. An employee picks it up and plugs it into a computer. The USB drive has malware.
A stranger follows a teacher into the school building. The teacher does not check. The stranger steals from the office.
A stranger stands behind a family member at the ATM. He watches them type their PIN. He steals their card and uses the PIN.
A fraudster calls a business owner. He says he is from the bank. He says there is a problem. He asks for the OTP. The business owner gives it. The fraudster steals money.
Types of Social Engineering
|
V
+-------------------+
| Pretexting |
+-------------------+
|
V
+-------------------+
| Baiting |
+-------------------+
|
V
+-------------------+
| Quid Pro Quo |
+-------------------+
|
V
+-------------------+
| Tailgating |
+-------------------+
|
V
+-------------------+
| Shoulder Surfing |
+-------------------+
|
V
+-------------------+
| Phishing |
+-------------------+
Types of social engineering include pretexting, baiting, quid pro quo, tailgating, shoulder surfing, and phishing.
A fake invoice scam is when a bad person sends you a fake bill. They pretend to be a supplier. They ask you to pay money to a fake account.
Fake invoices can trick you into paying money to the wrong person. Many small businesses have lost money to fake invoices.
Imagine you get a bill in the mail. It looks like it is from your electricity company. It says you owe 50,000 naira. You pay the bill. Later, you find out the bill was fake. The money went to a thief. That is a fake invoice scam.
A small business receives a fake invoice for office supplies. The invoice looks real. The business pays the money. The money goes to a thief.
A school receives a fake invoice for textbooks. The invoice looks real. The school pays the money. The money goes to a thief.
A family receives a fake invoice for a service. The invoice looks real. The family pays the money. The money goes to a thief.
A Nigerian business receives a fake invoice from a fake supplier. The invoice looks real. The business pays 500,000 naira. The money goes to a fraudster.
Fake Invoice Scam
|
V
+-------------------+
| Fake Invoice |
+-------------------+
|
V
+-------------------+
| Looks Real |
+-------------------+
|
V
+-------------------+
| You Pay Money |
+-------------------+
|
V
+-------------------+
| Money Goes to |
| Thief |
+-------------------+
A fake invoice scam is when a bad person sends you a fake bill. They pretend to be a supplier. They ask you to pay money to a fake account.
CEO fraud is when a bad person pretends to be the boss of a company. They send an email to an employee. They ask the employee to send money or information.
CEO fraud can trick employees into sending money to a thief. Many small businesses have lost money to CEO fraud.
Imagine you work in a small business. You get an email from your boss. The email says, "I need you to send 200,000 naira to this account. It is urgent. Do not tell anyone." You trust your boss. You send the money. Later, you find out the email was fake. The money went to a thief. That is CEO fraud.
A small business employee receives an email from the "CEO." The email asks for a urgent payment. The employee sends the money. The money goes to a thief.
A school employee receives an email from the "principal." The email asks for a urgent payment. The employee sends the money. The money goes to a thief.
A family business employee receives an email from the "owner." The email asks for a urgent payment. The employee sends the money. The money goes to a thief.
A Nigerian business employee receives an email from the "CEO." The email asks for a urgent payment of 1 million naira. The employee sends the money. The money goes to a fraudster.
CEO Fraud
|
V
+-------------------+
| Fake Email from |
| "CEO" |
+-------------------+
|
V
+-------------------+
| Urgent Request |
+-------------------+
|
V
+-------------------+
| Employee Sends |
| Money |
+-------------------+
|
V
+-------------------+
| Money Goes to |
| Thief |
+-------------------+
CEO fraud is when a bad person pretends to be the boss of a company. They send an email to an employee. They ask the employee to send money or information.
Protecting your business means taking steps to avoid phishing and scams. It means being careful and training your staff.
If you do not protect your business, you can lose money and data. Protection keeps your business safe.
Here is how to protect your business:
A small business trains its staff about phishing. They check every email. They call suppliers before paying. They have not been tricked.
A school trains its teachers about phishing. They check every email. They call parents before releasing students. They have not been tricked.
A family trains its members about phishing. They check every email. They call the bank before giving information. They have not been tricked.
A Nigerian business trains its staff about phishing. They check every email. They call suppliers before paying. They have not been tricked.
Protecting Your Business
|
V
+-------------------+
| Train Staff |
+-------------------+
|
V
+-------------------+
| Check Emails |
+-------------------+
|
V
+-------------------+
| Verify Requests |
+-------------------+
|
V
+-------------------+
| Use 2FA |
+-------------------+
|
V
+-------------------+
| Back Up Files |
+-------------------+
|
V
+-------------------+
| Business Safe |
+-------------------+
To protect your business, train your staff, check emails, verify requests, use 2FA, back up files, and report suspicious emails.
Training your staff means teaching them about phishing and how to spot it. It means helping them stay safe.
Your staff are your first line of defence. If they know about phishing, they can spot it. If they do not know, they might click on a bad link.
Here is how to train your staff:
A small business trains its staff every three months. They send fake phishing emails to test them. The staff learn to spot phishing.
A school trains its teachers every term. They send fake phishing emails to test them. The teachers learn to spot phishing.
A family trains its members every month. They talk about phishing at dinner. The family learns to spot phishing.
A Nigerian business trains its staff every quarter. They send fake phishing emails to test them. The staff learn to spot phishing.
Training Your Staff
|
V
+-------------------+
| Explain Phishing |
+-------------------+
|
V
+-------------------+
| Show Examples |
+-------------------+
|
V
+-------------------+
| Teach Signs |
+-------------------+
|
V
+-------------------+
| Practice |
+-------------------+
|
V
+-------------------+
| Reward Reporting |
+-------------------+
|
V
+-------------------+
| Review Regularly |
+-------------------+
To train your staff, explain what phishing is, show examples, teach the signs, practice, reward reporting, and review regularly.
What to do if you are tricked means the steps you take after you realise you have been a victim of phishing or a scam.
If you are tricked, you need to act quickly. The faster you act, the less damage you suffer.
Here is what to do if you are tricked:
A small business owner was tricked by a fake invoice. They changed their passwords. They called the bank. They reported to the police. They told their staff. They learned from the incident.
A school was tricked by a phishing email. They changed passwords. They called the bank. They reported to the police. They told their staff. They learned.
A family was tricked by a scam. They changed passwords. They called the bank. They reported to the police. They told their family. They learned.
A Nigerian business was tricked by a fake invoice. They changed passwords. They called the bank. They reported to the police and NITDA. They told their staff. They learned.
What to Do If You Are Tricked
|
V
+-------------------+
| 1. Stay Calm |
+-------------------+
|
V
+-------------------+
| 2. Change |
| Passwords |
+-------------------+
|
V
+-------------------+
| 3. Call Bank |
+-------------------+
|
V
+-------------------+
| 4. Report |
+-------------------+
|
V
+-------------------+
| 5. Tell Staff |
+-------------------+
|
V
+-------------------+
| 6. Learn |
+-------------------+
If you are tricked, stay calm, change passwords, call your bank, report to authorities, tell your staff, and learn from the incident.
Phishing and scams are common in Nigeria. Here are some Nigerian examples.
Seeing examples from Nigeria helps you understand how phishing and scams work in your own country.
Here are some Nigerian examples:
A Nigerian bank sends a text message: "Dear customer, beware of fake emails asking for your password. We will never ask for your password. Do not reply. Call us if you are not sure."
A Nigerian school tells students: "Do not click on strange links. They can give your computer a virus. If you see a strange link, tell a teacher."
A Nigerian family tells their children: "Do not share your personal information online. Hackers can use it to trick you."
NITDA posts on social media: "Be careful of fake websites. They look like real websites, but they are not. Always check the website address before you enter your password."
Nigerian Phishing and Scams
+------------------------------------------+
| Banks: Warn about phishing |
| Telecoms: Warn about smishing |
| Government: Warn about phishing |
| Schools: Teach about phishing |
| Businesses: Warn about fake websites |
+------------------------------------------+
Nigerian banks, telecoms, government agencies, schools, and businesses all warn people about phishing and scams.
Phishing and social engineering can be explained using fun examples that children understand.
When you use fun examples, learning becomes easier and more enjoyable.
Here are some fun examples:
Imagine you are playing a game. Someone sends you a message: "Give me your password, and I will give you 1,000 gold coins." That is phishing. Do not do it.
Your teacher tells you: "If someone asks for your password, do not give it. Even if they say they are from the school."
Your parents tell you: "If someone calls and says they are from the bank, do not give them your PIN. Real banks never ask for your PIN."
In a Nigerian football match, the other team pretends to kick left but kicks right. That is a trick. Phishing is a trick too.
Fun Phishing and Social Engineering
+------------------------------------------+
| Video Game: Enemies pretend to be friends|
| Football: Team tricks you |
| Social Media: Fake friend asks password |
| School: Fake teacher asks password |
| Cooking: Fake recipe |
+------------------------------------------+
Phishing and social engineering can be understood through video games, football, social media, school, and cooking. Hackers trick you, but you can spot the tricks.
Phishing and scams are not just for computers. They are like things in everyday life.
When you understand phishing and scams in everyday life, you can use the ideas to stay safe.
Here are everyday examples:
A stranger knocks on your door and says they are from the electricity company. They ask to come in and check the meter. But they are not from the electricity company. They are a thief. That is social engineering.
A stranger calls the school and says they are a parent. They ask for a child's class. The school gives the information. The stranger is not a parent.
A stranger calls the family and says they are from the bank. They ask for the PIN. The family gives the PIN. The stranger steals money.
A fraudster calls a business owner and says he is from the bank. He says there is a problem. He asks for the OTP. The business owner gives it. The fraudster steals money.
Everyday Phishing and Scams
+------------------------------------------+
| Stranger at Door: Social engineering |
| Fake Phone Call: Vishing |
| Fake Letter: Scam |
| Fake Text: Smishing |
| Fake Email: Phishing |
+------------------------------------------+
Phishing and scams are like a stranger at the door, a fake phone call, a fake letter, a fake text, and a fake email. They all try to trick you.
A phishing awareness policy is a set of rules about phishing. It says what to look for and what to do.
A policy helps everyone in your business follow the same rules. It keeps your business safe.
A phishing awareness policy has these parts:
A small business creates a phishing awareness policy. All staff are trained. All suspicious emails are reported. The business is safe.
A school creates a phishing awareness policy. All teachers are trained. All suspicious emails are reported. The school is safe.
A family creates a phishing awareness policy. All members are trained. All suspicious emails are reported. The family is safe.
A Nigerian business creates a phishing awareness policy. All staff are trained. All suspicious emails are reported. The business is safe.
Phishing Awareness Policy
|
V
+-------------------+
| Training |
+-------------------+
|
V
+-------------------+
| Reporting |
+-------------------+
|
V
+-------------------+
| Verification |
+-------------------+
|
V
+-------------------+
| Passwords |
+-------------------+
|
V
+-------------------+
| Links |
+-------------------+
|
V
+-------------------+
| Attachments |
+-------------------+
|
V
+-------------------+
| Review |
+-------------------+
A phishing awareness policy is a set of rules about phishing. It says what to look for and what to do.
| Word | Simple Definition |
|---|---|
| Phishing | Fake emails or messages that try to steal your information |
| Social Engineering | Tricking people into giving information or doing something |
| Spear Phishing | Fake emails sent to a specific person |
| Smishing | Fake text messages (SMS) |
| Vishing | Fake phone calls |
| Pharming | Fake websites that look real |
| Clone Phishing | A copy of a real email with a bad link |
| Pretexting | Creating a fake story to trick you |
| Baiting | Offering something to trick you |
| Quid Pro Quo | Offering a service in exchange for information |
| Tailgating | Following you into a secure area |
| Shoulder Surfing | Watching you type your password |
| Fake Invoice | A fake bill that tricks you into paying money |
| CEO Fraud | Pretending to be the boss to trick an employee |
| Policy | A set of rules |
A small shop in Lagos trains its staff about phishing. They check every email. They call suppliers before paying. They have not been tricked.
A small school in Abuja trains its teachers about phishing. They check every email. They call parents before releasing students. They have not been tricked.
A family business in Port Harcourt trains its members about phishing. They check every email. They call the bank before giving information. They have not been tricked.
Banks like GTBank, Zenith, and Access Bank warn customers about phishing. They send text messages that say, "We will never ask for your PIN or OTP."
Companies like MTN, Glo, and Airtel warn customers about smishing. They send messages that say, "Do not click on strange links."
NITDA warns the public about phishing. They post warnings on social media and websites.
Schools like Covenant University and University of Lagos teach students about phishing. They hold assemblies and send emails.
Companies like Jumia and Konga warn customers about fake websites. They send messages that say, "Always check the website address before you pay."
In a video game, enemies pretend to be friends. They trick you. Phishing is like that. Hackers pretend to be friends.
In football, the other team pretends to go left but goes right. They trick you. Phishing is like that. Hackers trick you.
On social media, someone might pretend to be your friend. They ask for your password. That is phishing.
In school, someone might pretend to be a teacher. They ask for your password. That is phishing.
Someone knocks and says they are a police officer. They ask to come in. But they are not a police officer. They are a thief. That is social engineering.
Someone calls and says they are from the bank. They ask for your PIN. That is vishing.
You receive a letter that says you won a prize. You must pay a fee to claim it. That is a scam.
You receive a text that says your package is delayed. Click here. That is smishing.
You receive an email that says your account is blocked. Click here. That is phishing.
+-------------------+
| Receive Email |
+-------------------+
|
V
+-------------------+
| Check Sender |
+-------------------+
|
V
+-------------------+
| Look for Urgency |
+-------------------+
|
V
+-------------------+
| Check for |
| Mistakes |
+-------------------+
|
V
+-------------------+
| Does It Ask for |
| Personal Info? |
+-------------------+
|
+----+----+
| |
Yes No
| |
V V
+-------+ +-------+
|Delete | | Safe |
+-------+ +-------+
| |
V V
+-------------------+
| Report It |
+-------------------+
Day 1: Hacker picks target
|
V
Day 2: Hacker creates fake email
|
V
Day 3: Hacker sends email
|
V
Day 4: Victim receives email
|
V
Day 5: Victim clicks link
|
V
Day 6: Victim enters information
|
V
Day 7: Hacker steals information
|
V
Day 8: Victim loses money/data
| Safety Measure | Done? |
|---|---|
| Staff trained about phishing | Yes / No |
| All emails checked for signs | Yes / No |
| Strange links not clicked | Yes / No |
| Strange attachments not opened | Yes / No |
| Requests for money verified by phone | Yes / No |
| Suspicious emails reported | Yes / No |
| Phishing awareness policy created | Yes / No |
| Feature | Phishing | Social Engineering |
|---|---|---|
| Method | Email, text, phone | Any method |
| Goal | Steal information | Trick you into action |
| Example | Fake bank email | Stranger at the door |
| Protection | Check emails carefully | Verify identities |
| Type | What It Means |
|---|---|
| Email Phishing | Fake emails that look real |
| Spear Phishing | Fake emails sent to a specific person |
| Smishing | Fake text messages (SMS) |
| Vishing | Fake phone calls |
| Pharming | Fake websites that look real |
| Clone Phishing | A copy of a real email with a bad link |
Phishing is when a bad person pretends to be someone you trust. They send fake emails or messages to trick you into giving them your password or money.
Phishing works in six steps: pick a target, create a fake message, send the message, victim clicks, victim enters information, hacker steals information.
Types of phishing include email phishing, spear phishing, smishing, vishing, pharming, and clone phishing. Each type uses a different way to trick you.
You can spot phishing by looking for signs like requests for passwords, urgent language, spelling mistakes, and strange email addresses. Do not click on suspicious links.
Social engineering is when a bad person tricks you into doing something or giving them information. They use words, tricks, and your trust.
Types of social engineering include pretexting, baiting, quid pro quo, tailgating, shoulder surfing, and phishing.
A fake invoice scam is when a bad person sends you a fake bill. They pretend to be a supplier. They ask you to pay money to a fake account.
CEO fraud is when a bad person pretends to be the boss of a company. They send an email to an employee. They ask the employee to send money or information.
To protect your business, train your staff, check emails, verify requests, use 2FA, back up files, and report suspicious emails.
To train your staff, explain what phishing is, show examples, teach the signs, practice, reward reporting, and review regularly.
If you are tricked, stay calm, change passwords, call your bank, report to authorities, tell your staff, and learn from the incident.
Nigerian banks, telecoms, government agencies, schools, and businesses all warn people about phishing and scams.
Phishing and social engineering can be understood through video games, football, social media, school, and cooking. Hackers trick you, but you can spot the tricks.
Phishing and scams are like a stranger at the door, a fake phone call, a fake letter, a fake text, and a fake email. They all try to trick you.
A phishing awareness policy is a set of rules about phishing. It says what to look for and what to do.
Congratulations! You have completed Module Three: Phishing, Scams, and Social Engineering.
In this module, you learned that phishing is when a bad person pretends to be someone you trust. You learned that it works in six steps.
You learned about the types of phishing: email phishing, spear phishing, smishing, vishing, pharming, and clone phishing.
You learned how to spot phishing by looking for signs.
You learned about social engineering. It is when a bad person tricks you into doing something or giving them information.
You learned about the types of social engineering: pretexting, baiting, quid pro quo, tailgating, shoulder surfing, and phishing.
You learned about fake invoice scams and CEO fraud.
You learned how to protect your business from phishing and scams.
You learned how to train your staff about phishing.
You learned what to do if you are tricked.
You learned about Nigerian examples of phishing and scams.
You learned about fun examples and everyday examples.
You learned how to build a phishing awareness policy.
You are now a Phishing and Social Engineering expert in training!
Phishing is when a bad person pretends to be someone you trust. They send fake emails or messages to trick you into giving them your password or money.
Phishing works in six steps: pick a target, create a fake message, send the message, victim clicks, victim enters information, hacker steals information.
Types of phishing include email phishing, spear phishing, smishing, vishing, pharming, and clone phishing.
Look for requests for passwords, urgent language, spelling mistakes, and strange email addresses. Do not click on suspicious links.
Social engineering is when a bad person tricks you into doing something or giving them information. They use words, tricks, and your trust.
Types of social engineering include pretexting, baiting, quid pro quo, tailgating, shoulder surfing, and phishing.
A fake invoice scam is when a bad person sends you a fake bill. They pretend to be a supplier.
CEO fraud is when a bad person pretends to be the boss of a company. They send an email to an employee asking for money or information.
Train your staff, check emails, verify requests, use 2FA, back up files, and report suspicious emails.
Stay calm, change passwords, call your bank, report to authorities, tell your staff, and learn from the incident.
| Word | Definition |
|---|---|
| 1. Phishing | A. Fake text messages |
| 2. Social Engineering | B. Fake phone calls |
| 3. Smishing | C. Fake emails or messages that try to steal your information |
| 4. Vishing | D. Tricking people into giving information |
| 5. Fake Invoice | E. Pretending to be the boss |
| 6. CEO Fraud | F. A fake bill |
| 7. Pretexting | G. Creating a fake story to trick you |
Answers: 1-C, 2-D, 3-A, 4-B, 5-F, 6-E, 7-G
You receive an email that says, "Your business account is blocked. Click here to fix it." The email address looks strange.
Question: What should you do?
Answer: Do not click the link. This is phishing. Delete the email. Call your bank if you are worried.
You receive an invoice from a supplier. The invoice asks you to pay 500,000 naira to a new account.
Question: What should you do?
Answer: Call the supplier to verify. Do not pay until you confirm. This might be a fake invoice scam.
You receive an email from your "boss." The email says, "Send 200,000 naira to this account. It is urgent. Do not tell anyone."
Question: What should you do?
Answer: Call your boss to verify. Do not send the money. This might be CEO fraud.
Instructions:
Time: 30 minutes
Instructions:
Goal: Create a dashboard that shows how well your class spots phishing.
Steps:
Time: 2 weeks
Instructions:
In Module Four, you will learn about Malware, Antivirus, and Safe Browsing.
You will learn:
To prepare for Module Four, think about these questions:
See you in Module Four!
End of Module Three
Welcome to Module Four of the Cybersecurity for Small Businesses course!
In Module One, you learned what cyber security is and why it matters for small businesses. You learned about hackers, malware, phishing, and ransomware.
In Module Two, you learned about passwords and access control. You learned how to create strong passwords and how to control who sees what.
In Module Three, you learned about phishing, scams, and social engineering. You learned how bad people trick you into giving them your information.
Now, in Module Four, you are going to learn about malware, antivirus, and safe browsing.
