Cyber threats are growing in volume and intensity as well as sophistication, evidenced by the recent Wannacry and Petya cyberattacks. The Cybercrimes and Cybersecurity Bill of 2017 has been introduced with the aim of providing South Africa a coordinated approach to fighting cybercrime, resulting in a more secure cyber universe. The bill will also create a list of new cybercrime and cybersecurity offences that are related to data, messages, computers and networks.
For example, using personal or financial information to commit an offence, hacking and unlawful interception of data, as well as computer-related forgery and uttering, extortion or terrorist activity. The bill will further place a responsibility on organisations to report cybercrime within specific timeframes, as well as providing a mechanism to force financial service and telecommunications providers to supply specific information on offenders and their activities when using their infrastructure or services to commit cybercrimes within a period of 72 hours of becoming aware of the cyber threat.
When hackers breach an organisation’s servers, most of the resulting consequences are related to identity theft, reputational and brand damage, or financial and intellectual property loss. As enterprises and government agencies increasingly adopt cloud, mobile, and social computing, information technology (IT) environments are becoming more difficult to defend. Increasingly, organisations need to accept that security breaches are inevitable.
Security strategies need to go beyond defence to include detection, response, and recovery. All this gives rise to a need for new skills, approaches and specialised tools and services, including continuous monitoring and threat forensics powered by analytics because of the impact of the Bill on data governance processes.
Private and public sectors have rapidly adopted new technology to better serve constituents and reduce dependency on legacy systems that are difficult to maintain. Ironically, the very steps taken to embrace these new innovations add to the cyber risks. It has become important to begin viewing the management of cyber risk as a core function of running organisational operations, particularly in the financial services sector and telecommunications service providers which carry sensitive consumer information.
According to a Norton by Symantec cybercrime report release 2016, technology experts saw cybercrime becoming more prevalent in South Africa costing the economy up to R35 billion in 2015 at an average cost of R4 000 per victim. The cybercrime report further noted that within the last year, 689 million people in 21 countries globally experienced cybercrime. Cybercrime has become so prevalent that many people equally fear online and real-world risks.
Security can no longer be classified as a grudge purchase but as an operational necessity, it is now about protecting people not just intangible IT assets. Further, there is value in updating organisations’ processes and technology to implement controls around cybercrime which will include improved data governance and compliance with other regulation such as the Protection of Personal Information Act 4 of 2013 and the Financial Intelligence Centre Act, as amended.
Technology has been at the core of the telecommunications and financial services sectors, with the last 10 years seeing growth in the use of devices such as smartphones that have changed the way financial services consumers and suppliers interact. Business now needs cognitive analytics to understand the criminals’ phishing behaviours, replay the behaviours and block the attacks.
Although the concept of the bill is valuable, there are still concerns around the negative effects that it could have on the everyday person’s day-to-day online habits that could, in extreme cases, result in one being arrested. Taking guidance from Europe, however, where data protection and cybercrime legislation is more mature and practicalities have been tested, will be imperative for South African lawmakers and organisations.