A FRAMEWORK FOR MITIGATING PHISHING IN THE NIGERIA OIL AND GAS INDUSTRY

Abstract

Corporate organizations have in recent times continued to adopt digital solutions for their operations. This has exposed them to variety of cyber security threats such as Phishing. The Nigerian oil and gas industry which plays significant role in the country’s economy faces the problem of cyber security attack targeting its vital corporate data and operating stability. Phishing attacks continue to be a security threat even though organizations utilize various strategies such as employee awareness and training, and email filtering and many more, yet human mistakes along with outdated systems lead to the rise of these attacks. This paper presents a framework that aims to mitigate Phishing attacks in Nigeria's midstream and downstream oil and gas subsectors. The framework is based on ISO 27001 principles with machine learning approach. It incorporates detection mechanism together with emphasis on continuous security risk assessment. Interviews with industries stakeholders was conducted in order to ascertain the current mitigation strategies, and actionable strategies were outlined.  The framework integrates human elements alongside technology-based strategies to combat phishing attacks thus providing implementable strategies for Nigeria’s oil and gas sector to boost its cybersecurity resilience. The detection mechanism of the framework implements Logistic regression model trained on local enterprise data to detect phishing related attack. Industry stakeholder interviews combined with Microsoft Defender alerts and Anti-Phishing Working Group (APWG) repositories form part of the data used in this work. The logistic regression model performed excellently with accuracy of 97.7%, signifying that Machine learning based phishing detection mechanism is effective and can be integrated into frameworks without incurring high computation overhead. Results further indicate need for improvement on employee training programs and technical controls in addition to incident response plans.