Cyber criminology for financial gain continues to be an escalating global trend but education and being proactive will go a long way to beating the cyber criminals, says GRAHAM CROOCK, Director, IT Audit, Risk and Cyber Lab BDO.
Cyber crime for financial gain continues to be an escalating global trend but education, being prepared and proactive will go a long way to beating the cyber criminals. In the context of the African continent, South Africa has emerged as the preferred destination for cybercrime, worldwide, due to two reasons.
The past 20 years has seen rapid growth in information-based technology infrastructure. We use a lot of optic fibre and we have big data warehouses and storage facilities. Our banks are on par with or ahead of the European and American banks in this regard.
The advanced infrastructure makes South Africa a hotspot for cybercrime activities. What further aids the criminal activity is that as a country, we are capable of formulating and promulgating laws, however we are weak at policing them.
The scourge of cybercrime in our country is escalating at an alarming rate. One of the few solutions to combatting this lies formulating crowd-sourced solutions, which can form the basis of preventing future attacks and shutting the door on cyber criminology.
South Africans are less informed about cybercrime than we should be, however, research also indicates a steady surge towards a more proactive attitude towards prevention.
Education and preparedness play pivotal roles in this proactive approach. A key focus in educating users is overcoming the misconception that cybercriminals are merely felons who perpetuate their attacks from dark, isolated locations. The fact is that cyberattacks can be carried out from the very same office location that is being targeted. All cybercriminals require is a computer and an internet connection.
Education means teaching users how to respond to cyberattacks. Users must know who to call, what to shut down and when to switch off their hardware in the event of an attack. These actions must be the critical focus of every training and this should be integrated with response teams.
Training is now also become available online, making it more accessible, so, companies need to budget and invest in these training platforms.
Over and above education and training, legislation is integral in combatting cybercrime and protecting companies from its consequences. Unfortunately, in the current context, the legislation that exists has proven inadequate in protecting companies from the consequences of cybercrime.
There are currently four pieces of legislation that are earmarked to protect us from cybercrime:
· National Cybersecurity Policy Framework
· Cybercrimes and Cybersecurity Bill
· The Electronic Communications and Transactions Act (25 of 2002)
o Cyber Inspectors
o Cyber Crime
· Protection of Personal Information Act (4 of 2013)
POPI (Protection of Personal Information), which has not yet been passed by parliament, however, is imminent and will be key in providing defensive merits over personal information.
However, a key facet of legislation is ensuring that legislation stays abreast of the technology development that continues rapidly — a challenge for every government in the world.
The complexities which arise encompass the strategic alignment of how legislation is modified and reformed to better protect users. Key to this approach is also the rate of legislation being passed into law, something which continues to stifle the progression of effectively combatting cybercrime.
If we are going to efficiently fight cybercrime, we cannot have a one-dimensional perspective. We need to observe the general persuasive crime and corruption that is prevalent in the market, because before a criminal can become an effective cybercriminal they need to be good social engineers capable of manipulating people and extracting information from them. This is inevitably where cybercrime links to bribery and corruption.
The very essence of how these attacks are often launched and perpetuated emphasises the need for stringent methods of regulation, monitoring and recovery processes, to learn from these cyberattacks and close the loop, ensuring that we do not become susceptible to them again. Therefore, as complex as it is to regulate cybercriminal activity, common law principles also have a role in how we deal with cybercrimes.
South Africa also plays an integral part in the economic growth of the continent, thus making it a lucrative economic hotspot for cybercriminal activity. This inevitably means that out of all the African countries, we have the most malicious IP activity.
The infrastructure and our economy means that South Africa is also a prime location to tunnel and launch attacks to other parts of the world as well — an activity which further delves into the complexities of cyberattacks.
Effective education and training platforms, coupled with the proactive attitude towards ensuring necessary precautions and positive attitudes towards cybercrime will be the impetus for us to overcome this scourge.