As digital transformation sees more companies digitise their businesses and processes, cybersecurity must be a top priority for companies to ensure cyber and informational safety.
With remote working, an increase in ransomware attacks and the general uptick in digital transformation, cybersecurity is at the forefront of the tech conversation worldwide – and South Africa is no exception.
According to Monique Hart, lead Solutions Engineer, Security SME at VMware SSA, South Africa has become a target of cybercrime due to law enforcement agencies being ill-equipped to detect and thwart it. This, coupled with underreporting of cybercrimes and companies not having the financial resources to immediately improve their systems, is part of the challenge.
“This is not something one person can fix, it needs to be a country effort,” she says.
The cybersecurity situation on the continent also rates as high risk. A report published by Interpol in 2021 on cybercrime in Africa found that the most prominent threats include online scams, digital extortion, business email compromise, ransomware, and botnets.
“The same Interpol report said that between January 2020 to February 2021 there were 679 million email threats detected, 8.2 million files compromised, 14.3 million web threats, and a total of 230 million threat detections in South Africa alone. In the same period Accenture identified South Africa as having the third-highest number of cybercrime victims worldwide. The cost of which Interpol tallied up to a whopping R2.2 billion a year. These are numbers almost impossible to comprehend!,” says Monique.
Having fallen prey to the most cyberattacks of any country on the continent, the state of South Africa’s cybersecurity also leaves a lot to be desired. The World Economic Forum outlined three main ways for governments to guard against cyberattacks: improving international participation, adjusting policy frameworks and increasing cybersecurityawareness with an emphasis on education Initiatives.
Monique explains that closer to home, South Africa has developed the Cybercrimes Act, which gives these crimes a name and provides both the police and the National Prosecuting Authority (NPA) the power they need to tackle cybercrime. This includes the NPA being able to investigate ransomware attacks, cyber forgery, extortion and the unlawful interception of data. However, there is still a lot of work to be done.
"Cybersecurity skills are scarce globally and even more so here in Africa. The majority of enterprises in South Africa have been hit by cybercrime, especially banks. Financial institutions need to continually launch consumer awareness initiatives and spend large amounts of money on education. A cyber criminal will always try to exploit the weakest link in the cyber chain: which just happens to be an end user, who is, as they say, a naïve and lucrative target,” she adds.
End users are typically most affected when their personal data like login information and usernames are compromised.
“We aren’t only speaking about logging into your bank or performing a financial transaction here, we are also referring to accessing your social net-works or even an application on your phone. This is exactly why we need the law on our side when challenging cybercrime, public awareness alone is not the only answer. Unfortunately we aren’t there yet, and even with growing education, awareness, and improved policing there is a long way to go,” she says.
Empowering employees: While improving cybersecurity might seem rather overwhelming, this can be addressed in a myriad of ways–one of the most key being education and training, including that of employees. However this will require support at an executive level, “Awareness and education is critical. The problem with the areas of both risk and security is that it’s not easy to prove that security awareness programmes work, which inadvertently leads to “egg on your face” situations for IT professionals trying to prove to executive teams that ongoing education is needed, according to Monique.
To get the balance right, business needs to go back to basics. Create a security vision around how they want security to be embraced by employees, which she says is more a case of defining what behaviours should look like and then communicating this to teams in meaningful ways. So, education is as much show and tell than it is a draconian approach to enforcing policies with no buy in.
Educating staff about different cybersecurity threats and ensuring that they know how to recognise them is crucial. Monique believes that many security infringements are a result of human error and some employees end up unwittingly giving protected information to hackers.
“If the research is to be believed, human error accounts for a massive number of all breaches. In fact, Gartner said that it’s as high as 22 percent. In our own experience working with clients, we have seen that while phishing and stolen credentials rank really highly in the types of breaches that are becoming more pervasive, the doorway into the business is always through people. But, remember, people are guided by outcomes, so show them how a change in behaviour will have a positive impact on the security posture of the business.”
It is also well documented that the global pandemic caused an upswing in remote working, which is one of the factors compromising cybersecurity, and increases the need for awareness for all employees. For example, malware and ransomware can compromise messages to and from a remote worker, culminating in infecting a remote worker’s computer and a company network.
Awareness is key for all employees and it’s important for team managers to provide cybersecurity training and to ensure that remote-working employees know how to secure their private networks, personal computers and laptops.
For more cybersecurity advice from leading experts, read the full article, which was originally published in the first-edition of CIO Magazine and is now available for download here.
