Electricity and Control November 2024

CYBERSECURITY

Cybersecurity in South Africa’s public sector Following a series of cyber-attacks on state owned enterprises and government institutions it seems that South Africa’s public sector has become a prime target for cybercriminals. Cybersecurity specialists at ESET Southern Africa, say more robust security measures and greater awareness among public sector workers are needed to help close the gaps in cybersecurity.

O ne of the most significant issues in the public sector is the lack of comprehensive security management. The public sector, and municipalities in particular, remain among the most unmanaged environments in terms of cybersecurity. Although most entities have basic antivirus systems in place, these solutions are inadequate for the scale and complexity of their operations and often miss oth er critical elements which are necessary for an overarching cybersecurity strategy. This lack of tailored cybersecurity solutions leaves public sector entities vulnerable to a range of threats, which are increasingly complex and sophisticated. From ransomware attacks to data breaches, the consequences of cyber attacks in the public sector can be severe. Financial and operational impact The financial toll of cybercrime on South Africa’s public sec tor is a major concern. The Department of Public Works and Infrastructure recently reported that R24 million was stolen in a cyber-attack in May 2024, adding to the R300 million stolen over the past decade. Such incidents are not isolated. The Council for Scientific and Industrial Research estimates that cybercrime costs the South African economy up to R2.2 billion annually. Beyond financial losses, the operational impact can be just as severe. The 2021 attack on Transnet’s ports caused widespread disruption to critical import and export activ ities. These incidents don’t only affect the targeted entity. They have far-reaching consequences that can disrupt en tire supply chains. Policy and governance In response to the growing threat, the South African govern ment has introduced the Directive on Public Service Infor

mation Security. Issued under the Public Service Act, 1994, this directive provides much-needed guidance on informa tion security governance for national and provincial depart ments. However, more needs to be done to enforce these policies and ensure compliance across the public sector. There is a need for stronger governance and accountability. Public sector entities should have dedicated security teams, including Security Managers and Chief Security Officers, who can oversee the implementation of cybersecurity measures and ensure systems are regularly audited for vulnerabilities. Stealth and sophistication One of the most concerning aspects of cyber-attacks today is the ability of hackers to remain undetected within sys tems for extended periods and use sophisticated tactics to get employees, unwittingly, to release company payments into the wrong hands. Hackers can lay dormant in a net work for up to 298 days. During this time, they can collect passwords, banking information, and other sensitive data, only to strike when the moment is right. There are other examples where hackers duplicate the mailbox of a director, convincing personnel to make unau thorised purchases. These relatively low-level breaches can quickly escalate into major financial losses and opera tional disruptions. Proactive cybersecurity A proactive defence strategy is extremely important for public sector organisations to stay ahead of cyber crim inals. This includes implementing advanced technical solutions and developing a culture of security awareness among employees. Moving away from a reactive mindset towards a more proactive, preventive approach is a step in the right direction. Cybersecurity is not a one-time solution; rather, it’s an ongoing process that requires vigilance, adaptation, and a willingness to invest in people and technology to keep entities safe. ESET Southern Africa’s cybersecurity team has the ex pertise to offer guidance that will help government institu tions strengthen their defences and implement proactive cybersecurity strategies.

For more information visit: www.eset.com/za

Securing South Africa’s public sector in cyberspace requires robust technology, the right mindset, and appropriate skills.

30 Electricity + Control NOVEMBER 2024