What is malware?
Malware is bad software. It is a program that harms your computer. The word "malware" comes from "malicious software." Malicious means wanting to do bad things.
What is antivirus?
Antivirus is good software. It protects your computer from malware. It finds bad programs and removes them. It is like a guard for your computer.
What is safe browsing?
Safe browsing means being careful when you use the internet. It means avoiding bad websites. It means not clicking on strange links. It means protecting your business online.
Imagine you have a small shop. You sell beautiful clothes. You have a guard at the door. The guard checks everyone who comes in. If someone looks dangerous, the guard stops them. Antivirus is like that guard for your computer.
Imagine you are walking in a big city. There are many streets. Some are safe. Some are dangerous. You need to know which streets to avoid. The internet is like that city. Some websites are safe. Some are dangerous. Safe browsing helps you stay on the safe streets.
Why are malware, antivirus, and safe browsing important for small businesses?
Your business has valuable things. It has customer information. It has money. It has your reputation. If your computer gets malware, you can lose all these things. If you visit bad websites, you can get malware. Antivirus and safe browsing protect your business.
In this module, you will learn all about malware, antivirus, and safe browsing. You will learn what malware is. You will learn about the different types of malware. You will learn how antivirus works. You will learn how to browse the internet safely.
By the end of this module, you will be a malware, antivirus, and safe browsing expert. You will know how to keep your business safe.
Let us begin this exciting journey together!
After completing this module, you will be able to:
Once upon a time, in the city of Enugu, Nigeria, there lived a woman named Mama Ngozi. Mama Ngozi had a small shop. She sold food items like rice, beans, and garri.
Mama Ngozi also had a small garden behind her shop. She grew tomatoes, peppers, and vegetables. She loved her garden. She took care of it every day.
One day, Mama Ngozi travelled to Lagos for a wedding. She was away for two weeks. When she returned, she was shocked. Her garden was full of weeds. The weeds had taken over. The tomatoes were small. The peppers were dying. The vegetables were gone.
Mama Ngozi called her grandson, Emeka. "Emeka," she said, "what happened to my garden?"
Emeka looked at the garden. "The weeds grew while you were away," he said. "Nobody pulled them out."
Mama Ngozi nodded. "Weeds are like malware," she said. "If you do not remove them, they take over. They destroy everything."
Emeka was confused. "What is malware?" he asked.
Mama Ngozi smiled. "Malware is bad software that harms computers. Just like weeds harm my garden. We need a gardener to remove the weeds. And we need antivirus to remove malware."
Emeka understood. He helped Mama Ngozi clean the garden. They pulled out all the weeds. They watered the plants. After a few weeks, the garden was beautiful again.
That night, Mama Ngozi told Emeka, "Remember, my son. Malware is like weeds. It grows when you are not watching. You must always be careful. You must always use antivirus. You must always keep your computer clean."
Emeka learned a very important lesson. Malware is dangerous. Antivirus is important. And you must always be watchful.
And that is exactly what you will learn in this module.
Malware is bad software. It is a program that harms your computer. The word "malware" comes from "malicious software." Malicious means wanting to do bad things.
Malware can delete your files. It can slow down your computer. It can steal your information. It can even spy on you. Malware is dangerous for small businesses.
Imagine you have a robot that is supposed to help you clean your shop. But someone changed its program. Now the robot makes a mess instead of cleaning. That is malware. It is software that does bad things instead of good things.
A small shop's computer was infected with malware. The malware deleted all the sales records. The shop owner did not know how much money was made.
A school's computer was infected with malware. The malware deleted all the exam questions. The teachers had to write new questions.
A family's computer was infected with malware. The malware showed pop-up ads all the time. The computer became very slow.
A Nigerian business lost important files because of malware. The malware came from a fake email attachment.
Malware
|
V
+-------------------+
| Bad Software |
+-------------------+
|
V
+-------------------+
| Harms Your |
| Computer |
+-------------------+
|
V
+-------------------+
| Deletes, Steals, |
| Spies |
+-------------------+
Malware is bad software. It harms your computer by deleting files, stealing information, or spying on you.
There are many types of malware. Each type does something different.
Knowing the types of malware helps you understand the dangers. It helps you protect yourself.
Here are the main types of malware:
| Type | What It Does | Example |
|---|---|---|
| Virus | Attaches to files and spreads when you open them | Deletes your documents |
| Worm | Spreads by itself through networks | Slows down the whole network |
| Trojan | Pretends to be good software but is bad | Steals your passwords |
| Ransomware | Locks your files and asks for money | Demands payment to unlock files |
| Spyware | Spies on what you do | Records your keystrokes |
| Adware | Shows unwanted ads | Pop-up ads everywhere |
A small business's computers were infected with spyware. The spyware recorded keystrokes and stole customer passwords.
A school's computers were infected with adware. The adware showed pop-up ads during lessons.
A family's computer was infected with ransomware. The ransomware locked all the photos and demanded money.
A Nigerian business was infected with a trojan. The trojan stole customer data.
Types of Malware
|
V
+-------------------+
| Virus |
+-------------------+
|
V
+-------------------+
| Worm |
+-------------------+
|
V
+-------------------+
| Trojan |
+-------------------+
|
V
+-------------------+
| Ransomware |
+-------------------+
|
V
+-------------------+
| Spyware |
+-------------------+
|
V
+-------------------+
| Adware |
+-------------------+
Types of malware include viruses, worms, trojans, ransomware, spyware, and adware. Each type does something different.
A virus is a type of malware. It attaches itself to other files. When you open the file, the virus runs and spreads.
Viruses can spread from computer to computer. They can destroy your files. They can make your computer stop working.
Imagine you have a cold. You sneeze, and your friend gets the cold. Then your friend sneezes, and another friend gets it. A computer virus is like a cold. It spreads from computer to computer.
A virus spread through a small business's network. It deleted all the files on every computer.
A virus spread through the school computer lab. It made all the computers slow.
A virus spread from a USB drive to a family computer. It deleted all the music files.
A virus spread through a Nigerian cybercafe. It stole customers' passwords.
Virus
|
V
+-------------------+
| Attaches to File |
+-------------------+
|
V
+-------------------+
| You Open File |
+-------------------+
|
V
+-------------------+
| Virus Runs and |
| Spreads |
+-------------------+
A virus is a type of malware that attaches to files. When you open the file, the virus runs and spreads.
A worm is a type of malware. It spreads by itself. It does not need you to open a file. It copies itself and sends copies to other computers.
Worms spread very fast. They can infect many computers in a short time. They can slow down networks and cause problems.
Imagine you have a magic notebook. Every time you write in it, a copy of the notebook appears in your friend's bag. Then your friend writes in it, and a copy appears in another friend's bag. That is a worm. It copies itself without you doing anything.
A worm spread through a small business's network. It slowed down all the computers and stopped work for a whole day.
A worm spread through the school network. It made the internet very slow.
A worm spread through a family's Wi-Fi. It slowed down the internet for everyone.
A worm spread through a Nigerian office network. It stopped staff from working for two days.
Worm
|
V
+-------------------+
| Copies Itself |
+-------------------+
|
V
+-------------------+
| Sends Copies to |
| Other Computers |
+-------------------+
|
V
+-------------------+
| Spreads Fast |
+-------------------+
A worm is a type of malware that spreads by itself. It copies itself and sends copies to other computers. It spreads very fast.
A trojan is a type of malware. It pretends to be good software. But when you install it, it does bad things.
Trojans trick you. They look like useful programs. But they are dangerous. They can steal your information or give hackers access to your computer.
Imagine a stranger gives you a gift. It looks like a beautiful box. But when you open it, a snake jumps out. That is a trojan. It looks good, but it is bad.
A person downloaded a free game. The game was a trojan. It stole their passwords.
A student downloaded a free study app. The app was a trojan. It deleted their schoolwork.
A family member downloaded a free video player. The player was a trojan. It showed pop-up ads all the time.
A Nigerian businessman downloaded a free accounting program. The program was a trojan. It stole his bank details.
Trojan
|
V
+-------------------+
| Pretends to be |
| Good Software |
+-------------------+
|
V
+-------------------+
| You Install It |
+-------------------+
|
V
+-------------------+
| It Does Bad |
| Things |
+-------------------+
A trojan is a type of malware that pretends to be good software. When you install it, it does bad things.
Ransomware is a type of malware. It locks your files. Then it asks you to pay money to unlock them. The money is called a ransom.
Ransomware is very dangerous. It can lock all your business files. If you do not pay, you might lose everything. Many small businesses have lost important data to ransomware.
Imagine a thief breaks into your shop. He locks all your goods in a room. He says, "Pay me 500,000 naira, or I will throw away the key." That is ransomware. It locks your files and demands money.
A small clinic was attacked by ransomware. The malware locked all patient records. The clinic had to pay to get them back.
A school was attacked by ransomware. The malware locked all student grades. The school had to restore from a backup.
A family was attacked by ransomware. The malware locked all their photos. The family had to pay to get them back.
A Nigerian business was attacked by ransomware. The malware locked all customer data. The business had to pay a large ransom.
Ransomware
|
V
+-------------------+
| Locks Your Files |
+-------------------+
|
V
+-------------------+
| Asks for Money |
+-------------------+
|
V
+-------------------+
| If You Pay, You |
| Might Get Files |
| Back |
+-------------------+
Ransomware is a type of malware that locks your files and asks for money to unlock them. It is very dangerous.
Malware spreads in many ways. Knowing how it spreads helps you avoid it.
If you know how malware spreads, you can protect yourself. You can avoid the things that spread malware.
Here are the main ways malware spreads:
| How It Spreads | What It Means |
|---|---|
| Email Attachments | Malware hides in files attached to emails |
| Fake Downloads | Malware hides in free software |
| USB Drives | Malware spreads from one computer to another |
| Bad Websites | Malware downloads when you visit bad sites |
| Pop-Up Ads | Malware hides in pop-up ads |
| Networks | Malware spreads through shared networks |
| Phishing | Malware hides in links in fake emails |
A small business employee opened an email attachment. The attachment was malware. It infected the computer.
A student used a USB drive from home. The USB drive had malware. It infected the school computer.
A family member clicked on a pop-up ad. The ad downloaded malware to the computer.
A Nigerian office worker opened a fake email. The email had malware. It infected the office network.
How Malware Spreads
|
V
+-------------------+
| Email |
+-------------------+
|
V
+-------------------+
| Downloads |
+-------------------+
|
V
+-------------------+
| USB Drives |
+-------------------+
|
V
+-------------------+
| Bad Websites |
+-------------------+
|
V
+-------------------+
| Pop-Up Ads |
+-------------------+
|
V
+-------------------+
| Networks |
+-------------------+
Malware spreads through email attachments, fake downloads, USB drives, bad websites, pop-up ads, networks, and phishing.
Signs of a malware infection are things you notice when your computer has malware. They tell you something is wrong.
If you know the signs, you can detect malware early. You can remove it before it causes more damage.
Here are signs of a malware infection:
A small business owner noticed their computer was very slow. They ran an antivirus scan. It found a virus. They removed it.
A school noticed pop-up ads on all computers. They ran an antivirus scan. It found adware. They removed it.
A family noticed their photos were missing. They ran an antivirus scan. It found a virus. They restored from backup.
A Nigerian business noticed its computers were crashing often. They ran an antivirus scan. It found ransomware. They restored from backup.
Signs of Malware
|
V
+-------------------+
| Slow Computer |
+-------------------+
|
V
+-------------------+
| Pop-Up Ads |
+-------------------+
|
V
+-------------------+
| Missing Files |
+-------------------+
|
V
+-------------------+
| Frequent Crashes |
+-------------------+
Signs of a malware infection include a slow computer, pop-up ads, missing files, frequent crashes, and antivirus problems.
Antivirus is software that protects your computer from malware. It finds bad programs and removes them. It is like a guard for your computer.
Antivirus finds and removes malware. It stops viruses from spreading. It keeps your computer safe.
Imagine you have a guard at the gate of your shop. The guard checks everyone who comes in. If someone looks dangerous, the guard stops them. Antivirus is like that guard. It checks every file and stops the bad ones.
A small business uses antivirus on all its computers. The antivirus stops thousands of viruses every month.
Your school uses antivirus on the computer lab computers. It stops viruses from spreading.
Your family uses antivirus on the home computer. It keeps the computer safe.
A Nigerian bank uses antivirus on all staff computers. It stops malware from stealing customer data.
Antivirus
|
V
+-------------------+
| Software Guard |
+-------------------+
|
V
+-------------------+
| Checks Files |
+-------------------+
|
V
+-------------------+
| Stops Bad Files |
+-------------------+
|
V
+-------------------+
| Computer Stays |
| Safe |
+-------------------+
Antivirus is software that protects your computer from viruses and other malware. It is like a guard for your computer.
Antivirus works by scanning your computer for known malware. It compares files to a list of known viruses. If it finds a match, it removes the file.
Knowing how antivirus works helps you use it better. It helps you understand why updates are important.
Antivirus works in three main ways:
A small business's antivirus uses signature-based detection. It compares files to a list of known viruses. It finds and removes a virus.
Your school's antivirus uses heuristic detection. It notices a program acting strangely. It stops the program.
Your family's antivirus uses behavioural detection. It notices a program trying to delete files. It stops the program.
A Nigerian bank's antivirus uses all three methods. It finds and removes malware before it can steal data.
How Antivirus Works
|
V
+-------------------+
| Signature-Based |
+-------------------+
|
V
+-------------------+
| Heuristic |
+-------------------+
|
V
+-------------------+
| Behavioural |
+-------------------+
|
V
+-------------------+
| Removes Malware |
+-------------------+
Antivirus works by scanning for known malware, looking for bad behaviour, and watching what programs do. It removes malware when it finds it.
Choosing antivirus software means picking the best antivirus for your business.
Not all antivirus software is good. Some are better than others. Choosing the right one keeps your business safe.
Here is what to look for in antivirus software:
A small business chooses antivirus with real-time protection. It stops malware before it can run.
Your school chooses antivirus with regular updates. It stops new viruses.
Your family chooses antivirus with low impact. It does not slow down the computer.
A Nigerian bank chooses antivirus with good support. The company helps them when they have problems.
Choosing Antivirus
|
V
+-------------------+
| Good Reputation |
+-------------------+
|
V
+-------------------+
| Regular Updates |
+-------------------+
|
V
+-------------------+
| Real-Time |
| Protection |
+-------------------+
|
V
+-------------------+
| Low Impact |
+-------------------+
|
V
+-------------------+
| Good Support |
+-------------------+
Choose antivirus with a good reputation, regular updates, real-time protection, scanning options, low impact, and good support.
Safe browsing means being careful when you use the internet. It means avoiding bad websites. It means not clicking on strange links. It means protecting your business online.
The internet has many dangers. Hackers can steal your information. Bad websites can give your computer a virus. Safe browsing helps you avoid these dangers.
Imagine you are walking in a big city. There are many streets. Some are safe. Some are dangerous. You need to know which streets to avoid. The internet is like that city. Some websites are safe. Some are dangerous. Safe browsing helps you stay on the safe streets.
A small business employee visited a bad website. The website downloaded malware to the computer. Their files were deleted.
A student visited a bad website on a school computer. The website gave the computer a virus. The school had to clean all the computers.
A family member visited a bad website. The website showed pop-up ads. The ads downloaded malware.
A Nigerian business owner visited a fake banking website. The website stole their password. They lost money.
Safe Browsing
|
V
+-------------------+
| The Internet |
| (A Big City) |
+-------------------+
|
V
+-------------------+
| Some Streets |
| are Safe |
+-------------------+
|
V
+-------------------+
| Some Streets |
| are Dangerous |
+-------------------+
|
V
+-------------------+
| Safe Browsing |
| Keeps You Safe |
+-------------------+
Safe browsing means being careful when you use the internet. It helps you avoid bad websites and protect your information.
Browsing safely means following rules to stay safe online. It means checking websites before you use them.
If you browse safely, you can avoid malware and phishing. You can protect your business.
Here is how to browse safely:
A small business employee checks the website address before entering information. They look for HTTPS. They do not click on strange links. Their computer stays safe.
A student checks the website address before entering information. They look for HTTPS. They do not click on strange links. The school computer stays safe.
A family member checks the website address before entering information. They look for HTTPS. They do not click on strange links. The home computer stays safe.
A Nigerian business owner checks the website address before entering information. They look for HTTPS. They do not click on strange links. Their business stays safe.
How to Browse Safely
|
V
+-------------------+
| Check Website |
| Address |
+-------------------+
|
V
+-------------------+
| Look for HTTPS |
+-------------------+
|
V
+-------------------+
| No Strange Links |
+-------------------+
|
V
+-------------------+
| No Pop-Up Ads |
+-------------------+
|
V
+-------------------+
| Stay Safe |
+-------------------+
To browse safely, check website addresses, look for HTTPS, avoid strange links, avoid pop-up ads, use a firewall, keep your browser updated, and use antivirus.
Malware and antivirus are used all over the world, including in Nigeria. Here are some Nigerian examples.
Seeing examples from Nigeria helps you understand how malware and antivirus work in your own country.
Here are some Nigerian examples:
A Nigerian bank uses antivirus on all computers. When a virus is found, the antivirus removes it automatically.
A Nigerian school uses antivirus on the computer lab computers. When a student brings a USB drive with malware, the antivirus stops it.
A Nigerian family uses antivirus on the home computer. When a family member clicks on a bad link, the antivirus stops the malware.
A Nigerian business uses antivirus on all staff computers. The antivirus blocks thousands of malware attacks every month.
Nigerian Malware and Antivirus
+------------------------------------------+
| Banks: Antivirus, staff training |
| Telecoms: Antivirus, network scans |
| Government: Antivirus, public warnings |
| Schools: Antivirus, student training |
| Businesses: Antivirus, staff training |
+------------------------------------------+
Nigerian banks, telecoms, government agencies, schools, and businesses all use antivirus to protect against malware.
A malware safety plan is a set of rules you follow to keep your business safe from malware.
A plan helps you remember what to do. It helps you stay safe.
A malware safety plan has these parts:
A small business creates a malware safety plan. They install antivirus. They update software. They train staff. They back up files. Their business stays safe.
A school creates a malware safety plan. They install antivirus. They update software. They teach students. They back up files. Their school stays safe.
A family creates a malware safety plan. They install antivirus. They update software. They teach family members. They back up files. Their home stays safe.
A Nigerian business creates a malware safety plan. They install antivirus. They update software. They train staff. They back up files. Their business stays safe.
Malware Safety Plan
|
V
+-------------------+
| Antivirus |
+-------------------+
|
V
+-------------------+
| Updates |
+-------------------+
|
V
+-------------------+
| Safe Browsing |
+-------------------+
|
V
+-------------------+
| Email Safety |
+-------------------+
|
V
+-------------------+
| USB Safety |
+-------------------+
|
V
+-------------------+
| Backups |
+-------------------+
|
V
+-------------------+
| Training |
+-------------------+
|
V
+-------------------+
| Review |
+-------------------+
A malware safety plan includes antivirus, updates, safe browsing, email safety, USB safety, backups, training, and review.
| Word | Simple Definition |
|---|---|
| Malware | Bad software that harms your computer |
| Virus | A type of malware that attaches to files and spreads |
| Worm | A type of malware that spreads by itself |
| Trojan | A type of malware that pretends to be good software |
| Ransomware | A type of malware that locks your files and asks for money |
| Spyware | A type of malware that spies on what you do |
| Adware | A type of malware that shows unwanted ads |
| Antivirus | Software that protects your computer from malware |
| Signature | A pattern that identifies a virus |
| Heuristic | Looking for bad behaviour |
| Behavioural | Watching what programs do |
| Real-Time Protection | Checking files as you open them |
| Safe Browsing | Being careful when you use the internet |
| HTTPS | A way to send information safely over the internet |
| URL | The address of a website |
A small shop in Lagos uses antivirus on all computers. They scan for malware every day. They train staff about malware. They browse safely. Their computers are safe.
A small school in Abuja uses antivirus on all computers. They scan USB drives before use. They teach students about safe browsing. Their computers are safe.
A family business in Port Harcourt uses antivirus on the home computer. They do not click on strange links. They back up their photos. Their computer is safe.
Banks like GTBank, Zenith, and Access Bank use antivirus to protect customer data. They also train staff about malware.
Companies like MTN, Glo, and Airtel use antivirus to protect their networks. They also scan for malware.
NITDA uses antivirus to protect government systems. They also warn the public about malware.
Schools like Covenant University and University of Lagos use antivirus on all computers. They teach students about malware.
