Study of the Security Practices of E-Commerce Businesses in Lagos State

The rapid growth of e-commerce in Lagos has created a large surface of digital transactions and customer data that small and medium-sized online businesses frequently lack the capacity to adequately protect. This study assessed the cybersecurity practices of e-commerce businesses operating in Lagos State, South West Nigeria. A descriptive survey was conducted among 150 SME e-commerce operators in Lagos Island, Ikeja, and Surulere through convenience and snowball sampling. The questionnaire assessed SSL certificate deployment, payment gateway security compliance, customer data handling, staff security awareness, and vulnerability assessment frequency. Results showed that SSL certificates were deployed by 72.7 percent of businesses. Payment Card Industry DSS compliance was understood by only 28.0 percent and actively maintained by 18.7 percent. Customer data was stored in plaintext by 41.3 percent of respondents. Staff security awareness training had been conducted in the preceding year by only 23.3 percent. External security audits had never been conducted by 73.3 percent of businesses. Smaller businesses with fewer than five staff showed significantly worse security practices than larger SMEs across all dimensions (p < 0.05). The study concludes that e-commerce security standards in Lagos are inconsistently applied and particularly weak in data protection and compliance. Recommendations include NITDA-led SME e-commerce security certification, subsidised security assessment services, mandatory PCI DSS compliance for payment processors, and a digital security standard for registered e-commerce businesses in Lagos State. Keywords: e-commerce security, SME cybersecurity, PCI DSS, Lagos State, data protection