Almost everything an accountant handles now sits on a computer: ledgers, payroll, bank access, client files. That makes it a target. A single stolen password can empty a bank account, a locked server can halt a business for days. A leaked customer list can ruin a reputation and bring legal penalties. Cybersecurity is the discipline of preventing this.
The Institute of Chartered Accountants of Nigeria (ICAN) syllabus asks you to explain the key risks to data from cyber attacks and the actions that reduce them. Learn the main kinds of attack by name and by how they work, and pair each with a sensible defence.
In 30 seconds
Cybersecurity protects computer systems, networks and data from digital attack, unauthorised access, damage and theft, and aims to keep information confidential, accurate and available. The main risks are data breaches, ransomware, phishing, malware and trojans, man-in-the-middle attacks, denial-of-service attacks, SQL injection and social engineering. Defences include strong authentication, role-based access, regular updates, encryption, monitoring, staff training, backups and an incident response plan.
What cybersecurity means
Cybersecurity is the practice of protecting computer systems, networks, programs and data from digital attacks, unauthorised access, damage and theft, and of preventing the service disruption that attacks cause. It works in cyberspace, the digital world formed by connected networks and the information on them.
It aims to protect the confidentiality of information (only the right people see it), its integrity (it is accurate and unaltered) and its availability (it can be used when needed).
The syllabus stresses that cybersecurity is more than technology. It also depends on strategies, human behaviour, organisational policy and law. Five themes shape a full view: technological solutions, events such as attacks and breaches, strategies and processes, human engagement, and the assets being protected.
Key risks to data from cyber attacks
| Risk | How it works | Effect |
|---|---|---|
| Data breach | Criminals gain unauthorised access to sensitive data. It may come from hacking (exploiting weaknesses), insider threats (trusted people misusing access) or physical theft of devices | Identity theft, fraud and misuse of personal or corporate data |
| Ransomware | Malicious software blocks access to a system or encrypts data until a ransom is paid | Data loss or operational shutdown if no backup exists |
| Phishing | Fraudulent messages, usually email, trick people into revealing passwords, card details or login credentials. It exploits human weakness, not technical flaws | Unauthorised access to data |
| Malware and trojans | Malicious programs such as viruses and spyware that damage, disrupt or steal data. A trojan disguises itself as legitimate software | Rapid spread across the network and compromised information |
| Man-in-the-middle | An attacker intercepts communication between two parties, usually on an unsecured network, and can steal, alter or inject data without either side noticing | Dangerous in banking and e-commerce |
| Denial of service (DoS and DDoS) | A flood of traffic overwhelms a website or network so that real users cannot reach it | No direct theft, but lost access, disruption and financial loss |
| SQL injection | Attackers insert malicious code into a web application’s database query to read or change the data | Theft or alteration of data |
| Social engineering | People are manipulated into giving up confidential information, using urgency or the apparent authority of a trusted person | Disclosure of sensitive data |
Actions to reduce the risk
| Action | How it helps |
|---|---|
| Strong authentication | Multi-factor authentication asks for two or more proofs of identity, such as a password and a security token or fingerprint, so a stolen password alone is not enough |
| Access controls | Users see only the data they need. Role-based access control ties access to a person’s job, which limits internal breaches |
| Updates and patches | Outdated software has weaknesses that criminals exploit, so patches should be applied promptly, with automatic updates wherever possible |
| Encryption | Turns sensitive data into an unreadable form that only a key can unlock, so stolen data is useless |
| Monitoring network traffic | Continuous checks for suspicious activity allow early detection |
| An incident response plan | A tested plan says who does what when an attack occurs, which limits damage and recovery time |
| Expert help | Specialists can assess weaknesses and strengthen defences |
Other standard measures are firewalls and anti-malware software, regular staff training so that people spot phishing and social engineering. Regular off-site backups that are tested, so that a ransomware attack does not mean permanent loss.
Why backups and training pay off: a numerical example
A firm earns ₦500,000 a day. A ransomware attack locks its systems. With a tested backup, it is back in 2 days and loses ₦1,000,000 of sales. With no usable backup, it takes 10 days, losing ₦5,000,000, and may also lose records. A backup system costing ₦600,000 a year therefore pays for itself after a single serious incident. Staff training costs little and guards against the phishing that often starts the attack.
Data protection law
In Nigeria, the Nigeria Data Protection Act 2023 requires organisations to protect personal data and to report serious breaches to the regulator and, where there is a risk to people, to those affected. A breach is therefore a legal as well as a financial and reputational problem.
