Study of the Security Implications of Bring-Your-Own-Device Policies in Nigerian Banks

BYOD policies in Nigerian commercial banks present significant cybersecurity risks when personal devices connect to bank networks and access customer financial data without adequate endpoint security management. This study examined the security implications of BYOD practices in five commercial banks in Lagos State, South West Nigeria. A descriptive survey was conducted among 160 bank employees across IT, operations, and customer service departments who regularly used personal devices for work purposes. The questionnaire assessed device security configuration, bank data access behaviour on personal devices, awareness of BYOD-related risks, compliance with bank BYOD policies, and self-reported security incidents attributable to BYOD. Results showed that 74.4 percent accessed customer financial data on personal devices. Device encryption for work-related data was enabled by only 38.8 percent. Remote wipe capability for lost devices was configured in only 21.3 percent of work-enabled personal devices. Bank BYOD policy awareness was adequate in only 47.5 percent of respondents. Security incidents where data was accessed on a lost or stolen personal device were reported by 8.1 percent. The study concludes that BYOD practices in Lagos banks create significant unmanaged security risks and recommends formal Mobile Device Management implementation, mandatory BYOD policy training, minimum device security requirements for BYOD registration, and restricted data access permissions for unmanaged personal devices in Nigerian banking operations.

Keywords: BYOD security, mobile device management, banking sector, Lagos, data breach risk