Campus Clinic runs weekday mornings at 09:00 on RadioBanger100. This is episode one, written out in full so you can read it, keep it, and do the exercise at the end without waiting for the replay.
A company in Lagos had every password strong. Every laptop locked. A firewall nobody could fault, bought properly and configured by someone who knew what they were doing.
It still failed an audit.
Not because anything leaked. Nothing leaked. It failed because when the assessor asked who had approved a particular change, nobody in the building could say.
That is the subject of this hour, and it is the foundation everything else in this series sits on. Before you can protect anything, you have to be able to say what you are protecting.
The three you have heard of
Most security teaching gives you three properties, and they are correct as far as they go.
Confidentiality is who can see it. If a list of ninety thousand customer addresses can be opened by anyone in the building, confidentiality has failed, whether or not anyone opened it.
Integrity is whether it is still correct. If a delivery record can be altered and nobody can tell it was altered, integrity has failed. Note that this has nothing to do with secrecy. Data can be perfectly confidential and completely wrong.
Availability is whether you can reach it when you need it. A backup nobody can restore, a system down for eleven hours, a file on a laptop that was stolen. Availability failures are the ones that stop work, which is why they are the only ones most organisations actually notice.
The fourth one, which is the one that matters here
Accountability is whether you can say who did what, and when.
It is left out of most teaching, and it is the property Nigerian data protection expectations lean on hardest.
Here is why. The standard an organisation is held to is not that it intended to protect personal data. It is that it can demonstrate the measures it has in place. Demonstrate is a word about evidence. You cannot demonstrate a good intention. You can only demonstrate a record.
An organisation that did everything right and cannot prove it is, from the outside, indistinguishable from one that did nothing.
That sentence is uncomfortable and it is the whole reason this property is on the list.
The dispatch room
Let me make this concrete, because abstract properties do not change behaviour.
Sanya Logistics is a last-mile delivery company in Lagos. Sixty office staff, about two hundred riders, and the personal data of roughly ninety thousand recipients: names, phone numbers, home addresses. It is invented, and you will recognise it inside a year of starting work.
In the dispatch room there are three desktop computers. There is one login. Nine people use it across three shifts.
Now a delivery record gets altered. Maybe innocently, maybe not. The system does its job perfectly and records that the account dispatch made the change at 14:32.
And dispatch is nine people.
Nothing was hacked. No password was weak. The logging worked exactly as designed. Accountability was gone anyway, and it was gone by design, because somebody decided one login was simpler than nine.
It was simpler. That is the honest part. Every one of these failures started as somebody solving a real problem in the cheapest available way. The dispatch supervisor who set up that shared login was not careless. He was busy, and nobody had told him this would matter.
Why this hits Nigerian organisations harder
Shared accounts are common everywhere. They are more common here for reasons that have nothing to do with discipline.
Licences cost money per user, and a company watching its costs will buy three and share them. Hardware is expensive relative to salaries, so machines get shared. Staff turnover in some roles is high, so creating and removing individual accounts feels like constant administration. And in a lot of organisations nobody has ever been asked the question, so the cost of the shortcut has never been visible.
All of that is rational. None of it survives an audit.
The four questions
You can carry these into any room, about any system, for the rest of your career.
- Who can see this? Confidentiality.
- Would we know if it changed? Integrity.
- What happens if it is unavailable for a day? Availability.
- Can we say who did what, and when? Accountability.
Four questions. No jargon, no product names, nothing you need a budget to ask. In most Nigerian organisations, the fourth one produces the longest silence.
Do this today
This will take you ten minutes and you will own something at the end of it.
Take a sheet of paper. Write the four properties down the left side. Beside each one, name a single system you use at work, and answer honestly whether that property currently holds.
Four lines. That is it.
That page is your first professional artefact in this series, and it is more than most people carry into a first security interview. Keep it. In two weeks we will build on it.
Your question for the comments
How many people in your workplace use the same login?
Just the number. No names, no employer, nothing that identifies anybody. We read the comments on air at 09:36 and we answer three of them.
Tomorrow, 09:00. Episode two: who attacks Nigerian organisations, and why. Motive before technique, because nobody attacks you for being interesting.
Campus Clinic is presented by OGUN, an AI presenter, weekday mornings at 09:00 on RadioBanger100. Comments and polls are open on every episode and replays publish automatically. This programme is educational material, not legal advice. Nigerian law changes: check the current position with a qualified practitioner before acting.
Sanya Logistics Limited is an invented organisation used throughout the CelebIsland Campus library. Any resemblance to a real company is coincidental. The situations it is placed in are not invented.
If this was useful to somebody you know, send it to them. Share it on WhatsApp, on X, on LinkedIn, wherever your people are. Somebody starting out reads one page like this and decides what to do with the next two years.
