1.1 Introduction
Cybersecurity risk assessment is defined as the systematic process of identifying, analyzing, and evaluating potential threats and vulnerabilities within an organization's digital infrastructure in order to determine the likelihood and impact of cyber incidents and to implement appropriate mitigation measures (NIST, 2020). In financial institutions, cybersecurity risk assessment plays a critical role in protecting sensitive customer information, maintaining the integrity of financial transactions, and ensuring continuous service delivery in an increasingly digitalized banking environment.
Financial institutions operate in one of the most targeted sectors for cybercrime due to the high value of financial data and the reliance on interconnected information systems. Banks such as Zenith Bank Plc utilize various digital platforms including mobile banking applications, online banking portals, automated teller machines, and electronic payment systems to enhance service delivery and customer convenience. However, these technological advancements also expose the institution to a wide range of cyber threats such as phishing attacks, ransomware, data breaches, insider threats, and distributed denial-of-service attacks (Aliyu & Bala, 2021).
As a prelude to other parts of this study, this chapter will discuss the background upon which this study was initiated, the statement of problems that led to this study, the Aim and Objectives of the study. Others are significance of the study, scope of work, research hypothesis and questions, limitation of the study and definition of terms.
1.2 Background of Study
Cybersecurity risk assessment in financial institutions has become a central issue in modern banking due to the rapid expansion of digital financial services and the increasing sophistication of cyber threats. Cybersecurity risk assessment refers to the structured process of identifying, analyzing, and evaluating risks that may compromise the confidentiality, integrity, and availability of information systems within an organization, with the aim of implementing appropriate controls to mitigate such risks (NIST, 2020). In the financial sector, this process is particularly critical because banks manage sensitive customer data, large volumes of financial transactions, and interconnected digital infrastructures that are frequently targeted by cybercriminals.
According to Adeyemi and Oladipo (2021), the banking industry has experienced a significant rise in cyberattacks over the past decade due to increased dependence on digital technologies such as mobile banking, internet banking, and electronic payment systems. They reported that financial institutions are among the most vulnerable sectors globally because cybercriminals are constantly developing more advanced techniques to exploit system vulnerabilities. In Nigeria, this challenge is further intensified by infrastructural limitations and gaps in cybersecurity enforcement across institutions.
Nwankwo and Eze (2020) asserted that, the evolution of financial technology has improved service delivery in banks but has also expanded the attack surface for cyber threats. They stated that cyber risks such as phishing, ransomware, identity theft, and distributed denial-of-service attacks have become common occurrences in the Nigerian banking sector. These threats not only affect financial stability but also undermine customer confidence in digital banking systems. Zenith Bank Plc, as one of the leading financial institutions in Nigeria, is not exempt from these risks due to its extensive reliance on digital platforms for transaction processing and customer engagement.
According to Okoye and Chukwu (2020), financial institutions face increasing pressure to adopt effective cybersecurity risk management frameworks that can detect, prevent, and respond to emerging threats in real time. They affirmed that many banks still rely on outdated or fragmented security systems that are not capable of addressing modern cyber risks effectively. In addition, the integration of third-party service providers such as fintech companies and cloud computing platforms further complicates cybersecurity risk management in the banking sector.
Daramola (2019) stated that, human factors remain one of the most critical weaknesses in cybersecurity risk assessment within financial institutions. He asserted that employees often serve as entry points for cyberattacks due to poor awareness, inadequate training, and weak adherence to security protocols. Social engineering attacks, in particular, exploit human error to gain unauthorized access to banking systems (Daramola, 2019).
According to the Central Bank of Nigeria (2022), financial institutions are required to implement comprehensive cybersecurity frameworks that align with global best practices. It stated that banks must ensure continuous risk assessment, regular system audits, and robust incident response mechanisms to safeguard financial systems. However, despite these regulatory requirements, compliance levels vary among institutions, and enforcement challenges still exist.
Aliyu and Bala (2021) affirmed that, cybercrime in the banking sector has become more organized and financially motivated, with attackers targeting both institutional systems and individual customers. They contended that cybercriminals exploit weaknesses in authentication systems, network security, and user behavior to gain unauthorized access to financial information. The increasing use of mobile and internet banking platforms has further amplified these risks, making cybersecurity risk assessment an essential component of banking operations.
This study is set against the backdrop of increasing cyber threats in the financial sector, growing dependence on digital banking systems, and the need for more effective cybersecurity risk assessment frameworks in Nigerian financial institutions.
1.3 Statement of Problems
Investigation revealed that many tourism promotion efforts are still traditional in approach, relying heavily on outdated methods rather than interactive and engaging digital communication strategies such as social media marketing, virtual tours, and influencer engagement. According to Buhalis (2000), tourism destinations depend heavily on effective information dissemination to remain competitive in the global tourism market, where visibility plays a key role in decision-making by potential tourists.