Worked example: matching attack to defence
Scenario. Name the attack and a suitable defence:
- (a) an email that appears to come from the bank asks staff to confirm their login details
- (b) a caller claiming to be the managing director demands an urgent transfer
- (c) a website is flooded with traffic and cannot be reached
- (d) files are encrypted and a payment is demanded
| Case | Attack | Defence |
|---|---|---|
| (a) | Phishing | Staff training, and multi-factor authentication so that stolen details are not enough |
| (b) | Social engineering | A rule that urgent payment requests are verified through a second channel and approved by two people |
| (c) | Denial-of-service attack | Traffic monitoring and filtering, and a response plan |
| (d) | Ransomware | Tested off-site backups, updates and patches, and an incident response plan |
Cybersecurity in more detail
The three aims explained
Confidentiality means that only authorised people can see information, which is protected by access controls and encryption. Integrity means that information is accurate and has not been altered without authority, which is protected by controls on who can change data and by logs. Availability means that systems and data can be used when needed, which is protected by backups, redundancy and defence against denial of service.
A ransomware attack threatens availability. A phishing breach threatens confidentiality. An unauthorised change to a ledger threatens integrity.
How an attack unfolds
A typical attack begins with a phishing email that tricks an employee into entering a password. The attacker uses the credentials to log in, explores the network, moves to systems holding valuable data, copies it, and then may lock files with ransomware and demand payment.
The defences work at each stage: training stops the click, multi-factor authentication stops a stolen password from being enough, access controls limit what the attacker can reach, monitoring detects strange activity, encryption makes copied data useless, and backups allow recovery.
Layered defence
| Layer | Examples |
|---|---|
| People | Training, a security-aware culture, clear rules for reporting suspicious messages |
| Process | Access reviews, patching schedules, an incident response plan, tested backups |
| Technology | Firewalls, anti-malware, encryption, multi-factor authentication, monitoring |
| Governance | Policies, audits and legal compliance with data protection law |
Incident response: the steps
- Detect and report the incident quickly.
- Contain it by isolating affected systems.
- Investigate what happened and what data was affected.
- Eradicate the cause and recover from clean backups.
- Notify those the law requires, such as the regulator and affected individuals.
- Learn from the incident and improve controls.
The accountant’s role
Accountants hold sensitive financial data and approve payments, so they are prime targets of fraud such as fake supplier emails asking for a change of bank details. Controls such as verifying changes through a second channel, dual approval of payments and regular reconciliations stop many losses.
Exam focus: the XML signature wrapping attack
November 2025 Section A asked which attack undermines a web server’s validation requests that use the XML signature element. The answer is a wrapping attack. In an XML signature wrapping attack, the attacker moves or inserts elements in a signed message so that the server still validates the signature but processes the attacker’s altered content.
It is a web-services attack, so it sits alongside other threats to cloud and web applications. Defences include strict schema validation, checking that the signed element is the one the application actually uses, and keeping security libraries updated.
Exam focus: actions to mitigate cyber attacks
- Strong authentication and access controls. Multi-factor authentication needs two or more factors, such as a password, a token or a biometric scan. Role-based access control limits each user to the data needed for their job.
- Regular updates and patches to remove known weaknesses, with automated updates where possible.
- Encrypt sensitive data both when stored and when sent, so intercepted data stays unreadable.
- Back up critical data in secure off-site or cloud locations and test recovery, which limits the damage of ransomware.
- Educate employees and train them. Staff are the first line of defence against phishing and social engineering.
- Monitor network traffic for unusual patterns, using intrusion detection systems and security information and event management (SIEM) tools.
- Develop an incident response plan.
- Use firewalls and anti-malware tools and secure wireless networks.
- Partner with cybersecurity experts for specialist support.
Common mistakes in the exam
- Treating cybersecurity as only a technical matter. People and policy matter as much.
- Confusing phishing, which tricks people, with malware, which is a program.
- Saying a DoS attack steals data. It disrupts access.
- Naming an attack without a matching defence.
- Forgetting insider threats and physical theft as sources of breaches.
- Forgetting that backups and an incident plan limit damage after an attack.
Quick revision
- Cybersecurity: protect systems, networks and data. Goals: confidentiality, integrity, availability.
- Eight risks: breach, ransomware, phishing, malware and trojans, man-in-the-middle, DoS and DDoS, SQL injection, social engineering.
- Defences: multi-factor authentication, role-based access, patching, encryption, monitoring, training, backups, incident response plan, expert help.
Practice questions
These are original questions written in the style of the ICAN exam. Try each one before you open the answer.
Section A style: multiple choice
Question 1. Software that blocks access to data until a payment is made is called:
- Phishing
- Ransomware
- A trojan only
- SQL injection
Show the answer
B. Ransomware locks or encrypts data and demands a ransom.
Question 2. A fraudulent email designed to trick a user into revealing a password is:
- A denial-of-service attack
- Phishing
- A man-in-the-middle attack
- Encryption
Show the answer
B. Phishing exploits human weakness.
Question 3. Which of the following best describes multi-factor authentication?
- Using one long password
- Requiring two or more forms of verification before access
- Encrypting data
- Backing up data
Show the answer
B. It combines factors such as a password, a token and a fingerprint.
Question 4. A DDoS attack aims to:
- Steal passwords
- Make a website or network inaccessible by flooding it with traffic
- Encrypt files
- Install a trojan
Show the answer
B. It does not take data directly but disrupts access.
Question 5. Restricting each user’s access to the data needed for their job is called:
- Role-based access control
- Phishing
- Patching
- Social engineering
Show the answer
A.