Companies like Jumia and Konga use antivirus to protect customer data. They also train staff.
In a video game, enemies attack your character. You use a shield to protect yourself. Antivirus is like a shield for your computer.
In football, the goalkeeper stops the ball from entering the goal. Antivirus is like a goalkeeper for your computer.
On social media, you block people who post bad things. Antivirus blocks bad software.
In school, the security guard stops bad people from entering. Antivirus stops bad software from entering.
Weeds are like malware. They grow and harm the plants. You pull them out. That is like antivirus.
Mosquitoes are like malware. They bite and cause harm. You use a mosquito net. That is like antivirus.
Rats are like malware. They eat your food and make a mess. You set traps. That is like antivirus.
Bad friends are like malware. They encourage you to do bad things. You avoid them. That is like antivirus.
Litter is like malware. It makes the street dirty. You clean it up. That is like antivirus.
+-------------------+
| Malware Attacks |
+-------------------+
|
V
+-------------------+
| Antivirus Scans |
+-------------------+
|
V
+-------------------+
| Finds Malware? |
+-------------------+
|
+----+----+
| |
Yes No
| |
V V
+-------+ +-------+
| Remove| |Computer|
| It | | Safe |
+-------+ +-------+
| |
V V
+-------------------+
| Computer Safe |
+-------------------+
Day 1: Malware enters
|
V
Day 2: Malware spreads
|
V
Day 3: Computer slows down
|
V
Day 4: Pop-up ads appear
|
V
Day 5: Files go missing
|
V
Day 6: Antivirus detects malware
|
V
Day 7: Malware removed
|
V
Day 8: Computer safe again
| Safety Measure | Done? |
|---|---|
| Antivirus installed | Yes / No |
| Antivirus updated | Yes / No |
| Regular scans scheduled | Yes / No |
| Do not click strange links | Yes / No |
| Do not open strange attachments | Yes / No |
| Scan USB drives before use | Yes / No |
| Files backed up | Yes / No |
| Safe browsing habits followed | Yes / No |
| Feature | Virus | Worm | Trojan |
|---|---|---|---|
| How it spreads | Attaches to files | Spreads by itself | Pretends to be good software |
| Needs you to open a file? | Yes | No | Yes |
| Speed of spread | Medium | Fast | Slow |
| Example | Deletes documents | Slows network | Steals passwords |
| Type | What It Does |
|---|---|
| Virus | Attaches to files and spreads |
| Worm | Spreads by itself |
| Trojan | Pretends to be good software |
| Ransomware | Locks files and asks for money |
| Spyware | Spies on what you do |
| Adware | Shows unwanted ads |
Malware is bad software. It harms your computer by deleting files, stealing information, or spying on you.
Types of malware include viruses, worms, trojans, ransomware, spyware, and adware. Each type does something different.
A virus is a type of malware that attaches to files. When you open the file, the virus runs and spreads.
A worm is a type of malware that spreads by itself. It copies itself and sends copies to other computers. It spreads very fast.
A trojan is a type of malware that pretends to be good software. When you install it, it does bad things.
Ransomware is a type of malware that locks your files and asks for money to unlock them. It is very dangerous.
Malware spreads through email attachments, fake downloads, USB drives, bad websites, pop-up ads, networks, and phishing.
Signs of a malware infection include a slow computer, pop-up ads, missing files, frequent crashes, and antivirus problems.
Antivirus is software that protects your computer from viruses and other malware. It is like a guard for your computer.
Antivirus works by scanning for known malware, looking for bad behaviour, and watching what programs do. It removes malware when it finds it.
Choose antivirus with a good reputation, regular updates, real-time protection, scanning options, low impact, and good support.
Safe browsing means being careful when you use the internet. It helps you avoid bad websites and protect your information.
To browse safely, check website addresses, look for HTTPS, avoid strange links, avoid pop-up ads, use a firewall, keep your browser updated, and use antivirus.
Nigerian banks, telecoms, government agencies, schools, and businesses all use antivirus to protect against malware.
A malware safety plan includes antivirus, updates, safe browsing, email safety, USB safety, backups, training, and review.
Congratulations! You have completed Module Four: Malware, Antivirus, and Safe Browsing.
In this module, you learned that malware is bad software. It harms your computer by deleting files, stealing information, or spying on you.
You learned about the types of malware: viruses, worms, trojans, ransomware, spyware, and adware.
You learned that a virus attaches to files and spreads.
You learned that a worm spreads by itself.
You learned that a trojan pretends to be good software.
You learned that ransomware locks your files and asks for money.
You learned how malware spreads: through email, downloads, USB drives, bad websites, pop-up ads, networks, and phishing.
You learned the signs of a malware infection: a slow computer, pop-up ads, missing files, and frequent crashes.
You learned about antivirus. It is software that protects your computer from malware.
You learned how antivirus works: signature-based detection, heuristic detection, and behavioural detection.
You learned how to choose antivirus software.
You learned about safe browsing. It means being careful when you use the internet.
You learned how to browse safely: check website addresses, look for HTTPS, avoid strange links, avoid pop-up ads, use a firewall, keep your browser updated, and use antivirus.
You learned about Nigerian examples of malware and antivirus.
You learned how to build a malware safety plan.
You are now a Malware, Antivirus, and Safe Browsing expert in training!
Malware is bad software. It harms your computer by deleting files, stealing information, or spying on you.
Types of malware include viruses, worms, trojans, ransomware, spyware, and adware.
A virus is a type of malware that attaches to files. When you open the file, the virus runs and spreads.
A worm is a type of malware that spreads by itself. It copies itself and sends copies to other computers.
A trojan is a type of malware that pretends to be good software. When you install it, it does bad things.
Ransomware is a type of malware that locks your files and asks for money to unlock them.
Malware spreads through email attachments, fake downloads, USB drives, bad websites, pop-up ads, networks, and phishing.
Antivirus is software that protects your computer from viruses and other malware. It is like a guard for your computer.
Choose antivirus with a good reputation, regular updates, real-time protection, scanning options, low impact, and good support.
Safe browsing means being careful when you use the internet. It helps you avoid bad websites and protect your information.
| Word | Definition |
|---|---|
| 1. Malware | A. A type of malware that spreads by itself |
| 2. Virus | B. A type of malware that pretends to be good software |
| 3. Worm | C. Bad software that harms your computer |
| 4. Trojan | D. A type of malware that locks your files and asks for money |
| 5. Ransomware | E. A type of malware that attaches to files and spreads |
| 6. Spyware | F. Software that protects your computer from malware |
| 7. Antivirus | G. A type of malware that spies on what you do |
Answers: 1-C, 2-E, 3-A, 4-B, 5-D, 6-G, 7-F
Your business computer is very slow. It shows pop-up ads all the time. Your files are missing.
Question: What should you do?
Answer: Your computer might have malware. You should run an antivirus scan. You should also update your antivirus and your software.
You receive an email with an attachment. The email says, "Open this file to see something funny." You do not know the sender.
Question: What should you do?
Answer: Do not open the attachment. It might contain malware. Delete the email.
You find a USB drive on the ground. You want to see what is on it.
Question: What should you do?
Answer: Do not plug it into your computer. It might contain malware. Give it to an adult or a teacher.
Instructions:
Time: 30 minutes
Instructions:
Goal: Create a dashboard that shows how well your class protects against malware.
Steps:
Time: 2 weeks
Instructions:
In Module Five, you will learn about Network and Wi-Fi Security.
You will learn:
To prepare for Module Five, think about these questions:
See you in Module Five!
End of Module Four
Welcome to Module Five of the Cybersecurity for Small Businesses course!
In Module One, you learned what cyber security is and why it matters for small businesses. You learned about hackers, malware, phishing, and ransomware.
In Module Two, you learned about passwords and access control. You learned how to create strong passwords and how to control who sees what.
In Module Three, you learned about phishing, scams, and social engineering. You learned how bad people trick you into giving them your information.
In Module Four, you learned about malware, antivirus, and safe browsing. You learned how to protect your computer from bad software.
Now, in Module Five, you are going to learn about network and Wi-Fi security.
What is a network?
A network is a group of computers and devices that are connected together. They can share files, printers, and internet connections.
What is Wi-Fi?
Wi-Fi is a way to connect to a network without wires. It uses radio waves to send information through the air. It is like a magic invisible wire.
Imagine your shop has many rooms. Each room has a telephone. The telephones are connected by wires. They can talk to each other. That is a network. Now imagine the telephones have no wires. They use invisible signals to talk. That is Wi-Fi.
Why is network and Wi-Fi security important for small businesses?
Your network connects all your devices. It connects your computer, your phone, your tablet, and your payment machine. If your network is not secure, hackers can get in. They can steal your information. They can watch what you do. They can use your internet for bad things.
Think about it this way. Your network is like the front door of your shop. If the door is open, anyone can walk in. If the door is locked, only you can enter. Network security is like locking the door.
In this module, you will learn all about network and Wi-Fi security. You will learn how to secure your business Wi-Fi. You will learn about Wi-Fi encryption. You will learn about public Wi-Fi risks. You will learn about firewalls.
By the end of this module, you will be a network and Wi-Fi security expert. You will know how to keep your business network safe.
Let us begin this exciting journey together!
After completing this module, you will be able to:
Once upon a time, in the city of Abuja, Nigeria, there lived a family called the Okafors. The Okafors had a small business. They sold food items like rice, beans, and garri.
The Okafors had a shop. The shop had a big gate. Every night, Mr. Okafor locked the gate. He wanted to keep his business safe. He did not want thieves to enter.
One evening, Mr. Okafor was very tired. He forgot to lock the gate. He went to bed. The gate stayed open all night.
In the morning, Mrs. Okafor woke up. She saw that the gate was open. She was worried. She called her husband.
"Mr. Okafor," she said, "the gate is open. Did you forget to lock it?"
Mr. Okafor was shocked. "I forgot," he said. "I was very tired last night."
They checked the shop. Some goods were missing. They were very upset. They learned a lesson. An open gate is dangerous. Anyone can enter.
That evening, Mr. Okafor called his children, Ada and Chidi. He told them what happened.
"My children," he said, "our gate is like our Wi-Fi. If we do not lock our Wi-Fi, anyone can enter. They can use our internet. They can see our information. They can do bad things."
Ada was confused. "How do we lock our Wi-Fi?" she asked.
Mr. Okafor smiled. "We use a strong password," he said. "We use encryption. We change the router settings. We do not share the password with strangers."
Chidi nodded. "So our Wi-Fi is like our gate," he said. "We must always lock it."
"Exactly," Mr. Okafor said. "Always lock your gate. Always lock your Wi-Fi."
And that is exactly what you will learn in this module.
A network is a group of computers and devices that are connected together. They can share files, printers, and internet connections.
Networks help us share things. We can share files. We can share printers. We can share internet. Networks make our businesses work better.
Imagine your shop has many rooms. Each room has a telephone. The telephones are connected by wires. They can talk to each other. That is a network.
A small business has many computers. They are connected together. They can share files and printers. That is a network.
Your school has many computers. They are connected together. They can share files and printers. That is a network.
Your home has many devices. Your computer, your phone, and your smart TV are connected together. They can share internet. That is a network.
A Nigerian small business has many computers. They are connected together. They can share customer data. That is a network.
What is a Network?
|
V
+-------------------+
| Computers and |
| Devices |
+-------------------+
|
V
+-------------------+
| Connected |
| Together |
+-------------------+
|
V
+-------------------+
| Share Files, |
| Printers, Internet|
+-------------------+
A network is a group of computers and devices that are connected together. They can share files, printers, and internet connections.
Wi-Fi is a way to connect to a network without wires. It uses radio waves to send information through the air. It is like a magic invisible wire.
Wi-Fi lets you connect to the internet without wires. You can move around. You can use your devices anywhere in your shop. Wi-Fi is convenient.
Imagine you have a magic invisible wire. You can connect your computer to the internet without plugging anything in. That is Wi-Fi.
A cafe offers free Wi-Fi. Customers can connect their phones and laptops to the internet.
Your school has Wi-Fi. Students and teachers can connect their devices to the internet.
Your home has Wi-Fi. Your family can connect their phones, tablets, and computers to the internet.
A Nigerian hotel offers free Wi-Fi. Guests can connect their devices to the internet.
What is Wi-Fi?
|
V
+-------------------+
| No Wires |
+-------------------+
|
V
+-------------------+
| Radio Waves |
+-------------------+
|
V
+-------------------+
| Connect to |
| Internet |
+-------------------+
Wi-Fi is a way to connect to a network without wires. It uses radio waves to send information through the air.
Network and Wi-Fi security means keeping your network and Wi-Fi safe from hackers. It means protecting your devices and your information.
If your network is not secure, hackers can get in. They can steal your information. They can watch what you do. They can use your internet for bad things.
Imagine your network is like the front door of your shop. If the door is open, anyone can walk in. If the door is locked, only you can enter. Network security is like locking the door.
A small business did not secure its network. A hacker got in and stole customer data. The business lost customers and money.
Your school did not secure its Wi-Fi. A hacker got in and changed student grades. The school had to fix the problem.
Your family did not secure the Wi-Fi. A neighbour used the internet for free. The internet was very slow.
A Nigerian business did not secure its network. A fraudster got in and stole customer data. The business lost customers and money.
Why Network and Wi-Fi Security Matters
|
V
+-------------------+
| Network at Risk |
+-------------------+
|
V
+-------------------+
| Hackers Can |
| Enter |
+-------------------+
|
V
+-------------------+
| You Lose Data, |
| Money, Privacy |
+-------------------+
Network and Wi-Fi security matters because it protects your devices and your information from hackers.
A business network has several parts. Each part does something different.
Knowing the parts of your network helps you secure it. You can see where the dangers are.
Here are the main parts of a business network:
| Part | What It Does | Example |
|---|---|---|
| Router | Connects your devices to the internet | Wi-Fi router |
| Modem | Connects your router to the internet service provider | Cable modem |
| Devices | Computers, phones, tablets, payment machines | Your laptop |
| Wi-Fi | Wireless connection to the router | Your business Wi-Fi |
| Firewall | Blocks bad connections | Router firewall |
A small business has a router, a modem, many devices, Wi-Fi, and a firewall. All these parts work together.
Your school has a router, a modem, many devices, Wi-Fi, and a firewall. All these parts work together.
Your home has a router, a modem, many devices, Wi-Fi, and a firewall. All these parts work together.
A Nigerian business has a router, a modem, many devices, Wi-Fi, and a firewall. All these parts work together.
Parts of a Business Network
|
V
+-------------------+
| Router |
+-------------------+
|
V
+-------------------+
| Modem |
+-------------------+
|
V
+-------------------+
| Devices |
+-------------------+
|
V
+-------------------+
| Wi-Fi |
+-------------------+
|
V
+-------------------+
| Firewall |
+-------------------+
The main parts of a business network are the router, the modem, the devices, Wi-Fi, and the firewall.
Securing your business Wi-Fi router means making it safe from hackers. It means locking the door to your network.
If your router is not secure, hackers can get in. They can steal your information. They can use your internet for bad things.
Here is how to secure your business Wi-Fi router:
A small business changed the default router password. They used WPA3 encryption. Their network is safe.
Your school changed the default router password. They used WPA2 encryption. Their network is safe.
Your family changed the default router password. They used WPA2 encryption. Their network is safe.
A Nigerian business changed the default router password. They used WPA3 encryption. Their network is safe.
Securing Your Business Wi-Fi Router
|
V
+-------------------+
| Change Password |
+-------------------+
|
V
+-------------------+
| Use WPA2/WPA3 |
+-------------------+
|
V
+-------------------+
| Change SSID |
+-------------------+
|
V
+-------------------+
| Turn Off WPS |
+-------------------+
|
V
+-------------------+
| Update Firmware |
+-------------------+
|
V
+-------------------+
| Turn Off Remote |
| Access |
+-------------------+
|
V
+-------------------+
| Use Firewall |
+-------------------+
To secure your business Wi-Fi router, change the default password, use WPA2 or WPA3 encryption, change the SSID, turn off WPS, update firmware, turn off remote access, and use a firewall.
Wi-Fi encryption scrambles the information sent over your Wi-Fi. It makes it hard for hackers to read. WPA2 and WPA3 are types of encryption.
Without encryption, anyone can read your information. With encryption, hackers cannot read it. Encryption keeps your information safe.
Imagine you are sending a letter. If you send it without an envelope, anyone can read it. If you send it with a sealed envelope, only the person you sent it to can read it. Wi-Fi encryption is like the sealed envelope.
A small business uses WPA3 encryption. Hackers cannot read their information.
Your school uses WPA2 encryption. Hackers cannot read student information.
Your family uses WPA2 encryption. Hackers cannot read your information.
A Nigerian bank uses WPA3 encryption. Hackers cannot read customer information.
Wi-Fi Encryption
|
V
+-------------------+
| Scrambles Info |
+-------------------+
|
V
+-------------------+
| Hackers Cannot |
| Read It |
+-------------------+
|
V
+-------------------+
| Information Safe |
+-------------------+
Wi-Fi encryption scrambles your information so hackers cannot read it. WPA2 and WPA3 are types of encryption. Always use WPA2 or WPA3.
Public Wi-Fi is a wireless internet connection that anyone can use. It is found in cafes, airports, hotels, and libraries.
Public Wi-Fi is not always safe. Hackers can spy on what you do. They can steal your passwords and your information.
Imagine you are talking to your friend in a crowded room. Anyone can hear what you are saying. Public Wi-Fi is like that crowded room. Anyone can see what you are doing. Hackers can listen to your information.
A small business owner used public Wi-Fi at a cafe. A hacker stole their password. The hacker accessed their bank account.
A student used public Wi-Fi at a library. A hacker stole their school password. The hacker changed their grades.
A family member used public Wi-Fi at an airport. A hacker stole their email password. The hacker sent fake emails to their friends.
A Nigerian business traveller used public Wi-Fi at a hotel. A hacker stole their bank details. The hacker stole money from their account.
Public Wi-Fi Risks
|
V
+-------------------+
| Public Wi-Fi |
+-------------------+
|
V
+-------------------+
| Hackers Can Spy |
+-------------------+
|
V
+-------------------+
| They Steal Your |
| Information |
+-------------------+
|
V
+-------------------+
| You Lose Data |
+-------------------+
Public Wi-Fi is not always safe. Hackers can spy on what you do. Avoid using public Wi-Fi for sensitive business activities like banking.
Staying safe on public Wi-Fi means taking steps to protect your information when you use public networks.
If you do not protect yourself, hackers can steal your information. You can lose money and privacy.
Here is how to stay safe on public Wi-Fi:
A small business owner used a VPN on public Wi-Fi. The VPN scrambled their information. Hackers could not read it.
A student used HTTPS websites on public Wi-Fi. Their information was safe.
A family member turned off file sharing on public Wi-Fi. Hackers could not access their files.
A Nigerian business traveller used a VPN on public Wi-Fi. Their bank details were safe.
Staying Safe on Public Wi-Fi
|
V
+-------------------+
| Use a VPN |
+-------------------+
|
V
+-------------------+
| Use HTTPS |
+-------------------+
|
V
+-------------------+
| No Banking |
+-------------------+
|
V
+-------------------+
| Log Out |
+-------------------+
|
V
+-------------------+
| Stay Safe |
+-------------------+
Stay safe on public Wi-Fi by using a VPN, using HTTPS, avoiding banking, and logging out when done.
A firewall is software or hardware that blocks bad things from coming into your computer. It is like a wall around your computer.
A firewall stops hackers from entering your computer. It also stops malware from sending your information out.
Imagine a wall around your shop. The wall has a gate. The gate only opens for people you trust. A firewall is like that wall. It only lets safe things in and out.
A small business uses a firewall to protect its network. The firewall blocks millions of bad connections every day.
Your school uses a firewall to protect its computers. It blocks students from visiting bad websites.
Your family uses a firewall on the home Wi-Fi. It blocks hackers from entering.
A Nigerian company uses a firewall to protect its data. It blocks fraudsters from entering the network.
Firewall
|
V
+-------------------+
| The Wall |
+-------------------+
|
V
+-------------------+
| Blocks Bad |
| Connections |
+-------------------+
|
V
+-------------------+
| Lets Good |
| Connections In |
+-------------------+
A firewall is software or hardware that blocks bad things from coming into your computer. It is like a wall around your computer.
A firewall works by checking every connection. It decides if the connection is safe or dangerous.
Knowing how a firewall works helps you understand why it is important. It helps you use it correctly.