Furthermore, inadequate coordination between media practitioners and tourism managers limits the ability to deliver accurate, consistent, and appealing messages about tourism products and services. As a result, many tourism destinations fail to fully harness the power of media as a tool for development, awareness creation, and sustainable tourism growth. It is against this backdrop that this study seeks to examine how media and communication systems influence the development of tourism by improving destination awareness, shaping tourist perception, and enhancing promotional strategies within the tourism sector.
1.4 Aim and Objectives of Study
The aim of this study is to assess cybersecurity risk management practices in financial institutions using Zenith Bank Plc as a case study.
The specific objectives of the study are to:
- Examine the types of cybersecurity risks faced by Zenith Bank Plc.
- Evaluate the existing cybersecurity risk assessment framework in Zenith Bank Plc.
- Assess the effectiveness of current cybersecurity control measures in the bank.
- Determine the impact of human factors on cybersecurity risk in Zenith Bank Plc.
- Identify strategies for improving cybersecurity risk assessment in financial institutions.
1.5 Research Questions
The study came up with research questions so as to be able to ascertain the above stated objectives. The specific research questions for the study are stated below as follows:
- What types of cybersecurity risks are faced by Zenith Bank Plc?
- How effective is the existing cybersecurity risk assessment framework in Zenith Bank Plc?
- How effective are the current cybersecurity control measures in mitigating cyber threats?
- How do human factors contribute to cybersecurity risks in Zenith Bank Plc?
- What strategies can improve cybersecurity risk assessment in financial institutions?
1.6 Research Hypotheses
In order to pursue the objective of this study, the following generalized statements have been designed to guide and aids in obtaining the result for the experiment to be conducted. For this work, the null hypothesis will be represented with H0 while the alternative hypothesis will be represented with hypothesis H1.
Hypothesis One
- H0: There is no significant relationship between cybersecurity risk assessment practices and cyber threat reduction in Zenith Bank Plc.
- H1: There is a significant relationship between cybersecurity risk assessment practices and cyber threat reduction in Zenith Bank Plc.
Hypothesis Two
- H0: Human factors do not significantly influence cybersecurity risks in Zenith Bank Plc.
- H1: Human factors significantly influence cybersecurity risks in Zenith Bank Plc.
Hypothesis Three
- H0: Existing cybersecurity control measures do not significantly improve risk mitigation in Zenith Bank Plc.
- H1: Existing cybersecurity control measures significantly improve risk mitigation in Zenith Bank Plc.
Hypothesis Four
- H0: Cybersecurity risk assessment frameworks do not significantly enhance threat detection in Zenith Bank Plc.
- H1: Cybersecurity risk assessment frameworks significantly enhance threat detection in Zenith Bank Plc.
1.7 Significance of Study
It is believed that at the completion of the study, the findings will help financial institutions improve cybersecurity risk assessment frameworks to reduce exposure to cyberattacks and financial fraud. The study will also help Zenith Bank Plc strengthen its internal cybersecurity policies and improve threat detection and response mechanisms.
Furthermore, the research will assist regulatory authorities such as the Central Bank of Nigeria in enhancing cybersecurity compliance monitoring within financial institutions. In addition, this study will benefit cybersecurity professionals by providing practical insights into real-world banking security challenges and risk management approaches.
Lastly, the research will serve as a reference for researchers and students interested in cybersecurity risk assessment in the Nigerian financial sector.
1.8 Scope and Limitations of the Study
The scope of the study covers cybersecurity risk identification, evaluation, and mitigation strategies within Zenith Bank Plc, Lagos State, Nigeria, focusing on digital banking systems and operational cybersecurity frameworks.
The study does not cover other financial institutions outside Zenith Bank Plc or cybersecurity risks unrelated to banking operations.
1.9 Definition of Terms
Cybersecurity Risk Assessment:
This is the systematic process of identifying, analyzing, and evaluating potential cyber threats to determine their impact and likelihood in order to implement appropriate security controls (NIST, 2020).
Cybersecurity:
This refers to the protection of computer systems, networks, and data from unauthorized access, attacks, or damage (Stallings & Brown, 2018).
Financial Institution:
This is an organization such as a bank that provides financial services including deposits, loans, and electronic transactions (Central Bank of Nigeria, 2022).
Risk Management:
This is the process of identifying, assessing, and controlling threats to an organization's capital and earnings (ISO, 2018).
Cyber Threat:
This refers to any malicious activity aimed at disrupting, damaging, or gaining unauthorized access to digital systems (ENISA, 2021).
Human Factor:
This refers to the role of human behavior and errors in contributing to cybersecurity vulnerabilities within an organization (Daramola, 2019).
…