An Integrated Framework for Combating Phishing in Nigeria’s Midstream and Downstream Oil and Gas Operations

Abstract

In recent years, corporate organizations have increasingly adopted digital 
technologies to enhance their operations. However, this digital transformation has 
also heightened their exposure to cybersecurity threats—particularly phishing 
attacks. The Nigerian oil and gas sector, a critical component of the national economy, 
is particularly vulnerable, with frequent phishing incidents targeting sensitive 
corporate data and operational stability. Despite the adoption of mitigation measures 
such as employee training and email filtering, phishing remains a persistent threat, 
often exacerbated by human error and outdated systems. This paper proposes a 
comprehensive framework for mitigating phishing attacks within Nigeria’s midstream 
and downstream oil and gas subsectors. The framework leverages ISO 27001 
principles and incorporates a machine learning-based detection mechanism, 
specifically using a logistic regression model trained on localized enterprise data. It 
emphasizes continuous security risk assessment and integrates both technical 
controls and human-centric strategies. To validate the framework, interviews were 
conducted with industry stakeholders to assess current mitigation practices. The 
detection mechanism also utilizes data from Microsoft Defender alerts and the Anti
Phishing Working Group (APWG) repositories. The logistic regression model 
demonstrated a high accuracy rate of 97.7%, highlighting its effectiveness with 
minimal computational overhead. Findings further underscore the need for improved 
employee training, updated technical safeguards, and robust incident response plans 
to enhance cybersecurity resilience across the sector.