A firewall works in three main ways:
A small business's firewall uses packet filtering. It blocks bad packets from entering the network.
Your school's firewall uses stateful inspection. It remembers safe connections.
Your family's firewall uses application filtering. It blocks bad programs.
A Nigerian bank's firewall uses all three methods. It blocks bad connections and bad programs.
How a Firewall Works
|
V
+-------------------+
| Packet Filtering |
+-------------------+
|
V
+-------------------+
| Stateful |
| Inspection |
+-------------------+
|
V
+-------------------+
| Application |
| Filtering |
+-------------------+
|
V
+-------------------+
| Blocks Bad |
| Connections |
+-------------------+
A firewall works by checking connections, remembering safe connections, and filtering programs. It blocks bad connections.
Network and Wi-Fi security are used all over the world, including in Nigeria. Here are some Nigerian examples.
Seeing examples from Nigeria helps you understand how network and Wi-Fi security work in your own country.
Here are some Nigerian examples:
A Nigerian bank secures its network with a firewall and WPA3 encryption. Hackers cannot get in.
A Nigerian school secures its Wi-Fi with WPA2 encryption. Hackers cannot get in.
A Nigerian family secures its Wi-Fi with a strong password. Neighbours cannot use their internet.
A Nigerian business secures its network with a firewall. Fraudsters cannot get in.
Nigerian Network and Wi-Fi Security
+------------------------------------------+
| Banks: Firewalls, encryption |
| Telecoms: Encryption, firewalls |
| Government: Firewalls, encryption |
| Schools: WPA2 encryption |
| Businesses: Firewalls, encryption |
+------------------------------------------+
Nigerian banks, telecoms, government agencies, schools, and businesses all use network and Wi-Fi security to stay safe.
Network and Wi-Fi security can be explained using fun examples that children understand.
When you use fun examples, learning becomes easier and more enjoyable.
Here are some fun examples:
Imagine you are playing a game. You have a shield that blocks enemy attacks. A firewall is like that shield.
Your school has a security guard at the gate. He stops bad people from entering. A firewall is like that guard.
Your family has a mosquito net over the bed. It keeps mosquitoes away. Encryption is like that net.
In a Nigerian football match, the goalkeeper stops the ball. A firewall stops bad connections.
Fun Network and Wi-Fi Security
+------------------------------------------+
| Video Game: Shield against enemies |
| Football: Goalkeeper stops ball |
| Social Media: Block bad posts |
| School: Security guard stops bad people |
| Cooking: Cover keeps flies away |
+------------------------------------------+
Network and Wi-Fi security are everywhere. They are in video games, football, social media, school, and cooking. A firewall is like a shield or a guard.
Network security is not just for computers. It is like things in everyday life.
When you understand network security in everyday life, you can use the ideas to stay safe.
Here are everyday examples:
You lock your gate to keep thieves out. You lock your Wi-Fi to keep hackers out.
You do not talk to strangers at school. You do not share your Wi-Fi password with strangers.
You use a mosquito net to keep mosquitoes away. You use encryption to keep hackers away.
A Nigerian family locks their gate at night. They also lock their Wi-Fi with a strong password.
Everyday Network Security
+------------------------------------------+
| Lock Gate: Keep thieves out |
| Mosquito Net: Keep mosquitoes away |
| Check Visitors: Firewall checks |
| Keep Secrets: Do not share password |
| Seatbelt: VPN for safety |
+------------------------------------------+
Network security is like locking your gate, using a mosquito net, checking visitors, keeping secrets, and wearing a seatbelt.
A network security plan is a set of rules you follow to keep your network safe.
A plan helps you remember what to do. It helps you stay safe.
A network security plan has these parts:
A small business creates a network security plan. They change the router password. They use WPA3. They train staff. Their network is safe.
A school creates a network security plan. They change the router password. They use WPA2. They train teachers. Their network is safe.
A family creates a network security plan. They change the router password. They use WPA2. They train family members. Their network is safe.
A Nigerian business creates a network security plan. They change the router password. They use WPA3. They train staff. Their network is safe.
Network Security Plan
|
V
+-------------------+
| Router |
+-------------------+
|
V
+-------------------+
| Wi-Fi |
+-------------------+
|
V
+-------------------+
| Firewall |
+-------------------+
|
V
+-------------------+
| Updates |
+-------------------+
|
V
+-------------------+
| Public Wi-Fi |
+-------------------+
|
V
+-------------------+
| Staff |
+-------------------+
|
V
+-------------------+
| Review |
+-------------------+
A network security plan explains how to secure your router, Wi-Fi, firewall, updates, public Wi-Fi use, staff, and when to review.
A case study is a real-life example that helps us learn. Let us look at a Nigerian small business.
Case studies help us see how network and Wi-Fi security work in real life.
A Nigerian small business called "Chidi's Electronics" sold phones and laptops. The owner, Chidi, noticed that his Wi-Fi was very slow. Customers were complaining. He investigated.
He found that strangers were using his Wi-Fi. The Wi-Fi password was weak. The router still had the default password. The encryption was old.
Chidi decided to improve his network security. Here is what he did:
After one month, Chidi saw results:
Chidi learned that network and Wi-Fi security are important for small businesses.
Chidi shared his success with other small businesses. They all started improving their network security.
Your school can use the same approach. Change the default password. Use WPA2. Create a network security plan.
Your family can use the same approach. Change the default password. Use WPA2. Create a network security plan.
Nigerian small businesses like Chidi's Electronics use network and Wi-Fi security to stay safe.
Case Study: Chidi's Electronics
|
V
+-------------------+
| Problem: Slow |
| Wi-Fi |
+-------------------+
|
V
+-------------------+
| Solution: Secure |
| the Network |
+-------------------+
|
V
+-------------------+
| Change Password, |
| WPA3, Firewall, |
| Updates, Plan |
+-------------------+
|
V
+-------------------+
| Result: Fast |
| Wi-Fi, safe data |
+-------------------+
Chidi's Electronics secured its Wi-Fi by changing passwords, using WPA3, turning on the firewall, updating firmware, training staff, and creating a plan. The Wi-Fi became faster and safer.
| Word | Simple Definition |
|---|---|
| Network | A group of computers and devices connected together |
| Wi-Fi | A way to connect to a network without wires |
| Router | A device that connects your devices to the internet |
| Modem | A device that connects your router to the internet service provider |
| SSID | The name of your Wi-Fi network |
| Encryption | Scrambling information so hackers cannot read it |
| WPA2 | A type of Wi-Fi encryption |
| WPA3 | A newer type of Wi-Fi encryption |
| WPS | A feature that makes it easy to connect, but is easy to hack |
| Firewall | Software or hardware that blocks bad connections |
| Public Wi-Fi | Wireless internet that anyone can use |
| VPN | Virtual Private Network - scrambles your information |
| HTTPS | A way to send information safely over the internet |
| Firmware | Software built into a device |
| Default Password | The password that comes with a device |
A small shop in Lagos secures its network with a firewall and WPA3 encryption. They change default passwords. They update firmware. Their network is safe from hackers.
A small school in Abuja secures its Wi-Fi with WPA2 encryption. They change default passwords. They turn on the firewall. Their Wi-Fi is safe from hackers.
A family business in Port Harcourt secures its Wi-Fi with a strong password. They use WPA2 encryption. They turn on the firewall. Their Wi-Fi is safe.
Banks like GTBank, Zenith, and Access Bank secure their networks with firewalls and encryption. They protect customer data.
Companies like MTN, Glo, and Airtel secure their networks with encryption and firewalls. They protect customer data.
NITDA secures its networks with firewalls and encryption. They protect government data.
Schools like Covenant University and University of Lagos secure their Wi-Fi with WPA2 encryption. They protect student data.
Companies like Jumia and Konga secure their networks with firewalls and encryption. They protect customer data.
In a video game, you have a shield to protect your character. A firewall is like a shield for your network.
In football, the goalkeeper stops the ball. A firewall stops bad connections.
On social media, you block people who post bad things. A firewall blocks bad connections.
In school, the security guard stops bad people from entering. A firewall stops bad connections.
You lock your gate to keep thieves out. You lock your Wi-Fi to keep hackers out.
You use a mosquito net to keep mosquitoes away. You use encryption to keep hackers away.
You check who comes to your shop. A firewall checks what comes to your network.
You do not tell strangers your secrets. You do not share your Wi-Fi password.
You wear a seatbelt to stay safe in a car. You use a VPN to stay safe online.
+-------------------+
| Router |
+-------------------+
|
V
+-------------------+
| Change Password |
+-------------------+
|
V
+-------------------+
| Use WPA2/WPA3 |
+-------------------+
|
V
+-------------------+
| Change SSID |
+-------------------+
|
V
+-------------------+
| Turn Off WPS |
+-------------------+
|
V
+-------------------+
| Update Firmware |
+-------------------+
|
V
+-------------------+
| Turn On Firewall |
+-------------------+
|
V
+-------------------+
| Network Safe |
+-------------------+
Day 1: Get new router
|
V
Day 2: Change default password
|
V
Day 3: Use WPA2/WPA3 encryption
|
V
Day 4: Change SSID
|
V
Day 5: Turn off WPS
|
V
Day 6: Update firmware
|
V
Day 7: Turn on firewall
|
V
Day 8: Network safe
| Security Task | Done? |
|---|---|
| Changed default router password | Yes / No |
| Using WPA2 or WPA3 encryption | Yes / No |
| Changed SSID | Yes / No |
| Turned off WPS | Yes / No |
| Updated router firmware | Yes / No |
| Turned on firewall | Yes / No |
| Using a VPN on public Wi-Fi | Yes / No |
| Staff trained about network security | Yes / No |
| Feature | WPA2 | WPA3 |
|---|---|---|
| Created | 2004 | 2018 |
| Security | Good | Better |
| Password protection | Good | Stronger |
| Recommendation | Use if WPA3 not available | Use if available |
| Feature | Public Wi-Fi | Business Wi-Fi |
|---|---|---|
| Who can use it? | Anyone | Only you and your staff |
| Security | Not safe | Safe if secured |
| Encryption | Maybe not | WPA2/WPA3 |
| Recommendation | Use VPN, no banking | Safe for business |
A network is a group of computers and devices that are connected together. They can share files, printers, and internet connections.
Wi-Fi is a way to connect to a network without wires. It uses radio waves to send information through the air.
Network and Wi-Fi security matters because it protects your devices and your information from hackers.
The main parts of a business network are the router, the modem, the devices, Wi-Fi, and the firewall.
To secure your business Wi-Fi router, change the default password, use WPA2 or WPA3 encryption, change the SSID, turn off WPS, update firmware, turn off remote access, and use a firewall.
Wi-Fi encryption scrambles your information so hackers cannot read it. WPA2 and WPA3 are types of encryption. Always use WPA2 or WPA3.
Public Wi-Fi is not always safe. Hackers can spy on what you do. Avoid using public Wi-Fi for sensitive business activities like banking.
Stay safe on public Wi-Fi by using a VPN, using HTTPS, avoiding banking, and logging out when done.
A firewall is software or hardware that blocks bad things from coming into your computer. It is like a wall around your computer.
A firewall works by checking connections, remembering safe connections, and filtering programs. It blocks bad connections.
Nigerian banks, telecoms, government agencies, schools, and businesses all use network and Wi-Fi security to stay safe.
Network and Wi-Fi security are everywhere. They are in video games, football, social media, school, and cooking. A firewall is like a shield or a guard.
Network security is like locking your gate, using a mosquito net, checking visitors, keeping secrets, and wearing a seatbelt.
A network security plan explains how to secure your router, Wi-Fi, firewall, updates, public Wi-Fi use, staff, and when to review.
Chidi's Electronics secured its Wi-Fi by changing passwords, using WPA3, turning on the firewall, updating firmware, training staff, and creating a plan. The Wi-Fi became faster and safer.
Congratulations! You have completed Module Five: Network and Wi-Fi Security.
In this module, you learned that a network is a group of computers and devices that are connected together.
You learned that Wi-Fi is a way to connect to a network without wires.
You learned why network and Wi-Fi security matters. It protects your devices and your information.
You learned about the parts of a business network: the router, the modem, the devices, Wi-Fi, and the firewall.
You learned how to secure your business Wi-Fi router.
You learned about Wi-Fi encryption: WPA2 and WPA3.
You learned about public Wi-Fi risks.
You learned how to stay safe on public Wi-Fi.
You learned about firewalls and how they work.
You learned about Nigerian examples of network and Wi-Fi security.
You learned about fun examples and everyday examples.
You learned how to build a network security plan.
You learned from a case study of Chidi's Electronics, a Nigerian small business that secured its network.
You are now a Network and Wi-Fi Security expert in training!
A network is a group of computers and devices that are connected together. They can share files, printers, and internet connections.
Wi-Fi is a way to connect to a network without wires. It uses radio waves to send information through the air.
It protects your devices and your information from hackers.
The main parts are the router, the modem, the devices, Wi-Fi, and the firewall.
Change the default password, use WPA2 or WPA3 encryption, change the SSID, turn off WPS, update firmware, turn off remote access, and use a firewall.
Wi-Fi encryption scrambles your information so hackers cannot read it. WPA2 and WPA3 are types of encryption.
Hackers can spy on what you do. They can steal your passwords and your information.
Use a VPN, use HTTPS, avoid banking, and log out when done.
A firewall is software or hardware that blocks bad things from coming into your computer. It is like a wall around your computer.
A firewall works by checking connections, remembering safe connections, and filtering programs. It blocks bad connections.
Nigerian banks, telecoms, and government agencies use firewalls and encryption to protect data.
| Word | Definition |
|---|---|
| 1. Network | A. A way to connect to a network without wires |
| 2. Wi-Fi | B. Software or hardware that blocks bad connections |
| 3. Router | C. A group of computers and devices connected together |
| 4. Encryption | D. A device that connects your devices to the internet |
| 5. Firewall | E. Scrambling information so hackers cannot read it |
| 6. VPN | F. A newer type of Wi-Fi encryption |
| 7. WPA3 | G. Virtual Private Network - scrambles your information |
Answers: 1-C, 2-A, 3-D, 4-E, 5-B, 6-G, 7-F
Your business Wi-Fi is very slow. You think someone is using it without permission.
Question: What should you do?
Answer: Change your Wi-Fi password to a strong one. Check who is connected to your router. Make sure your router is secure.
You are at a cafe. You want to check your business bank account. The cafe has free Wi-Fi.
Question: What should you do?
Answer: Do not do banking on public Wi-Fi. Hackers can spy on you. Wait until you are on a secure network. Or use a VPN.
You just got a new Wi-Fi router for your business. It has a default password.
Question: What should you do?
Answer: Change the default password. Use WPA2 or WPA3 encryption. Change the SSID. Turn off WPS. Update the firmware. Turn on the firewall.
Instructions:
Time: 30 minutes
Instructions:
Goal: Create a dashboard that shows how well your class secures their networks.
Steps:
Time: 2 weeks
Instructions:
In Module Six, you will learn about Updates, Backups, and Data Protection.
You will learn:
To prepare for Module Six, think about these questions:
See you in Module Six!
End of Module Five
Welcome to Module Six of the Cybersecurity for Small Businesses course!
In Module One, you learned what cyber security is and why it matters for small businesses. You learned about hackers, malware, phishing, and ransomware.
In Module Two, you learned about passwords and access control. You learned how to create strong passwords and how to control who sees what.
In Module Three, you learned about phishing, scams, and social engineering. You learned how bad people trick you into giving them your information.
In Module Four, you learned about malware, antivirus, and safe browsing. You learned how to protect your computer from bad software.
In Module Five, you learned about network and Wi-Fi security. You learned how to keep your business network safe.
Now, in Module Six, you are going to learn about updates, backups, and data protection.
What is an update?
An update is a new version of software. It fixes problems and adds new features. It also fixes security holes.
What is a backup?
A backup is a copy of your files. You keep the copy in a safe place. If something happens to your files, you can use the backup.
What is data protection?
Data protection is keeping your business information safe. It means following rules about how to collect, store, and use data.
Imagine you have a small shop. You have a roof. The roof has small holes. When it rains, water leaks in. You fix the holes with patches. That is an update.
Imagine you have a treasure chest. You keep a copy of the key in a safe place. If you lose the first key, you can use the copy. That is a backup.
Imagine you have a list of customer names and phone numbers. You keep the list in a locked drawer. Only you can open the drawer. That is data protection.
Why are updates, backups, and data protection important for small businesses?
Your business has valuable things. It has customer data. It has money. It has your reputation. If your software is not updated, hackers can get in. If you do not have backups, you can lose everything. If you do not protect data, you can be fined.
Think about it this way. Your business is like a house. Updates fix the locks. Backups are a copy of your important documents. Data protection is keeping your documents in a safe place. All three are important.
In this module, you will learn all about updates, backups, and data protection. You will learn why updates matter. You will learn how to make backups. You will learn how to protect customer data.
By the end of this module, you will be an updates, backups, and data protection expert. You will know how to keep your business safe.
Let us begin this exciting journey together!
After completing this module, you will be able to:
Once upon a time, in the city of Kano, Nigeria, there lived a man named Malam Ibrahim. Malam Ibrahim had a small shop. He sold shoes and bags.
Malam Ibrahim's shop had a roof. The roof was old. It had small holes. When it rained, water leaked in. Malam Ibrahim put buckets under the leaks. He did not fix the roof.
One day, it rained very heavily. The water came through the holes. It damaged the shoes and bags. Malam Ibrahim lost a lot of money.
Malam Ibrahim was very sad. He called a carpenter. The carpenter fixed the roof. He patched all the holes.
"Malam," the carpenter said, "you should have fixed the roof earlier. The small holes became big problems."
Malam Ibrahim learned a lesson. Small problems become big problems if you do not fix them. Updates fix the holes in your software.
A few weeks later, Malam Ibrahim had another problem. He kept the key to his shop in his pocket. One day, he lost the key. He could not open the shop. He had to call a locksmith. It cost him money.
His friend, Mr. Adeyemi, came to visit. "Malam," he said, "why did you not keep a spare key?"
Malam Ibrahim was confused. "What is a spare key?" he asked.
Mr. Adeyemi explained. "A spare key is a copy of your key. You keep it in a safe place. If you lose your key, you can use the spare."
Malam Ibrahim understood. He made a spare key. He kept it in a safe place. He never had a problem with keys again.
That evening, Malam Ibrahim told his children, "My children, software is like my roof. It has small holes. These holes are called vulnerabilities. We must fix the holes with updates and patches. Also, your data is like my shop key. You must always keep a backup. If you lose the original, you can use the backup."
His children understood. They promised to always update their computers and back up their files.
And that is exactly what you will learn in this module.
An update is a new version of software. It fixes problems and adds new features. It also fixes security holes.
Updates fix security holes. Hackers look for old software with security holes. Updates close these holes. If you do not update, hackers can get in.
Imagine you have a bucket with a small hole in it. Water keeps leaking out. You put a patch on the hole. Now the bucket does not leak anymore. A software update is like that. It fixes a hole in your software.
A small business did not update its software. A hacker used an old hole to break in and steal customer data. The business lost customers and money.
Your school updates its computers every month. This keeps them safe from viruses.
Your family updates the home computer every week. This keeps it safe.
A Nigerian business updates its software regularly. This stops fraudsters from using old security holes.
Update
|
V
+-------------------+
| Old Software |
+-------------------+
|
V
+-------------------+
| Has Holes |
+-------------------+
|
V
+-------------------+
| Update Fixes |
| Holes |
+-------------------+
|
V
+-------------------+
| Computer Safe |
+-------------------+
An update is a new version of software that fixes problems and security holes. Updating your computer keeps it safe from hackers.
A patch is a small update. It fixes a specific problem. It is like a bandage for a cut.
Patches fix specific security holes quickly. They are small and fast to install. They keep your computer safe without waiting for a big update.
Imagine you have a small cut on your finger. You do not need a big bandage. You just need a small plaster. That is a patch. It fixes the small problem quickly.
A small business found a security hole in its software. They installed a patch. The hole was fixed.
Your school's computer system had a small problem. The IT teacher installed a patch. The problem was fixed.
Your family's Wi-Fi router had a small problem. Your parents installed a patch. The problem was fixed.
A Nigerian business found a small problem in its app. The business released a patch. Customers updated the app and were safe.
Patch
|
V
+-------------------+
| Small Problem |
+-------------------+
|
V
+-------------------+
| Patch Fixes It |
+-------------------+
|
V
+-------------------+
| Problem Solved |
+-------------------+
A patch is a small update that fixes a specific problem. It is like a bandage for a cut. Patches keep your computer safe.