Question 6. Confidentiality, integrity and availability are the aims of:
- Cybersecurity
- Digital marketing
- Cost accounting
- Project management
Show the answer
A.
Question 7. A ransomware attack primarily threatens which aim?
- Availability
- Confidentiality only
- Integrity only
- Anonymity
Show the answer
A. Systems and data are locked.
Question 8. Verifying a changed supplier bank detail by phone on a known number helps defend against:
- Social engineering and payment fraud
- Denial of service
- SQL injection
- Hardware failure
Show the answer
A. It uses a second channel.
Question 9. The first step in incident response is to:
- Detect and report quickly
- Pay the ransom
- Delete logs
- Ignore
Show the answer
A. Early detection limits damage.
Question 10. Layered defence means:
- One strong control
- Several controls across people, process and technology
- No controls
- Only a firewall
Show the answer
B. If one layer fails, others protect.
Section B style: written questions
Question 11 (10 marks). Explain five key risks to data from cyber attacks.
Show the marking guide
Award 2 marks for each: 1 for naming it and 1 for explaining how it works or its effect. Any five of: data breach, ransomware, phishing, malware and trojans, man-in-the-middle, denial of service, SQL injection and social engineering.
Question 12 (20 marks).
(a) Define cybersecurity and state its three main aims. (5 marks)
(b) Explain six actions an organisation can take to reduce cyber risk. (12 marks)
(c) A firm earns ₦500,000 a day. Explain why a tested backup is worth having if an attack could otherwise halt operations for ten days instead of two. (3 marks)
Show the marking guide
(a) 5 marks. Definition (2). Confidentiality, integrity and availability (3).
(b) 12 marks, 2 each. Any six of: multi-factor authentication, role-based access, updates and patches, encryption, monitoring, staff training, backups, an incident response plan, expert help.
(c) 3 marks. Eight extra days of downtime at ₦500,000 is ₦4,000,000 of avoided lost sales (2). The cost of a backup is small by comparison (1).
A further written question
Question 13 (10 marks). Explain the steps a business should take when it discovers a cyber attack.
Model answers
Show the model answer to Question 11
Five key risks to data. Data breach: unauthorised access to sensitive data through hacking, insiders or theft, leading to identity theft and fraud. Ransomware: malicious software locks or encrypts data until a ransom is paid, causing loss of data or shutdown if there is no backup. Phishing: fraudulent messages trick people into revealing passwords or card details, which gives access to data.
Malware and trojans: malicious programs damage, disrupt or steal data. Denial of service: a flood of traffic stops users from reaching a system, causing lost access and financial loss. Others are man-in-the-middle attacks, SQL injection and social engineering.
Show the model answer to Question 12
(a) Cybersecurity is the practice of protecting computer systems, networks, programs and data from digital attacks, unauthorised access, damage and theft. Its three main aims are confidentiality (only authorised people see information), integrity (information is accurate and unaltered) and availability (systems and data can be used when needed).
(b) Six actions. Multi-factor authentication asks for two or more proofs of identity, so a stolen password is not enough. Role-based access control gives users only the data they need. Updates and patches close weaknesses that criminals exploit. Encryption makes stolen data unreadable without a key. Staff training helps people spot phishing and social engineering. Tested backups and an incident response plan limit damage and speed recovery. Monitoring network traffic and expert help also reduce risk.
(c) With a tested backup, the firm is back in two days and loses ₦1,000,000 of sales. Without one, it takes ten days and loses ₦5,000,000. The backup avoids ₦4,000,000 of lost sales, which is far more than the cost of a backup system, and protects the records.
Show the model answer to Question 13
When a business discovers a cyber attack it should act in an orderly way. First, report and detect: staff must tell the responsible person at once, and the firm confirms what is happening. Second, contain the incident by isolating affected systems and disabling compromised accounts so it cannot spread. Third, investigate what happened, how the attacker got in and what data was affected.
Fourth, eradicate the cause, for example by removing malware and fixing the weakness, and recover from clean backups. Fifth, notify the regulator and affected people where the law, such as the Nigeria Data Protection Act, requires. Sixth, review and learn, updating controls, training and the response plan. Following a tested incident response plan limits damage and recovery time.
Pathfinder on cybersecurity
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
Tested the wrapping attack on XML signatures. Revise the Exam focus note.
Revise first: Exam focus: the XML signature wrapping attack
None of the diets mapped so far has a written question on this topic, so practise it through the multiple-choice questions. Check Section A of every diet for items on types of cyber attack and the actions that reduce the risk.
Revise first: Exam focus: actions to mitigate cyber attacks
Source: ICAN Pathfinder, Business Environment. Diets covered: May Diet, 2021 to May Diet, 2026. November Diet, 2024 is not yet mapped.
Spotted a mistake? Tell us and we will check it.
