Study of the Security Implications of Using Public Cloud Services in Small Businesses in Jos, Plateau State

Small businesses in Jos increasingly use public cloud services for storage and collaboration without adequate understanding of shared responsibility models and data protection obligations, creating security gaps that merit documentation. This study assessed the cloud service usage and security practices of small businesses in Jos North and Jos South Local Government Areas, Plateau State, North Central Nigeria. A descriptive survey was conducted among 130 small business owners and managers who used cloud services such as Google Workspace, Microsoft 365, or Dropbox. The questionnaire assessed data classification before cloud upload, understanding of shared responsibility, access control management, multi-factor authentication use, and contractual awareness of data residency. Results showed that 64.6 percent uploaded sensitive customer data to cloud storage without any classification process. The shared responsibility model was correctly understood by only 19.2 percent. Multi-factor authentication for cloud accounts was enabled by 28.5 percent. Administrator access was shared with non-IT staff by 47.7 percent. Cloud service terms regarding data location were reviewed by only 12.3 percent. The study concludes that cloud security practice among Jos small businesses is inadequate and recommends a small business cloud security guide published by SMEDAN, multi-factor authentication activation campaigns by cloud service providers in the Nigerian market, and the NITDA minimum cloud security standard for SME adoption.

Keywords: cloud security, small businesses, public cloud, Jos Plateau State, data protection