A security hole is a weakness in software. Hackers can use it to break into your computer.
If you do not fix security holes, hackers can use them. Updates fix these holes. They close the door on hackers.
Imagine your shop has a window that does not lock. A thief can open it and enter. You fix the lock. Now the thief cannot enter. A security hole is like that window. An update fixes the lock.
A small business had an old version of Windows. The version had a security hole. A hacker used it to break in. The business updated Windows. The hole was fixed.
Your school had an old version of its website software. The software had a security hole. A hacker changed the website. The school updated the software. The hole was fixed.
Your family had an old version of a browser. The browser had a security hole. A hacker could see your passwords. Your family updated the browser. The hole was fixed.
A Nigerian business had an old version of its banking app. The app had a security hole. A fraudster could access accounts. The business updated the app. The hole was fixed.
Security Hole
|
V
+-------------------+
| Weakness in |
| Software |
+-------------------+
|
V
+-------------------+
| Hacker Can Enter |
+-------------------+
|
V
+-------------------+
| Update Fixes It |
+-------------------+
|
V
+-------------------+
| Hacker Cannot |
| Enter |
+-------------------+
A security hole is a weakness in software. Hackers use it to break in. Updates fix security holes and keep hackers out.
There are different types of updates. Each type does something different.
Knowing the types of updates helps you understand what they do. It helps you decide which ones to install.
Here are the main types of updates:
| Type of Update | What It Does | Example |
|---|---|---|
| Security Update | Fixes security holes | Fixing a hole that hackers can use |
| Bug Fix Update | Fixes problems in the software | Fixing a crash in an app |
| Feature Update | Adds new features | Adding a new tool to an app |
| Driver Update | Updates software for hardware | Updating a printer driver |
| Firmware Update | Updates software built into a device | Updating a router's firmware |
A small business installs security updates every month. They install bug fix updates when needed. They install feature updates when they want new tools.
Your school installs security updates on all computers. They install bug fix updates when a program crashes.
Your family installs security updates on the home computer. They install driver updates for the printer.
A Nigerian business installs security updates on all systems. They install firmware updates on their routers.
Types of Updates
|
V
+-------------------+
| Security Update |
+-------------------+
|
V
+-------------------+
| Bug Fix Update |
+-------------------+
|
V
+-------------------+
| Feature Update |
+-------------------+
|
V
+-------------------+
| Driver Update |
+-------------------+
|
V
+-------------------+
| Firmware Update |
+-------------------+
Types of updates include security updates, bug fix updates, feature updates, driver updates, and firmware updates.
Automatic updates install by themselves. Manual updates require you to click a button.
Automatic updates are easier. You do not have to remember. Manual updates give you control. You decide when to update.
Imagine you have a robot that cleans your shop. If the robot cleans by itself, that is automatic. If you have to tell the robot to clean, that is manual. Automatic updates are like the robot that cleans by itself.
A small business sets updates to automatic. The computers update themselves. The owner does not have to remember.
Your school sets updates to automatic. The computers update themselves every night.
Your family sets updates to automatic. The home computer updates itself.
A Nigerian business sets updates to automatic. The systems update themselves regularly.
Automatic vs Manual Updates
|
V
+-------------------+ +-------------------+
| AUTOMATIC | | MANUAL |
+-------------------+ +-------------------+
| - Updates itself | | - You click button|
| - You do not | | - You decide when |
| remember | | |
+-------------------+ +-------------------+
| |
V V
+-------------------+ +-------------------+
| Easier | | More control |
+-------------------+ +-------------------+
Automatic updates install by themselves. Manual updates require you to click a button. Automatic updates are easier. Manual updates give you more control.
Updating your computer means installing the latest software. It means fixing security holes.
Updates fix security holes. Hackers look for these holes. If you do not update, hackers can get in.
Here is how to update Windows:
Here is how to update macOS:
A small business checks for Windows updates every week. They install updates as soon as they are available.
Your school sets Windows updates to automatic. The computers update themselves.
Your family checks for Windows updates every month. They install updates as soon as they are available.
A Nigerian business updates Windows on all computers. They do this every month.
Updating Windows
|
V
+-------------------+
| Start Button |
+-------------------+
|
V
+-------------------+
| Settings |
+-------------------+
|
V
+-------------------+
| Update & Security|
+-------------------+
|
V
+-------------------+
| Windows Update |
+-------------------+
|
V
+-------------------+
| Check for Updates|
+-------------------+
|
V
+-------------------+
| Install Updates |
+-------------------+
To update your computer, go to Settings, click Update & Security, click Windows Update, check for updates, and install them.
A backup is a copy of your files. You keep the copy in a safe place. If something happens to your files, you can use the backup.
Bad things happen. Your computer can break. A virus can delete your files. A thief can steal your laptop. Ransomware can lock your files. If you have a backup, you can get your files back. If you do not have a backup, your files are gone forever.
Imagine you have a favourite toy. You buy a second one and keep it in a safe place. If you lose the first one, you still have the second one. A backup is like that second toy.
A small business had a backup of all its files. When a virus deleted everything, they restored the files from the backup.
Your school has a backup of all student grades. When a computer broke, they restored the grades from the backup.
Your family has a backup of all photos. When the computer broke, they restored the photos from the backup.
A Nigerian business has a backup of all customer data. When a hacker attacked, they restored the data from the backup.
Backup
|
V
+-------------------+
| Original Files |
+-------------------+
|
V
+-------------------+
| Copy (Backup) |
+-------------------+
|
V
+-------------------+
| If Files Lost, |
| Use Backup |
+-------------------+
A backup is a copy of your files. It saves you from losing everything if something happens to your computer.
The 3-2-1 backup rule is a simple rule for keeping your files safe. It says: keep 3 copies of your files, on 2 different types of storage, with 1 copy off-site.
The 3-2-1 rule protects you from many problems. If one copy is lost, you still have two more.
Here is what the 3-2-1 rule means:
A small business follows the 3-2-1 rule. They have the original files on their computer. They have a backup on an external drive. They have another backup in the cloud.
Your school follows the 3-2-1 rule. They have the original files on the server. They have a backup on an external drive. They have another backup in the cloud.
Your family follows the 3-2-1 rule. They have the original photos on the computer. They have a backup on an external drive. They have another backup in the cloud.
A Nigerian business follows the 3-2-1 rule. They have the original data on their server. They have a backup on an external drive. They have another backup in the cloud.
The 3-2-1 Backup Rule
|
V
+-------------------+
| 3 Copies |
+-------------------+
|
V
+-------------------+
| 2 Types of |
| Storage |
+-------------------+
|
V
+-------------------+
| 1 Off-Site |
+-------------------+
The 3-2-1 backup rule says: keep 3 copies of your files, on 2 different types of storage, with 1 copy off-site.
Making a backup means copying your files to another place. It means saving them so you can get them back if something happens.
If you know how to make a backup, you can protect your files. You can save your customer data, your financial records, and your business documents.
Here is how to make a backup:
A small business backs up its customer data every week. They copy it to an external drive and to the cloud.
Your school backs up student grades every week. They copy them to an external drive and to the cloud.
Your family backs up photos and documents every month. They copy them to an external drive and to the cloud.
A Nigerian business backs up customer data every day. They copy it to an external drive and to the cloud.
How to Make a Backup
|
V
+-------------------+
| 1. Choose Files |
+-------------------+
|
V
+-------------------+
| 2. Choose Where |
+-------------------+
|
V
+-------------------+
| 3. Copy Files |
+-------------------+
|
V
+-------------------+
| 4. Check Backup |
+-------------------+
|
V
+-------------------+
| 5. Do Regularly |
+-------------------+
|
V
+-------------------+
| 6. Keep Safe |
+-------------------+
To make a backup, choose what to back up, choose where to back up, copy the files, check the backup, do it regularly, and keep the backup safe.
Data protection is keeping your business information safe. It means following rules about how to collect, store, and use data.
If you do not protect data, you can be fined. You can lose customers. You can lose trust. Data protection keeps your business safe and legal.
Imagine you have a list of customer names and phone numbers. You keep the list in a locked drawer. Only you can open the drawer. That is data protection.
A small business protects customer data. They use strong passwords. They encrypt the data. They do not share it with anyone.
Your school protects student data. They use strong passwords. They encrypt the data. They do not share it with anyone.
Your family protects personal data. They use strong passwords. They do not share it with strangers.
A Nigerian business protects customer data. They follow NDPR rules. They use strong passwords and encryption.
Data Protection
|
V
+-------------------+
| Keep Data Safe |
+-------------------+
|
V
+-------------------+
| Follow Rules |
+-------------------+
|
V
+-------------------+
| Use Passwords |
| and Encryption |
+-------------------+
|
V
+-------------------+
| Do Not Share |
+-------------------+
Data protection is keeping your business information safe. It means following rules about how to collect, store, and use data.
NDPR stands for Nigeria Data Protection Regulation. It is a law in Nigeria that protects people's data.
NDPR is important because it protects Nigerian citizens. It says that companies must protect personal data. If they do not, they can be fined.
NDPR says:
A small business follows NDPR. They protect customer data. They tell customers what data they collect. They report data breaches.
Your school follows NDPR. They protect student data. They tell parents what data they collect. They report data breaches.
Your family follows NDPR. They protect their personal data. They are careful what they share.
A Nigerian business follows NDPR. They protect customer data. They report data breaches to NITDA.
NDPR - Nigeria Data Protection Regulation
|
V
+-------------------+
| Collect Lawfully |
+-------------------+
|
V
+-------------------+
| Protect Data |
+-------------------+
|
V
+-------------------+
| Tell People |
+-------------------+
|
V
+-------------------+
| Report Breaches |
+-------------------+
|
V
+-------------------+
| Respect Rights |
+-------------------+
NDPR is a Nigerian law that protects personal data. Companies must collect data lawfully, protect data, tell people what data they collect, report breaches, and respect people's rights.
Protecting customer data means keeping it safe from hackers and other people. It means following good security practices.
If you do not protect customer data, you can be fined. You can lose customers. You can lose trust. Protecting data keeps your business safe and legal.
Here is how to protect customer data:
A small business protects customer data. They use strong passwords. They encrypt the data. They train staff. Their data is safe.
Your school protects student data. They use strong passwords. They encrypt the data. They train teachers. Their data is safe.
Your family protects personal data. They use strong passwords. They do not share it with strangers. Their data is safe.
A Nigerian business protects customer data. They use strong passwords. They encrypt the data. They train staff. Their data is safe.
How to Protect Customer Data
|
V
+-------------------+
| Strong Passwords |
+-------------------+
|
V
+-------------------+
| Encryption |
+-------------------+
|
V
+-------------------+
| 2FA |
+-------------------+
|
V
+-------------------+
| Limit Access |
+-------------------+
|
V
+-------------------+
| Back Up Data |
+-------------------+
|
V
+-------------------+
| Train Staff |
+-------------------+
|
V
+-------------------+
| Do Not Share |
+-------------------+
|
V
+-------------------+
| Report Breaches |
+-------------------+
To protect customer data, use strong passwords, use encryption, use 2FA, limit access, back up data, train staff, do not share data, and report breaches immediately.
Updates, backups, and data protection are used all over the world, including in Nigeria. Here are some Nigerian examples.
Seeing examples from Nigeria helps you understand how these practices work in your own country.
Here are some Nigerian examples:
A Nigerian bank updates its banking app every month. They also install patches. Customers are safe from fraud.
A Nigerian school updates its computers every month. They also install patches. Student data is safe.
A Nigerian family updates its home computer every month. They also install patches. Their data is safe.
NITDA updates its software every month. They also install patches. Government systems are safe.
Nigerian Updates, Backups, and Data Protection
+------------------------------------------+
| Banks: Updates, patches, backups |
| Telecoms: Updates, patches, backups |
| Government: Updates, patches, backups |
| Schools: Updates, patches, backups |
| Businesses: Updates, patches, backups |
+------------------------------------------+
Nigerian banks, telecoms, government agencies, schools, and businesses all use updates, backups, and data protection to stay safe.
Updates, backups, and data protection can be explained using fun examples that children understand.
When you use fun examples, learning becomes easier and more enjoyable.
Here are some fun examples:
Imagine you are playing a game. Your character gets hurt. You use a health pack. That is like an update. It fixes the problem.
Your teacher gives you a new book. It has more information. That is like an update. It gives you new things.
Your family fixes a leaking tap. That is like a patch. It fixes a small problem.
In a Nigerian football match, the coach changes tactics. That is like an update. It fixes a problem.
Fun Updates, Backups, and Data Protection
+------------------------------------------+
| Video Game: New armour |
| Football: Practice new skills |
| Social Media: Update profile |
| School: Learn new things |
| Cooking: Fix recipe |
+------------------------------------------+
Updates, backups, and data protection are everywhere. They are in video games, football, social media, school, and cooking. They fix problems and add new things.
A plan is a set of rules you follow to keep your business safe.
A plan helps you remember what to do. It helps you stay safe.
A plan has these parts:
A small business creates a plan. They set updates to automatic. They back up files every week. They protect customer data. They train staff. Their business stays safe.
A school creates a plan. They set updates to automatic. They back up student grades every week. They protect student data. They train teachers. Their school stays safe.
A family creates a plan. They set updates to automatic. They back up photos every month. They protect personal data. They train family members. Their home stays safe.
A Nigerian business creates a plan. They set updates to automatic. They back up customer data every day. They protect customer data. They train staff. Their business stays safe.
Updates, Backups, and Data Protection Plan
|
V
+-------------------+
| Updates |
+-------------------+
|
V
+-------------------+
| Backups |
+-------------------+
|
V
+-------------------+
| Data Protection |
+-------------------+
|
V
+-------------------+
| Training |
+-------------------+
|
V
+-------------------+
| Review |
+-------------------+
A plan includes updates, backups, data protection, training, and review.
| Word | Simple Definition |
|---|---|
| Update | A new version of software that fixes problems and security holes |
| Patch | A small update that fixes a specific problem |
| Security Hole | A weakness in software that hackers can use |
| Vulnerability | Another word for security hole |
| Automatic Update | An update that installs by itself |
| Manual Update | An update that you install by clicking a button |
| Backup | A copy of your files kept in a safe place |
| Data Recovery | Getting your files back after they are lost |
| 3-2-1 Rule | Keep 3 copies, on 2 types of storage, with 1 off-site |
| External Drive | A storage device you connect to your computer |
| Cloud Storage | A way to store files on the internet |
| Data Protection | Keeping your business information safe |
| NDPR | Nigeria Data Protection Regulation |
| Data Breach | When private information is stolen |
| Encryption | Scrambling information so hackers cannot read it |
A small shop in Lagos updates its software every month. They back up their files every week. They protect customer data. Their business is safe.
A small school in Abuja updates its computers every month. They back up student grades every week. They protect student data. Their school is safe.
A family business in Port Harcourt updates its home computer every month. They back up photos every month. They protect personal data. Their home is safe.
Banks like GTBank, Zenith, and Access Bank update their software regularly. They also install patches. This keeps customer data safe.
Companies like MTN, Glo, and Airtel update their network software. They also install patches. This keeps their networks safe.
NITDA updates its software regularly. They also install patches. This keeps government systems safe.
Schools like Covenant University and University of Lagos update their computers. They also install patches. This keeps student data safe.
Companies like Jumia and Konga update their software. They also install patches. This keeps customer data safe.
In a video game, you update your character with new armour and weapons. Updates for your computer give it new protection.
In football, you practice new skills. Updates are like practice. They make your computer better.
On social media, you update your profile. Software updates update your computer.
In school, you learn new things. Updates teach your computer new things.
The leak is a problem. Fixing it is a patch.
The tear is a problem. Mending it is a patch.
The broken bulb is a problem. Replacing it is an update.
The dull knife is a problem. Sharpening it is an update.
The cold is a problem. Medicine is a patch.
+-------------------+
| Software Has |
| Security Hole |
+-------------------+
|
V
+-------------------+
| Company Releases |
| Update/Patch |
+-------------------+
|
V
+-------------------+
| You Install |
| Update/Patch |
+-------------------+
|
V
+-------------------+
| Security Hole |
| is Fixed |
+-------------------+
|
V
+-------------------+
| Back Up Your |
| Files |
+-------------------+
|
V
+-------------------+
| Protect Customer |
| Data |
+-------------------+
|
V
+-------------------+
| Business Safe |
+-------------------+
Day 1: Company finds security hole
|
V
Day 2: Company creates patch
|
V
Day 3: Company releases patch
|
V
Day 4: You receive notification
|
V
Day 5: You install patch
|
V
Day 6: Security hole is fixed
|
V
Day 7: Computer safe
| Task | Done? |
|---|---|
| Updates set to automatic | Yes / No |
| Windows updated | Yes / No |
| macOS updated | Yes / No |
| Linux updated | Yes / No |
| Apps updated | Yes / No |
| Browsers updated | Yes / No |
| Backups made regularly | Yes / No |
| 3-2-1 rule followed | Yes / No |
| Customer data protected | Yes / No |
| NDPR followed | Yes / No |
| Feature | Automatic Updates | Manual Updates |
|---|---|---|
| Who installs? | Computer | You |
| Ease | Very easy | Needs action |
| Control | Less control | More control |
| Safety | Always up to date | You must remember |
| Feature | Update | Patch |
|---|---|---|
| Size | Large | Small |
| What it does | Fixes many things | Fixes one thing |
| Frequency | Less often | More often |
| Example | New version of Windows | Fix for a security hole |
An update is a new version of software that fixes problems and security holes. Updating your computer keeps it safe from hackers.
A patch is a small update that fixes a specific problem. It is like a bandage for a cut. Patches keep your computer safe.
A security hole is a weakness in software. Hackers use it to break in. Updates fix security holes and keep hackers out.
Types of updates include security updates, bug fix updates, feature updates, driver updates, and firmware updates.
Automatic updates install by themselves. Manual updates require you to click a button. Automatic updates are easier. Manual updates give you more control.
To update your computer, go to Settings, click Update & Security, click Windows Update, check for updates, and install them.
A backup is a copy of your files. It saves you from losing everything if something happens to your computer.
The 3-2-1 backup rule says: keep 3 copies of your files, on 2 different types of storage, with 1 copy off-site.
To make a backup, choose what to back up, choose where to back up, copy the files, check the backup, do it regularly, and keep the backup safe.
Data protection is keeping your business information safe. It means following rules about how to collect, store, and use data.
NDPR is a Nigerian law that protects personal data. Companies must collect data lawfully, protect data, tell people what data they collect, report breaches, and respect people's rights.
To protect customer data, use strong passwords, use encryption, use 2FA, limit access, back up data, train staff, do not share data, and report breaches immediately.
Nigerian banks, telecoms, government agencies, schools, and businesses all use updates, backups, and data protection to stay safe.
Updates, backups, and data protection are everywhere. They are in video games, football, social media, school, and cooking. They fix problems and add new things.
A plan includes updates, backups, data protection, training, and review.
Congratulations! You have completed Module Six: Updates, Backups, and Data Protection.
In this module, you learned that an update is a new version of software. It fixes problems and security holes.
You learned that a patch is a small update. It fixes a specific problem.
You learned that a security hole is a weakness in software. Hackers use it to break in.
You learned that updates fix security holes. They keep hackers out.
You learned about the types of updates: security updates, bug fix updates, feature updates, driver updates, and firmware updates.
You learned about automatic updates and manual updates.
You learned how to update your computer.
You learned that a backup is a copy of your files. It saves you from losing everything.
You learned about the 3-2-1 backup rule.
You learned how to make a backup.
You learned about data protection. It is keeping your business information safe.
You learned about NDPR, the Nigeria Data Protection Regulation.
You learned how to protect customer data.
You learned about Nigerian examples of updates, backups, and data protection.
You learned about fun examples and everyday examples.
You learned how to build a plan for updates, backups, and data protection.
You are now an Updates, Backups, and Data Protection expert in training!
An update is a new version of software that fixes problems and security holes.
A patch is a small update that fixes a specific problem.
Updates fix security holes. They keep hackers out. If you do not update, hackers can get in.
A backup is a copy of your files. It saves you from losing everything.
The 3-2-1 backup rule says: keep 3 copies of your files, on 2 different types of storage, with 1 copy off-site.
Data protection is keeping your business information safe. It means following rules about how to collect, store, and use data.
NDPR stands for Nigeria Data Protection Regulation. It is a Nigerian law that protects personal data.
Use strong passwords, use encryption, use 2FA, limit access, back up data, train staff, do not share data, and report breaches immediately.
Nigerian banks, telecoms, and government agencies update their software regularly and back up their data every day.
Yes! You can use updates and backups to protect your own computer and files.
| Word | Definition |
|---|---|
| 1. Update | A. A small update that fixes a specific problem |
| 2. Patch | B. A weakness in software that hackers can use |
| 3. Security Hole | C. A new version of software that fixes problems |
| 4. Automatic Update | D. A copy of your files kept in a safe place |
| 5. Backup | E. An update that installs by itself |
| 6. 3-2-1 Rule | F. Keeping your business information safe |
| 7. Data Protection | G. Keep 3 copies, on 2 types of storage, with 1 off-site |
| 8. NDPR | H. Nigeria Data Protection Regulation |
Answers: 1-C, 2-A, 3-B, 4-E, 5-D, 6-G, 7-F, 8-H
Your business computer is very slow. It keeps asking you to update.
Question: What should you do?
Answer: You should update your computer. Go to Settings, click Update & Security, click Windows Update, check for updates, and install them.
A virus deleted all your business files. You do not have a backup.
Question: What should you have done?
Answer: You should have made a backup. You should have followed the 3-2-1 rule. You should have copied your files to an external drive and to the cloud.
A hacker stole customer data from your business.
Question: What should you do?
Answer: You should report the breach to NITDA immediately. You should also tell your customers. You should improve your security.
Instructions:
Time: 30 minutes
Instructions:
Goal: Create a dashboard that shows how well your class protects their files and data.
Steps:
Time: 2 weeks
Instructions:
In Module Seven, you will learn about Incident Response for Small Businesses.
You will learn:
To prepare for Module Seven, think about these questions:
See you in Module Seven!
End of Module Six
Welcome to Module Seven of the Cybersecurity for Small Businesses course!
In Module One, you learned what cyber security is and why it matters for small businesses. You learned about hackers, malware, phishing, and ransomware.
In Module Two, you learned about passwords and access control. You learned how to create strong passwords and how to control who sees what.
In Module Three, you learned about phishing, scams, and social engineering. You learned how bad people trick you into giving them your information.
In Module Four, you learned about malware, antivirus, and safe browsing. You learned how to protect your computer from bad software.
In Module Five, you learned about network and Wi-Fi security. You learned how to keep your business network safe.
In Module Six, you learned about updates, backups, and data protection. You learned how to protect your files and customer data.
Now, in Module Seven, you are going to learn about incident response for small businesses.
What is an incident?
An incident is something bad that happens. In cyber security, an incident is when a hacker breaks in, a virus infects a computer, or data is stolen.
What is incident response?
Incident response is what we do when an incident happens. It is our plan for dealing with the problem. It is how we detect the incident, stop it, fix it, and recover.
Imagine you have a small shop. Suddenly, a fire starts in the store room. What do you do? You do not panic. You follow your fire plan. You call the fire service. You evacuate the shop. You stay calm. Incident response is the same. It is your plan for dealing with cyber incidents.
Why is incident response important for small businesses?
Bad things happen. Your computer can get a virus. A hacker can break in. Your files can be stolen. If you have a plan, you can handle the incident calmly. If you do not have a plan, you will panic. You might make mistakes. You might lose everything.
Think about it this way. Your business is like a house. An incident is like a fire. If you have a fire plan, you know what to do. You call the fire service. You leave the house. You stay calm. Incident response is like a fire plan for your business.
In this module, you will learn all about incident response for small businesses. You will learn what an incident is. You will learn the signs of an incident. You will learn the steps to take. You will learn how to recover. You will learn how to learn from the incident.
By the end of this module, you will be an incident response expert. You will know how to handle any cyber incident in your business.
Let us begin this exciting journey together!
After completing this module, you will be able to:
Once upon a time, in the city of Ibadan, Nigeria, there was a small shop called Mama Ngozi's Fashion Shop. Mama Ngozi sold beautiful clothes, shoes, and bags.
One day, Mama Ngozi's son, Chidi, came to visit. He said, "Mama, we need a fire plan. If there is a fire, we need to know what to do."
Mama Ngozi was confused. "What is a fire plan?" she asked.
Chidi explained. "A fire plan is a set of rules. It tells us what to do if there is a fire."
They made a plan. They decided:
They practiced the plan every month. They called it a fire drill.
One day, a fire started in the store room. The alarm sounded. Mama Ngozi and her workers did not panic. They followed the plan. They left the shop. They met at the big tree. Mama Ngozi called the fire service. Everyone was safe.
The fire service came. They put out the fire. They said, "You did a great job. Your fire plan saved lives."
Mama Ngozi called a meeting. She said, "Today, we faced an incident. But we were prepared. We had a plan. We followed the plan. We stayed calm. We survived."
That evening, Mama Ngozi told her children, "Preparation is key. If you prepare for an incident, you can handle it. If you do not prepare, you will panic."
Her children understood. They decided to make a plan for their own computer incidents.
And that is exactly what you will learn in this module.
An incident is something bad that happens. In cyber security, an incident is when a hacker breaks in, a virus infects a computer, or data is stolen.
If you do not know what an incident is, you cannot respond to it. Knowing what an incident is helps you prepare.
Imagine you are riding your bike. Suddenly, the tire goes flat. That is an incident. It is something bad that happened. You need to fix it. In cyber security, an incident is the same. It is something bad that happened to your business.
A small shop has an incident when a hacker steals customer money. A small clinic has an incident when a virus locks patient records.
Your school has an incident when a computer gets a virus. Your school has an incident when someone hacks the school website.
Your home has an incident when your Wi-Fi is hacked. Your home has an incident when your phone gets a virus.
A Nigerian business has an incident when fraudsters steal money. A Nigerian online store has an incident when customer data is stolen.
What is an Incident?
|
V
+-------------------+
| Something Bad |
| Happens |
+-------------------+
|
V
+-------------------+
| Harm is Caused |
+-------------------+
|
V
+-------------------+
| You Need to |
| Respond |
+-------------------+
An incident is something bad that happens. In cyber security, it is when a hacker breaks in, a virus infects a computer, or data is stolen.
Incident response is what we do when an incident happens. It is our plan for dealing with the problem. It is how we detect the incident, stop it, fix it, and recover.
If you do not have a plan, you will panic. If you panic, you might make mistakes. A good incident response plan helps you stay calm and fix the problem quickly.
Imagine there is a fire in your shop. What do you do? You do not panic. You follow your fire plan. You call the fire service. You leave the shop. You stay calm. Incident response is the same. It is your plan for dealing with cyber incidents.
A small business has an incident response plan. When a hacker attacks, they follow the plan. They detect the attack. They stop the attack. They fix the damage. They recover. They learn.
Your school has an incident response plan. When a virus infects the computers, they follow the plan. They disconnect the computers. They remove the virus. They restore the files. They learn.
Your family has an incident response plan. When your Wi-Fi is hacked, they follow the plan. They change the password. They check the devices. They learn.
A Nigerian business has an incident response plan. When fraudsters attack, they follow the plan. They block the transactions. They alert customers. They recover the money. They learn.
What is Incident Response?
|
V
+-------------------+
| Incident Happens |
+-------------------+
|
V
+-------------------+
| Follow the Plan |
+-------------------+
|
V
+-------------------+
| Detect, Stop, |
| Fix, Recover |
+-------------------+
|
V
+-------------------+
| Learn and Improve|
+-------------------+
Incident response is what we do when an incident happens. It is our plan for dealing with the problem.
Incident response has several phases. Each phase is a step in the process.
If you follow the phases, you can handle any incident. You will not forget anything. You will not panic.
Here are the phases of incident response:
| Phase | What It Means |
|---|---|
| 1. Preparation | Get ready before an incident happens |
| 2. Detection | Notice that an incident has happened |
| 3. Containment | Stop the incident from spreading |
| 4. Eradication | Remove the cause of the incident |
| 5. Recovery | Restore normal operations |
| 6. Learning | Learn from the incident and improve |
A small business follows these phases. They prepare by training staff. They detect attacks using monitoring tools. They contain attacks by disconnecting systems. They eradicate attacks by removing malware. They recover by restoring data. They learn by writing reports.
Your school follows these phases. They prepare by teaching students. They detect viruses using antivirus. They contain viruses by disconnecting computers. They eradicate viruses by cleaning them. They recover by restoring files. They learn by writing reports.
Your family follows these phases. They prepare by using strong passwords. They detect problems by checking devices. They contain problems by disconnecting from Wi-Fi. They eradicate problems by removing viruses. They recover by restoring data. They learn by talking about what happened.
A Nigerian business follows these phases. They prepare by training staff. They detect fraud using monitoring tools. They contain fraud by blocking transactions. They eradicate fraud by removing the fraudster. They recover by returning money. They learn by writing reports.
Phases of Incident Response
|
V
+-------------------+
| 1. Preparation |
+-------------------+
|
V
+-------------------+
| 2. Detection |
+-------------------+
|
V
+-------------------+
| 3. Containment |
+-------------------+
|
V
+-------------------+
| 4. Eradication |
+-------------------+
|
V
+-------------------+
| 5. Recovery |
+-------------------+
|
V
+-------------------+
| 6. Learning |
+-------------------+
Incident response has six phases: preparation, detection, containment, eradication, recovery, and learning.
Preparation is getting ready before an incident happens. It is the first phase of incident response.
If you are not prepared, you will panic. If you are prepared, you can handle the incident calmly.
Imagine you are going on a trip. You pack your bags. You check the weather. You plan your route. That is preparation. In cyber security, preparation means having a plan, training people, and using good tools.
A small business prepares by training staff, installing firewalls, and making backups. They also practice incident response drills.
Your school prepares by teaching students about cyber security, installing antivirus, and making backups.
Your family prepares by using strong passwords, updating software, and making backups.
A Nigerian business prepares by training staff, using fraud detection tools, and making backups.
Preparation
|
V
+-------------------+
| Make a Plan |
+-------------------+
|
V
+-------------------+
| Train People |
+-------------------+
|
V
+-------------------+
| Use Good Tools |
+-------------------+
|
V
+-------------------+
| Practice Drills |
+-------------------+
Preparation is getting ready before an incident happens. It means having a plan, training people, and using good tools.
Detection is noticing that an incident has happened. It is the second phase of incident response.
The faster you detect an incident, the faster you can respond. If you do not detect it, the damage can get worse.
Imagine you are in a room and you smell smoke. You detect that there is a fire. If you did not smell the smoke, you might not know about the fire. In cyber security, detection means noticing that something is wrong.
A small business detects an attack when their monitoring tools alert them. They also detect attacks when customers report fraud.
Your school detects a virus when antivirus software alerts them. They also detect a virus when computers start acting strangely.
Your family detects a problem when the Wi-Fi is slow. They also detect a problem when they receive strange messages.
A Nigerian business detects fraud when their monitoring tools alert them. They also detect fraud when customers call to report strange transactions.
Detection
|
V
+-------------------+
| Something is |
| Wrong |
+-------------------+
|
V
+-------------------+
| You Notice It |
+-------------------+
|
V
+-------------------+
| You Confirm It |
+-------------------+
|
V
+-------------------+
| You Report It |
+-------------------+
Detection is noticing that an incident has happened. The faster you detect it, the faster you can respond.
Containment is stopping the incident from spreading. It is the third phase of incident response.
If you do not contain the incident, it can spread and cause more damage. Containment limits the damage.
Imagine there is a fire in one room. You close the door to stop the fire from spreading to other rooms. That is containment. In cyber security, containment means stopping the attack from spreading to other computers.
A small business contains an attack by disconnecting affected computers from the network. They also block the hacker's access.
Your school contains a virus by disconnecting infected computers from the network. They also stop students from using those computers.
Your family contains a problem by disconnecting from Wi-Fi. They also change the Wi-Fi password.
A Nigerian business contains fraud by blocking the fraudster's account. They also stop all transactions from that account.
Containment
|
V
+-------------------+
| Incident Happens |
+-------------------+
|
V
+-------------------+
| Stop It From |
| Spreading |
+-------------------+
|
V
+-------------------+
| Disconnect, Block|
+-------------------+
|
V
+-------------------+
| Limit the Damage |
+-------------------+
Containment is stopping the incident from spreading. It limits the damage.
Eradication is removing the cause of the incident. It is the fourth phase of incident response.
If you do not remove the cause, the incident can happen again. Eradication fixes the problem.
Imagine you have weeds in your garden. You pull them out. That is eradication. In cyber security, eradication means removing the virus, deleting the malware, or fixing the weakness.
A small business eradicates an attack by removing the malware from their computers. They also fix the weakness that allowed the attack.
Your school eradicates a virus by cleaning the infected computers. They also update the antivirus software.
Your family eradicates a problem by removing the virus from your phone. They also update the phone's software.
A Nigerian business eradicates fraud by closing the fraudster's account. They also improve their fraud detection system.
Eradication
|
V
+-------------------+
| Find the Cause |
+-------------------+
|
V
+-------------------+
| Remove the Cause |
+-------------------+
|
V
+-------------------+
| Fix the Weakness |
+-------------------+
|
V
+-------------------+
| Prevent It From |
| Happening Again |
+-------------------+
Eradication is removing the cause of the incident. It fixes the problem and prevents it from happening again.
Recovery is restoring normal operations. It is the fifth phase of incident response.
After an incident, you need to get back to normal. Recovery helps you do that.
Imagine you were sick. You took medicine. Now you need to rest and get better. That is recovery. In cyber security, recovery means restoring files, fixing computers, and getting back to work.
A small business recovers by restoring data from backups. They also check that all systems are working properly.
Your school recovers by restoring files from backups. They also check that all computers are working.
Your family recovers by restoring data from backups. They also check that all devices are working.
A Nigerian business recovers by returning money to customers. They also check that all systems are working.
Recovery
|
V
+-------------------+
| Restore Files |
+-------------------+
|
V
+-------------------+
| Fix Computers |
+-------------------+
|
V
+-------------------+
| Check Systems |
+-------------------+
|
V
+-------------------+
| Get Back to Work |
+-------------------+
Recovery is restoring normal operations. It means restoring files, fixing computers, and getting back to work.
Learning is studying the incident and improving. It is the sixth phase of incident response.
If you do not learn from an incident, it can happen again. Learning helps you get better.
Imagine you failed a test. You study the questions you got wrong. You learn from your mistake. That is learning. In cyber security, learning means writing a report, finding out what went wrong, and improving.
A small business learns from an incident by writing a report. They find out how the hacker got in. They improve their security.
Your school learns from an incident by writing a report. They find out how the virus got in. They teach students about it.
Your family learns from an incident by talking about it. They find out how the problem happened. They change their habits.
A Nigerian business learns from an incident by writing a report. They find out how the fraud happened. They improve their fraud detection system.
Learning
|
V
+-------------------+
| Write a Report |
+-------------------+
|
V
+-------------------+
| Find Out What |
| Went Wrong |
+-------------------+
|
V
+-------------------+
| Improve |
+-------------------+
|
V
+-------------------+
| Prevent It From |
| Happening Again |
+-------------------+
Learning is studying the incident and improving. It helps prevent the incident from happening again.
Signs of an attack are things you notice when your business has been attacked. They tell you something is wrong.
If you know the signs, you can detect an incident early. You can remove the malware before it causes more damage.
Here are signs your business has been attacked:
A small business owner noticed their computer was very slow. They ran an antivirus scan. It found a virus. They removed it.
A school noticed pop-up ads on all computers. They ran an antivirus scan. It found adware. They removed it.
A family noticed their photos were missing. They ran an antivirus scan. It found a virus. They restored from backup.
A Nigerian business noticed its computers were crashing often. They ran an antivirus scan. It found ransomware. They restored from backup.
Signs Your Business Has Been Attacked
|
V
+-------------------+
| Slow Computer |
+-------------------+
|
V
+-------------------+
| Pop-Up Ads |
+-------------------+
|
V
+-------------------+
| Missing Files |
+-------------------+
|
V
+-------------------+
| Frequent Crashes |
+-------------------+
Signs your business has been attacked include a slow computer, pop-up ads, missing files, frequent crashes, and antivirus problems.
Steps to take means what you should do when you notice an attack. It means following the incident response phases.
If you know the steps, you can handle the attack calmly. You can remove the malware and recover your files.
Here are the steps to take when your business is attacked:
A small business computer was infected. They disconnected from the internet. They ran an antivirus scan. They removed the malware. They changed their passwords. They restored their files.
A school's computers were infected. They disconnected from the internet. They ran an antivirus scan. They removed the malware. They changed passwords. They restored files.
A family's computer was infected. They disconnected from the internet. They ran an antivirus scan. They removed the malware. They changed passwords. They restored files.
A Nigerian business's computers were infected. They disconnected from the internet. They ran an antivirus scan. They removed the malware. They changed passwords. They restored files.
Steps to Take When Your Business is Attacked
|
V
+-------------------+
| 1. Stay Calm |
+-------------------+
|
V
+-------------------+
| 2. Disconnect |
+-------------------+
|
V
+-------------------+
| 3. Scan |
+-------------------+
|
V
+-------------------+
| 4. Remove |
+-------------------+
|
V
+-------------------+
| 5. Restart |
+-------------------+
|
V
+-------------------+
| 6. Change |
| Passwords |
+-------------------+
|
V
+-------------------+
| 7. Restore Files |
+-------------------+
|
V
+-------------------+
| 8. Learn |
+-------------------+
When your business is attacked, stay calm, disconnect from the internet, run an antivirus scan, remove the malware, restart, change passwords, restore files, and learn from the incident.
Calling a professional means asking an expert for help. It means knowing when the problem is too big for you.
Some incidents are very serious. You might not be able to fix them alone. A professional can help.
Here is when to call a professional:
A small business computer was infected with ransomware. They could not remove it. They called a professional. The professional removed the ransomware.
A school's computers were infected with a virus. They could not remove it. They called a professional. The professional removed the virus.
A family's computer would not start. They called a professional. The professional fixed it.
A Nigerian business's data was locked by ransomware. They called a professional. The professional recovered the data.
When to Call a Professional
|
V
+-------------------+
| Cannot Remove |
| Malware |
+-------------------+
|
V
+-------------------+
| Files Locked |
+-------------------+
|
V
+-------------------+
| Computer Won't |
| Start |
+-------------------+
|
V
+-------------------+
| Data Lost |
+-------------------+
|
V
+-------------------+
| Call Professional|
+-------------------+
Call a professional when you cannot remove malware, when files are locked, when your computer will not start, when data is lost, or when you are not sure what to do.
Incident response is used all over the world, including in Nigeria. Here are some Nigerian examples.
Seeing examples from Nigeria helps you understand how incident response works in your own country.
Here are some Nigerian examples:
A Nigerian business might report: "Last month, we detected a fraud incident in 10 minutes. We contained it in 30 minutes. We eradicated it in 1 hour. We recovered in 4 hours. We learned and improved."
A Nigerian school might report: "Last term, we detected a virus in 20 minutes. We contained it in 1 hour. We eradicated it in 2 hours. We recovered in 5 hours. We learned and improved."
A Nigerian family might report: "Last month, we detected a Wi-Fi problem in 1 hour. We contained it in 2 hours. We eradicated it in 3 hours. We recovered in 1 day. We learned and improved."
NITDA might report: "Last year, we detected 100 attacks. We contained 95. We eradicated 95. We recovered 95. We learned and improved."
Nigerian Incident Response
+------------------------------------------+
| Banks: Fraud response |
| Telecoms: SIM fraud response |
| Government: Cyber attack response |
| Schools: Data breach response |
| Businesses: Fake order response |
+------------------------------------------+
Nigerian banks, telecoms, government agencies, schools, and businesses all use incident response to stay safe.
Incident response can be explained using fun examples that children understand.
When you use fun examples, learning becomes easier and more enjoyable.
Here are some fun examples:
Imagine you are playing a game where you have to protect a castle. The enemy breaks through the gate. You do not panic. You send soldiers to the gate. You fix the gate. You recover. You learn. That is incident response.
Your teacher gives a pop quiz. You are not prepared. You do not panic. You answer the questions you know. You learn from the experience. That is incident response.
Your phone battery dies. You do not panic. You charge it. That is incident response.
In a Nigerian football match, the coach sees the other team scoring. He changes the formation. He substitutes a player. That is incident response.
Fun Incident Response
+------------------------------------------+
| Video Game: Use health pack |
| Football: Change tactics |
| Social Media: Change password |
| School: Study harder |
| Cooking: Start again |
+------------------------------------------+
Incident response is everywhere. It is in video games, football, social media, school, and cooking. Cyber security incident response is just another type.
An incident response plan is a document that explains what to do when an incident happens.
A plan helps you stay calm. It helps you remember what to do. It helps you respond quickly.
An incident response plan has these parts:
A small business's incident response plan includes:
Your school's incident response plan includes:
Your family's incident response plan includes:
A Nigerian business's incident response plan includes:
Incident Response Plan
|
V
+-------------------+
| Team |
+-------------------+
|
V
+-------------------+
| Phases |
+-------------------+
|
V
+-------------------+
| Tools |
+-------------------+
|
V
+-------------------+
| Metrics |
+-------------------+
|
V
+-------------------+
| Communication |
+-------------------+
|
V
+-------------------+
| Review |
+-------------------+
An incident response plan explains who is responsible, what the phases are, what tools to use, how to measure success, who to communicate with, and when to review.
| Word | Simple Definition |
|---|---|
| Incident | Something bad that happens |
| Incident Response | What we do when an incident happens |
| Preparation | Getting ready before an incident |
| Detection | Noticing that an incident has happened |
| Containment | Stopping the incident from spreading |
| Eradication | Removing the cause of the incident |
| Recovery | Restoring normal operations |
| Learning | Studying the incident and improving |
| Malware | Bad software that harms your computer |
| Virus | A type of malware that attaches to files and spreads |
| Ransomware | Bad software that locks your files and asks for money |
| Antivirus | Software that protects your computer from malware |
| Backup | A copy of your files kept in a safe place |
| Professional | An expert who can help you |
| MTTD | Mean Time to Detect - how fast you notice an incident |
A small shop in Lagos uses incident response to handle fraud. They detect fraud in 10 minutes. They contain it in 30 minutes. They eradicate it in 1 hour. They recover in 4 hours. They learn and improve.
A small school in Abuja uses incident response to handle viruses. They detect viruses in 20 minutes. They contain them in 1 hour. They eradicate them in 2 hours. They recover in 5 hours. They learn and improve.
A family business in Port Harcourt uses incident response to handle Wi-Fi problems. They detect problems in 1 hour. They contain them in 2 hours. They eradicate them in 3 hours. They recover in 1 day. They learn and improve.
Banks like GTBank, Zenith, and Access Bank use incident response to handle fraud. They detect, contain, eradicate, recover, and learn.
Companies like MTN, Glo, and Airtel use incident response to handle SIM card fraud. They detect, contain, eradicate, recover, and learn.
NITDA uses incident response to handle cyber attacks. They detect, contain, eradicate, recover, and learn.
Schools like Covenant University and University of Lagos use incident response to handle data breaches. They detect, contain, eradicate, recover, and learn.
Companies like Jumia and Konga use incident response to handle fake orders. They detect, contain, eradicate, recover, and learn.
In a video game, if your character gets hurt, you use a health pack. That is incident response.
In football, if the other team scores, you change your tactics. That is incident response.
On social media, if your account is hacked, you change your password and report it. That is incident response.
In school, if you fail a test, you study harder. That is incident response.
The incident is losing your keys. You detect it. You contain it by checking your pockets. You eradicate it by finding the keys. You recover by using the keys. You learn by keeping them in a safe place.
The incident is getting sick. You detect it. You contain it by resting. You eradicate it by taking medicine. You recover by getting better. You learn by taking care of your health.
The incident is missing the bus. You detect it. You contain it by finding another bus. You eradicate it by getting on the bus. You recover by arriving at school. You learn by leaving earlier next time.
The incident is breaking a glass. You detect it. You contain it by not stepping on the glass. You eradicate it by cleaning it up. You recover by using a new glass. You learn by being more careful.
The incident is forgetting your homework. You detect it. You contain it by telling your teacher. You eradicate it by doing the homework. You recover by submitting it late. You learn by checking your bag before school.
+-------------------+
| Preparation |
+-------------------+
|
V
+-------------------+
| Detection |
+-------------------+
|
V
+-------------------+
| Containment |
+-------------------+
|
V
+-------------------+
| Eradication |
+-------------------+
|
V
+-------------------+
| Recovery |
+-------------------+
|
V
+-------------------+
| Learning |
+-------------------+
|
V
+-------------------+
| Improve |
+-------------------+
Past Present Future
| | |
V V V
+----------------+ +----------------+ +----------------+
| Preparation | | Detection | | Recovery |
+----------------+ +----------------+ +----------------+
| | |
V V V
+----------------+ +----------------+ +----------------+
| Train, Plan, | | Notice, Report,| | Restore, Fix, |
| Backup | | Confirm | | Learn |
+----------------+ +----------------+ +----------------+
| Metric | What It Measures | Example |
|---|---|---|
| MTTD | How fast you notice an incident | 15 minutes |
| MTTR | How fast you respond to an incident | 30 minutes |
| MTTC | How fast you stop an incident from spreading | 1 hour |
| MTTE | How fast you remove the cause | 2 hours |
| MTTR | How fast you restore normal operations | 6 hours |
| Number of Incidents | How many incidents happened | 10 |
| Number Resolved | How many incidents were fixed | 10 |
| Cost of Incidents | How much money was lost | 5 million naira |
| Feature | Good | Bad |
|---|---|---|
| Preparation | Prepared with a plan | Not prepared |
| Detection | Detects quickly | Detects slowly |
| Containment | Contains quickly | Does not contain |
| Eradication | Removes the cause | Does not remove the cause |
| Recovery | Recovers quickly | Recovers slowly |
| Learning | Learns and improves | Does not learn |
| Phase | What It Means | Example |
|---|---|---|
| Preparation | Getting ready | Training staff, making backups |
| Detection | Noticing an incident | Antivirus alerts, customer reports |
| Containment | Stopping the spread | Disconnecting computers |
| Eradication | Removing the cause | Deleting malware |
| Recovery | Restoring normal | Restoring files |
| Learning | Improving | Writing reports |
An incident is something bad that happens. In cyber security, it is when a hacker breaks in, a virus infects a computer, or data is stolen.
Incident response is what we do when an incident happens. It is our plan for dealing with the problem.
Incident response has six phases: preparation, detection, containment, eradication, recovery, and learning.
Preparation is getting ready before an incident happens. It means having a plan, training people, and using good tools.
Detection is noticing that an incident has happened. The faster you detect it, the faster you can respond.
Containment is stopping the incident from spreading. It limits the damage.
Eradication is removing the cause of the incident. It fixes the problem and prevents it from happening again.
Recovery is restoring normal operations. It means restoring files, fixing computers, and getting back to work.
Learning is studying the incident and improving. It helps prevent the incident from happening again.
Signs your business has been attacked include a slow computer, pop-up ads, missing files, frequent crashes, and antivirus problems.
When your business is attacked, stay calm, disconnect from the internet, run an antivirus scan, remove the malware, restart, change passwords, restore files, and learn.
Call a professional when you cannot remove malware, when files are locked, when your computer will not start, when data is lost, or when you are not sure what to do.
Nigerian banks, telecoms, government agencies, schools, and businesses all use incident response to stay safe.
Incident response is everywhere. It is in video games, football, social media, school, and cooking.
An incident response plan explains who is responsible, what the phases are, what tools to use, how to measure success, who to communicate with, and when to review.
Congratulations! You have completed Module Seven: Incident Response for Small Businesses.
In this module, you learned that an incident is something bad that happens. You learned that incident response is what we do when an incident happens.
You learned about the six phases of incident response: preparation, detection, containment, eradication, recovery, and learning.
You learned about preparation. It means having a plan, training people, and using good tools.
You learned about detection. It means noticing that an incident has happened.
You learned about containment. It means stopping the incident from spreading.
You learned about eradication. It means removing the cause of the incident.
You learned about recovery. It means restoring normal operations.
You learned about learning. It means studying the incident and improving.
You learned the signs that your business has been attacked.
You learned the steps to take when your business is attacked.
You learned when to call a professional.
You learned about Nigerian examples of incident response.
You learned about fun examples and everyday examples.
You learned how to build an incident response plan.
You are now an Incident Response expert in training!
An incident is something bad that happens. In cyber security, it is when a hacker breaks in, a virus infects a computer, or data is stolen.
Incident response is what we do when an incident happens. It is our plan for dealing with the problem.
Preparation, detection, containment, eradication, recovery, and learning.
Preparation is getting ready before an incident happens. It means having a plan, training people, and using good tools.
Detection is noticing that an incident has happened.
Containment is stopping the incident from spreading.
Eradication is removing the cause of the incident.
Recovery is restoring normal operations.
Learning is studying the incident and improving.
Call a professional when you cannot remove malware, when files are locked, when your computer will not start, when data is lost, or when you are not sure what to do.
| Word | Definition |
|---|---|
| 1. Incident | A. Noticing that an incident has happened |
| 2. Incident Response | B. Stopping the incident from spreading |
| 3. Preparation | C. Something bad that happens |
| 4. Detection | D. What we do when an incident happens |
| 5. Containment | E. Removing the cause of the incident |
| 6. Eradication | F. Restoring normal operations |
| 7. Recovery | G. Getting ready before an incident |
| 8. Learning | H. Studying the incident and improving |
Answers: 1-C, 2-D, 3-G, 4-A, 5-B, 6-E, 7-F, 8-H
Your business computer is very slow. It shows pop-up ads all the time. Your files are missing.
Question: What should you do?
Answer: Your computer might have malware. You should follow the incident response phases. Detect the malware. Contain it by disconnecting from the internet. Eradicate it by running an antivirus scan. Recover by restoring files. Learn by writing a report.
A hacker locks all your business files with ransomware. He demands money to unlock them.
Question: What should you do?
Answer: Do not pay the money. Use your backup to restore your files. If you have a backup, you do not need to pay.
A hacker stole customer data from your business.
Question: What should you do?
Answer: Report the breach to NITDA immediately. Tell your customers. Improve your security.
Instructions:
Time: 30 minutes
Instructions:
Goal: Create a dashboard that shows how well your class responds to incidents.
Steps:
Time: 2 weeks
Instructions:
In Module Eight, you will learn about Building a Cyber-Safe Culture and Next Steps.
You will learn:
To prepare for Module Eight, think about these questions:
See you in Module Eight!
End of Module Seven
Welcome to Module Eight, the final module of the Cybersecurity for Small Businesses course!
In Module One, you learned what cyber security is and why it matters for small businesses. You learned about hackers, malware, phishing, and ransomware.
In Module Two, you learned about passwords and access control. You learned how to create strong passwords and how to control who sees what.
In Module Three, you learned about phishing, scams, and social engineering. You learned how bad people trick you into giving them your information.
In Module Four, you learned about malware, antivirus, and safe browsing. You learned how to protect your computer from bad software.
In Module Five, you learned about network and Wi-Fi security. You learned how to keep your business network safe.
In Module Six, you learned about updates, backups, and data protection. You learned how to protect your files and customer data.
In Module Seven, you learned about incident response. You learned how to handle a cyber attack calmly and effectively.
Now, in Module Eight, you are going to learn about building a cyber-safe culture and next steps.
What is a cyber-safe culture?
A cyber-safe culture is when everyone in your business thinks about security. It is when security becomes a habit. It is when everyone knows what to do and why it matters.
Imagine you have a small shop. You have a rule: everyone must lock the door when they leave. Everyone follows the rule. It becomes a habit. That is a safety culture. A cyber-safe culture is the same, but for computers and data.
Why is a cyber-safe culture important for small businesses?
Because security is not just about tools. It is about people. You can have the best antivirus and firewall, but if your staff click on phishing emails, you are still at risk. A cyber-safe culture makes everyone part of the solution.
Think about it this way. Your business is like a football team. Everyone has a role. The goalkeeper stops the ball. The defenders protect the goal. The midfielders control the game. The strikers score goals. If everyone plays their part, the team wins. A cyber-safe culture is the same. Everyone plays their part to keep the business safe.
In this module, you will learn how to build a cyber-safe culture. You will learn simple security rules. You will learn how to train your staff. You will learn how to create a cyber security policy. You will learn about free tools and resources. You will create a 30-day action plan.
By the end of this module, you will be ready to make your business cyber-safe. You will know what to do next.
Let us begin this final journey together!
After completing this module, you will be able to:
Once upon a time, in a small village near the River Niger, there lived a group of people who were very wise. They had learned that safety was everyone's job.
The village had a rule: everyone must lock their doors at night. Everyone must look out for strangers. Everyone must report anything strange.
One day, a stranger came to the village. He looked friendly. He asked for food and water. The villagers gave him food and water. But they also watched him carefully.
At night, the stranger tried to enter a house. But the door was locked. He tried another house. That door was also locked. He tried a third house. The villagers saw him and raised the alarm. The stranger ran away.
The next day, the village chief called a meeting. He said, "We kept ourselves safe because everyone played their part. Everyone locked their doors. Everyone watched for strangers. Everyone reported strange things. That is our safety culture."
The villagers understood. They had a safety culture. It was not just one person's job. It was everyone's job.
That evening, the chief told the children, "Remember, safety is not just about locks and gates. It is about people. When everyone works together, everyone stays safe."
The children learned a very important lesson. A safety culture is a team effort.
And that is exactly what you will learn in this module.
A cyber-safe culture is when everyone in your business thinks about security. It is when security becomes a habit. It is when everyone knows what to do and why it matters.
Because security is not just about tools. It is about people. You can have the best antivirus and firewall, but if your staff click on phishing emails, you are still at risk. A cyber-safe culture makes everyone part of the solution.
Imagine you have a small shop. You have a rule: everyone must lock the door when they leave. Everyone follows the rule. It becomes a habit. That is a safety culture. A cyber-safe culture is the same, but for computers and data.
A small business has a cyber-safe culture. Everyone uses strong passwords. Everyone checks emails carefully. Everyone reports strange things. The business is safe.
Your school has a cyber-safe culture. Students and teachers use strong passwords. They check emails carefully. They report strange things. The school is safe.
Your family has a cyber-safe culture. Everyone uses strong passwords. Everyone checks emails carefully. Everyone reports strange things. The family is safe.
A Nigerian business has a cyber-safe culture. Everyone uses strong passwords. Everyone checks emails carefully. Everyone reports strange things. The business is safe.
Cyber-Safe Culture
|
V
+-------------------+
| Everyone Thinks |
| About Security |
+-------------------+
|
V
+-------------------+
| Security is |
| a Habit |
+-------------------+
|
V
+-------------------+
| Everyone Knows |
| What to Do |
+-------------------+
|
V
+-------------------+
| Business Safe |
+-------------------+
A cyber-safe culture is when everyone in your business thinks about security. It is when security becomes a habit.
Culture matters more than tools because tools cannot think. People think. Tools cannot decide. People decide. Tools cannot be careful. People be careful.
Many cyber attacks succeed because of human error. Someone clicks on a bad link. Someone uses a weak password. Someone shares information. Tools can help, but people are the first line of defence.
Imagine you have a very strong lock on your door. But you give the key to a stranger. The lock does not matter. The stranger can enter. Tools are like the lock. People are like the key. If people are not careful, tools do not help.
A small business had the best antivirus. But an employee clicked on a phishing email. The antivirus did not stop the employee. The business lost money.
A school had a strong firewall. But a student shared their password. The firewall did not stop the student. The school's website was hacked.
A family had a strong Wi-Fi password. But a family member told a friend. The friend told others. The Wi-Fi was slow.
A Nigerian business had strong security tools. But an employee clicked on a phishing email. The business lost money.
Culture vs Tools
|
V
+-------------------+
| Tools Alone |
+-------------------+
|
V
+-------------------+
| Cannot Stop |
| Human Error |
+-------------------+
|
V
+-------------------+
| Culture + Tools |
+-------------------+
|
V
+-------------------+
| Business Safe |
+-------------------+
Culture matters more than tools because tools cannot think. People think. People decide. People are the first line of defence.
Simple security rules are easy-to-follow instructions that keep your business safe. They are rules that everyone in your business must follow.
Rules help everyone know what to do. Rules help everyone stay safe. Rules make security a habit.
Here are simple security rules for your business:
A small business has simple security rules. Everyone follows them. The business is safe.
Your school has simple security rules. Students and teachers follow them. The school is safe.
Your family has simple security rules. Everyone follows them. The family is safe.
A Nigerian business has simple security rules. Everyone follows them. The business is safe.
Simple Security Rules
|
V
+-------------------+
| Strong Passwords |
+-------------------+
|
V
+-------------------+
| 2FA |
+-------------------+
|
V
+-------------------+
| No Strange Links |
+-------------------+
|
V
+-------------------+
| Lock Computer |
+-------------------+
|
V
+-------------------+
| Report Strange |
| Things |
+-------------------+
Simple security rules include using strong passwords, using 2FA, avoiding strange links, locking your computer, and reporting strange things.
Training your staff means teaching them about cyber security. It means helping them understand the risks and what to do.
Your staff are your first line of defence. If they know about cyber security, they can spot problems. If they do not know, they might make mistakes.
Here is how to train your staff:
A small business trains its staff every three months. They send fake phishing emails to test them. The staff learn to spot phishing.
A school trains its teachers every term. They send fake phishing emails to test them. The teachers learn to spot phishing.
A family trains its members every month. They talk about cyber security at dinner. The family learns to stay safe.
A Nigerian business trains its staff every quarter. They send fake phishing emails to test them. The staff learn to spot phishing.
Training Your Staff
|
V
+-------------------+
| Explain Risks |
+-------------------+
|
V
+-------------------+
| Show Examples |
+-------------------+
|
V
+-------------------+
| Teach Rules |
+-------------------+
|
V
+-------------------+
| Practice |
+-------------------+
|
V
+-------------------+
| Reward Good |
| Behaviour |
+-------------------+
|
V
+-------------------+
| Review Regularly |
+-------------------+
To train your staff, explain the risks, show examples, teach the rules, practice, reward good behaviour, and review regularly.
A cyber security policy is a document that explains how your business protects its computers, data, and people. It is a set of rules and guidelines.
A policy helps everyone know what to do. It helps everyone follow the same rules. It helps your business stay safe.
Imagine you have a shop. You have a rule: everyone must lock the door when they leave. You write the rule on a piece of paper. You put the paper on the wall. That is a policy. A cyber security policy is the same, but for computers and data.
A small business has a cyber security policy. It says: use strong passwords, use 2FA, do not click on strange links, report strange things. Everyone follows the policy. The business is safe.
Your school has a cyber security policy. It says: use strong passwords, do not share passwords, report strange things. Everyone follows the policy. The school is safe.
Your family has a cyber security policy. It says: use strong passwords, do not click on strange links, report strange things. Everyone follows the policy. The family is safe.
A Nigerian business has a cyber security policy. It says: use strong passwords, use 2FA, do not click on strange links, report strange things. Everyone follows the policy. The business is safe.
Cyber Security Policy
|
V
+-------------------+
| Rules and |
| Guidelines |
+-------------------+
|
V
+-------------------+
| Everyone Follows |
+-------------------+
|
V
+-------------------+
| Business Safe |
+-------------------+
A cyber security policy is a document that explains how your business protects its computers, data, and people. It is a set of rules and guidelines.
Creating a cyber security policy means writing down the rules for your business. It means deciding what everyone must do to stay safe.
If you do not write down the rules, people might forget them. If you write them down, everyone can see them. Everyone can follow them.
Here is how to create a cyber security policy:
A small business creates a cyber security policy. They list their assets. They identify threats. They choose security measures. They write the rules. They share the policy. They train staff. They review regularly.
Your school creates a cyber security policy. They list their assets. They identify threats. They choose security measures. They write the rules. They share the policy. They train teachers. They review regularly.
Your family creates a cyber security policy. They list their assets. They identify threats. They choose security measures. They write the rules. They share the policy. They train family members. They review regularly.
A Nigerian business creates a cyber security policy. They list their assets. They identify threats. They choose security measures. They write the rules. They share the policy. They train staff. They review regularly.
How to Create a Cyber Security Policy
|
V
+-------------------+
| 1. List Assets |
+-------------------+
|
V
+-------------------+
| 2. Identify |
| Threats |
+-------------------+
|
V
+-------------------+
| 3. Choose |
| Measures |
+-------------------+
|
V
+-------------------+
| 4. Write Rules |
+-------------------+
|
V
+-------------------+
| 5. Share Policy |
+-------------------+
|
V
+-------------------+
| 6. Train |
+-------------------+
|
V
+-------------------+
| 7. Review |
+-------------------+
To create a cyber security policy, list your assets, identify threats, choose security measures, write the rules, share the policy, train everyone, and review regularly.
Free and low-cost security tools are programs and services that help you stay safe without spending a lot of money.
Small businesses do not have a lot of money. Free and low-cost tools help them stay safe without breaking the bank.
Here are some free and low-cost security tools:
| Tool | What It Does | Cost |
|---|---|---|
| Antivirus | Protects against malware | Free options available |
| Password Manager | Stores passwords safely | Free options available |
| Two-Factor Authentication | Adds an extra layer of security | Free |
| Cloud Backup | Backs up files online | Free options available |
| Firewall | Blocks bad connections | Built into most systems |
| VPN | Scrambles your information | Free options available |
A small business uses free antivirus. They use a free password manager. They use cloud backup. Their business is safe without spending a lot of money.
Your school uses free antivirus. They use a free password manager. They use cloud backup. The school is safe without spending a lot of money.
Your family uses free antivirus. They use a free password manager. They use cloud backup. The family is safe without spending a lot of money.
A Nigerian business uses free antivirus. They use a free password manager. They use cloud backup. The business is safe without spending a lot of money.
Free and Low-Cost Security Tools
|
V
+-------------------+
| Antivirus |
+-------------------+
|
V
+-------------------+
| Password Manager |
+-------------------+
|
V
+-------------------+
| 2FA |
+-------------------+
|
V
+-------------------+
| Cloud Backup |
+-------------------+
|
V
+-------------------+
| Firewall |
+-------------------+
|
V
+-------------------+
| VPN |
+-------------------+
Free and low-cost security tools include antivirus, password managers, 2FA, cloud backup, firewalls, and VPNs.
Getting help means asking experts for advice. It means knowing where to find information and support.
You do not have to know everything. There are people and organizations that can help you. They can give you advice. They can answer your questions.
Here are some places to get help and advice:
A small business asks NITDA for advice. NITDA gives them free tips. The business is safer.
Your school asks a cyber security expert for advice. The expert gives them free tips. The school is safer.
Your family asks the bank for advice. The bank gives them free tips. The family is safer.
A Nigerian business asks NITDA for advice. NITDA gives them free tips. The business is safer.
Where to Get Help and Advice
|
V
+-------------------+
| NITDA |
+-------------------+
|
V
+-------------------+
| Cyber Security |
| Experts |
+-------------------+
|
V
+-------------------+
| Online Resources |
+-------------------+
|
V
+-------------------+
| Your Bank |
+-------------------+
|
V
+-------------------+
| Business |
| Associations |
+-------------------+
|
V
+-------------------+
| Government |
| Agencies |
+-------------------+
You can get help and advice from NITDA, cyber security experts, online resources, your bank, business associations, and government agencies.
A cyber-safe culture is important in Nigeria. Here are some Nigerian examples.
Seeing examples from Nigeria helps you understand how a cyber-safe culture works in your own country.
Here are some Nigerian examples:
A Nigerian bank has a cyber-safe culture. Everyone is trained. Everyone follows the rules. The bank is safe.
A Nigerian school has a cyber-safe culture. Students and teachers are trained. Everyone follows the rules. The school is safe.
A Nigerian family has a cyber-safe culture. Everyone is trained. Everyone follows the rules. The family is safe.
A Nigerian business has a cyber-safe culture. Everyone is trained. Everyone follows the rules. The business is safe.
Nigerian Cyber-Safe Culture
+------------------------------------------+
| Banks: Train staff, follow rules |
| Telecoms: Train staff, follow rules |
| Government: Train staff, follow rules |
| Schools: Train students, follow rules |
| Businesses: Train staff, follow rules |
+------------------------------------------+
Nigerian banks, telecoms, government agencies, schools, and businesses all have a cyber-safe culture. They train staff and follow the rules.
A cyber-safe culture can be explained using fun examples that children understand.
When you use fun examples, learning becomes easier and more enjoyable.
Here are some fun examples:
Imagine you are playing a game. Everyone on the team has a role. Everyone works together. You win. A cyber-safe culture is the same.
Your school has a rule: everyone must lock their locker. Everyone follows the rule. The school is safe. A cyber-safe culture is the same.
Your family has a rule: everyone must lock the door. Everyone follows the rule. The home is safe. A cyber-safe culture is the same.
In a Nigerian football match, everyone on the team has a role. Everyone works together. The team wins. A cyber-safe culture is the same.
Fun Cyber-Safe Culture
+------------------------------------------+
| Video Game: Everyone has a role |
| Football: Everyone works together |
| Social Media: Everyone follows rules |
| School: Everyone follows rules |
| Cooking: Everyone works together |
+------------------------------------------+
A cyber-safe culture is everywhere. It is in video games, football, social media, school, and cooking. Everyone has a role. Everyone works together.
A cyber-safe culture is not just for businesses. It is like things in everyday life.
When you understand a cyber-safe culture in everyday life, you can use the ideas to stay safe.
Here are everyday examples:
You lock your door at night. It is a habit. A cyber-safe culture is the same. Everyone uses strong passwords. It is a habit.
You look both ways before crossing the road. It is a habit. A cyber-safe culture is the same. Everyone checks emails carefully. It is a habit.
You wash your hands before eating. It is a habit. A cyber-safe culture is the same. Everyone reports strange things. It is a habit.
A Nigerian family locks their door at night. It is a habit. They also use strong passwords. It is a habit. A cyber-safe culture is the same.
Everyday Cyber-Safe Culture
+------------------------------------------+
| Lock Door: Everyone does it |
| Look Both Ways: Everyone does it |
| Wash Hands: Everyone does it |
| Wear Seatbelt: Everyone does it |
| Keep Secrets: Everyone does it |
+------------------------------------------+
A cyber-safe culture is like locking your door, looking both ways, washing your hands, wearing a seatbelt, and keeping secrets. It is a habit.
Building a cyber-safe culture means making security a habit in your business. It means everyone thinks about security.
A cyber-safe culture keeps your business safe. It helps everyone know what to do. It helps everyone work together.
Here is how to build a cyber-safe culture:
A small business builds a cyber-safe culture. The owner leads by example. Everyone is trained. It is easy to follow the rules. Good behaviour is rewarded. They talk about security. They review and improve. The business is safe.
Your school builds a cyber-safe culture. The principal leads by example. Everyone is trained. It is easy to follow the rules. Good behaviour is rewarded. They talk about security. They review and improve. The school is safe.
Your family builds a cyber-safe culture. The parents lead by example. Everyone is trained. It is easy to follow the rules. Good behaviour is rewarded. They talk about security. They review and improve. The family is safe.
A Nigerian business builds a cyber-safe culture. The owner leads by example. Everyone is trained. It is easy to follow the rules. Good behaviour is rewarded. They talk about security. They review and improve. The business is safe.
Building a Cyber-Safe Culture
|
V
+-------------------+
| Lead by Example |
+-------------------+
|
V
+-------------------+
| Train Everyone |
+-------------------+
|
V
+-------------------+
| Make It Easy |
+-------------------+
|
V
+-------------------+
| Reward Good |
| Behaviour |
+-------------------+
|
V
+-------------------+
| Talk About It |
+-------------------+
|
V
+-------------------+
| Review and |
| Improve |
+-------------------+
To build a cyber-safe culture, lead by example, train everyone, make it easy, reward good behaviour, talk about it, and review and improve.
A 30-day action plan is a list of things you will do in the next 30 days to make your business cyber-safe.
A plan helps you get started. It helps you stay organized. It helps you make progress.
Here is a sample 30-day action plan:
| Week | Action |
|---|---|
| Week 1 | Create strong passwords for all accounts. Turn on 2FA. |
| Week 2 | Install antivirus. Update all software. Back up your files. |
| Week 3 | Create a cyber security policy. Train your staff. |
| Week 4 | Review your plan. Make improvements. Celebrate your progress. |
A small business creates a 30-day action plan. They follow it. After 30 days, their business is safer.
Your school creates a 30-day action plan. They follow it. After 30 days, the school is safer.
Your family creates a 30-day action plan. They follow it. After 30 days, the family is safer.
A Nigerian business creates a 30-day action plan. They follow it. After 30 days, the business is safer.
30-Day Action Plan
|
V
+-------------------+
| Week 1: |
| Passwords, 2FA |
+-------------------+
|
V
+-------------------+
| Week 2: |
| Antivirus, |
| Updates, Backups |
+-------------------+
|
V
+-------------------+
| Week 3: |
| Policy, Training |
+-------------------+
|
V
+-------------------+
| Week 4: |
| Review, Improve, |
| Celebrate |
+-------------------+
A 30-day action plan is a list of things you will do in the next 30 days to make your business cyber-safe.
Celebrating your progress means recognizing what you have achieved. It means being proud of your hard work.
Celebrating keeps you motivated. It keeps your staff motivated. It makes security fun.
Here is how to celebrate your progress:
A small business celebrates its progress. They give a small reward to staff. They share their success. They plan the next steps. The business is safer and happier.
Your school celebrates its progress. They give a small reward to students. They share their success. They plan the next steps. The school is safer and happier.
Your family celebrates its progress. They give a small reward to family members. They share their success. They plan the next steps. The family is safer and happier.
A Nigerian business celebrates its progress. They give a small reward to staff. They share their success. They plan the next steps. The business is safer and happier.
Celebrating Your Progress
|
V
+-------------------+
| Reward Good |
| Behaviour |
+-------------------+
|
V
+-------------------+
| Share Your |
| Success |
+-------------------+
|
V
+-------------------+
| Be Proud |
+-------------------+
|
V
+-------------------+
| Plan Next Steps |
+-------------------+
Celebrating your progress means recognizing what you have achieved. It keeps you motivated.
A case study is a real-life example that helps us learn. Let us look at a Nigerian business.
Case studies help us see how a cyber-safe culture works in real life.
A Nigerian small business called "Chidi's Electronics" sold phones and laptops. The owner, Chidi, learned about cyber security. He decided to build a cyber-safe culture.
Here is what Chidi did:
After six months, Chidi saw results:
Chidi learned that a cyber-safe culture is good for business.
Chidi shared his success with other businesses. They all started building a cyber-safe culture.
Your school can use the same approach. Lead by example. Train everyone. Make it easy. Reward good behaviour. Talk about it. Review and improve.
Your family can use the same approach. Lead by example. Train everyone. Make it easy. Reward good behaviour. Talk about it. Review and improve.
Nigerian businesses like Chidi's Electronics have built a cyber-safe culture. They are safer and happier.
Case Study: Chidi's Electronics
|
V
+-------------------+
| Problem: |
| Cyber Attacks |
+-------------------+
|
V
+-------------------+
| Solution: |
| Cyber-Safe |
| Culture |
+-------------------+
|
V
+-------------------+
| Lead by Example, |
| Train Everyone, |
| Make It Easy, |
| Reward, Talk, |
| Review |
+-------------------+
|
V
+-------------------+
| Result: Safer, |
| Happier, Trusted |
+-------------------+
Chidi's Electronics built a cyber-safe culture. They led by example, trained everyone, made it easy, rewarded good behaviour, talked about it, and reviewed and improved. The business became safer and happier.
| Word | Simple Definition |
|---|---|
| Cyber-Safe Culture | When everyone in your business thinks about security |
| Cyber Security Policy | A document that explains how your business protects its computers, data, and people |
| Training | Teaching your staff about cyber security |
| Free Tools | Programs and services that help you stay safe without spending money |
| Low-Cost Tools | Programs and services that help you stay safe for a small amount of money |
| NITDA | National Information Technology Development Agency |
| 30-Day Action Plan | A list of things you will do in the next 30 days |
| Lead by Example | Showing others what to do by doing it yourself |
| Reward | Giving something good to someone who does well |
| Review | Checking your progress and making improvements |
| Antivirus | Software that protects your computer from malware |
| Password Manager | A program that stores all your passwords in one safe place |
| Two-Factor Authentication (2FA) | An extra layer of security that requires two things to log in |
| Cloud Backup | Backing up files to the internet |
| VPN | Virtual Private Network - scrambles your information |
A small shop in Lagos builds a cyber-safe culture. The owner leads by example. Everyone is trained. It is easy to follow the rules. Good behaviour is rewarded. They talk about security. They review and improve. The business is safe.
A small school in Abuja builds a cyber-safe culture. The principal leads by example. Everyone is trained. It is easy to follow the rules. Good behaviour is rewarded. They talk about security. They review and improve. The school is safe.
A family business in Port Harcourt builds a cyber-safe culture. The parents lead by example. Everyone is trained. It is easy to follow the rules. Good behaviour is rewarded. They talk about security. They review and improve. The family is safe.
Banks like GTBank, Zenith, and Access Bank have a cyber-safe culture. Everyone is trained. Everyone follows the rules. Everyone reports strange things.
Companies like MTN, Glo, and Airtel have a cyber-safe culture. They train staff. They follow the rules.
NITDA has a cyber-safe culture. They train staff. They follow the rules.
Schools like Covenant University and University of Lagos have a cyber-safe culture. They train students. They follow the rules.
Companies like Jumia and Konga have a cyber-safe culture. They train staff. They follow the rules.
In a video game, everyone on the team has a role. The healer heals. The fighter fights. The wizard casts spells. Everyone works together. A cyber-safe culture is the same.
In football, everyone on the team has a role. The goalkeeper stops the ball. The defenders protect the goal. The midfielders control the game. The strikers score goals. Everyone works together. A cyber-safe culture is the same.
On social media, everyone follows the rules. Everyone is careful. Everyone reports bad things. A cyber-safe culture is the same.
In school, everyone follows the rules. Everyone is careful. Everyone reports bad things. A cyber-safe culture is the same.
Everyone in your family locks the door at night. It is a habit. A cyber-safe culture is the same.
Everyone in your family looks both ways before crossing the road. It is a habit. A cyber-safe culture is the same.
Everyone in your family washes their hands before eating. It is a habit. A cyber-safe culture is the same.
Everyone in your family wears a seatbelt in the car. It is a habit. A cyber-safe culture is the same.
Everyone in your family keeps secrets. It is a habit. A cyber-safe culture is the same.
+-------------------+
| Lead by Example |
+-------------------+
|
V
+-------------------+
| Train Everyone |
+-------------------+
|
V
+-------------------+
| Make It Easy |
+-------------------+
|
V
+-------------------+
| Reward Good |
| Behaviour |
+-------------------+
|
V
+-------------------+
| Talk About It |
+-------------------+
|
V
+-------------------+
| Review and |
| Improve |
+-------------------+
|
V
+-------------------+
| Business Safe |
+-------------------+
Week 1: Passwords, 2FA
|
V
Week 2: Antivirus, Updates, Backups
|
V
Week 3: Policy, Training
|
V
Week 4: Review, Improve, Celebrate
| Task | Done? |
|---|---|
| Owner leads by example | Yes / No |
| Everyone is trained | Yes / No |
| It is easy to follow the rules | Yes / No |
| Good behaviour is rewarded | Yes / No |
| Security is talked about regularly | Yes / No |
| Culture is reviewed and improved | Yes / No |
| Cyber security policy is created | Yes / No |
| 30-day action plan is created | Yes / No |
| Feature | Tools Alone | Culture + Tools |
|---|---|---|
| Can think? | No | Yes (people think) |
| Can decide? | No | Yes (people decide) |
| Can be careful? | No | Yes (people are careful) |
| Stops human error? | No | Yes |
| Business safety | Partial | Full |
| Feature | Free Tools | Paid Tools |
|---|---|---|
| Cost | Free | Money |
| Effectiveness | Good | Better |
| Support | Limited | Good |
| Best for | Small businesses | Larger businesses |
A cyber-safe culture is when everyone in your business thinks about security. It is when security becomes a habit.
Culture matters more than tools because tools cannot think. People think. People decide. People are the first line of defence.
Simple security rules include using strong passwords, using 2FA, avoiding strange links, locking your computer, and reporting strange things.
To train your staff, explain the risks, show examples, teach the rules, practice, reward good behaviour, and review regularly.
A cyber security policy is a document that explains how your business protects its computers, data, and people. It is a set of rules and guidelines.
To create a cyber security policy, list your assets, identify threats, choose security measures, write the rules, share the policy, train everyone, and review regularly.
Free and low-cost security tools include antivirus, password managers, 2FA, cloud backup, firewalls, and VPNs.
You can get help and advice from NITDA, cyber security experts, online resources, your bank, business associations, and government agencies.
Nigerian banks, telecoms, government agencies, schools, and businesses all have a cyber-safe culture. They train staff and follow the rules.
A cyber-safe culture is everywhere. It is in video games, football, social media, school, and cooking. Everyone has a role. Everyone works together.
A cyber-safe culture is like locking your door, looking both ways, washing your hands, wearing a seatbelt, and keeping secrets. It is a habit.
To build a cyber-safe culture, lead by example, train everyone, make it easy, reward good behaviour, talk about it, and review and improve.
A 30-day action plan is a list of things you will do in the next 30 days to make your business cyber-safe.
Celebrating your progress means recognizing what you have achieved. It keeps you motivated.
Chidi's Electronics built a cyber-safe culture. They led by example, trained everyone, made it easy, rewarded good behaviour, talked about it, and reviewed and improved. The business became safer and happier.
Congratulations! You have completed Module Eight: Building a Cyber-Safe Culture and Next Steps.
In this module, you learned that a cyber-safe culture is when everyone in your business thinks about security. It is when security becomes a habit.
You learned that culture matters more than tools because tools cannot think.
You learned about simple security rules.
You learned how to train your staff.
You learned what a cyber security policy is and how to create one.
You learned about free and low-cost security tools.
You learned where to get help and advice.
You learned about Nigerian examples of a cyber-safe culture.
You learned about fun examples and everyday examples.
You learned how to build a cyber-safe culture.
You learned how to create a 30-day action plan.
You learned how to celebrate your progress.
You learned from a case study of Chidi's Electronics, a Nigerian business that built a cyber-safe culture.
You are now a Cyber-Safe Culture expert in training!
A cyber-safe culture is when everyone in your business thinks about security. It is when security becomes a habit.
Because tools cannot think. People think. People decide. People are the first line of defence.
Simple security rules include using strong passwords, using 2FA, avoiding strange links, locking your computer, and reporting strange things.
Explain the risks, show examples, teach the rules, practice, reward good behaviour, and review regularly.
A cyber security policy is a document that explains how your business protects its computers, data, and people.
List your assets, identify threats, choose security measures, write the rules, share the policy, train everyone, and review regularly.
Free and low-cost security tools include antivirus, password managers, 2FA, cloud backup, firewalls, and VPNs.
You can get help from NITDA, cyber security experts, online resources, your bank, business associations, and government agencies.
Lead by example, train everyone, make it easy, reward good behaviour, talk about it, and review and improve.
A 30-day action plan is a list of things you will do in the next 30 days to make your business cyber-safe.
| Word | Definition |
|---|---|
| 1. Cyber-Safe Culture | A. Teaching your staff about cyber security |
| 2. Cyber Security Policy | B. When everyone in your business thinks about security |
| 3. Training | C. A list of things you will do in the next 30 days |
| 4. Free Tools | D. A document that explains how your business protects its computers |
| 5. 30-Day Action Plan | E. Programs that help you stay safe without spending money |
| 6. Lead by Example | F. Checking your progress and making improvements |
| 7. Review | G. Showing others what to do by doing it yourself |
Answers: 1-B, 2-D, 3-A, 4-E, 5-C, 6-G, 7-F
Your staff click on phishing emails. They do not know how to spot them.
Question: What should you do?
Answer: You should train your staff. Explain the risks. Show examples. Teach the rules. Practice. Reward good behaviour. Review regularly.
Your business does not have a cyber security policy. Everyone does what they want.
Question: What should you do?
Answer: You should create a cyber security policy. List your assets. Identify threats. Choose security measures. Write the rules. Share the policy. Train everyone. Review regularly.
You want to make your business cyber-safe, but you do not know where to start.
Question: What should you do?
Answer: You should create a 30-day action plan. Week 1: Passwords, 2FA. Week 2: Antivirus, Updates, Backups. Week 3: Policy, Training. Week 4: Review, Improve, Celebrate.
Instructions:
Time: 30 minutes
Instructions:
Goal: Create a dashboard that shows how well your class has built a cyber-safe culture.
Steps:
Time: 2 weeks
Instructions:
Congratulations! You have completed the Cybersecurity for Small Businesses course!
You have learned:
You are now a Cyber Security for Small Businesses expert!
Keep learning. Keep practicing. Keep your business safe.
Thank you for completing this course!
End of Module Eight
End of Course: Cybersecurity for Small Businesses