By Adius Ncube, Partner, Public Sector and Policy at Oliver Wyman

Over the past few years, organisations have seen accelerated waves of digitisation, digitalisation, and digital transformation. State-owned and run organisations, many of which are in charge of critical infrastructure, are no exception. While this rapid adoption of digital technologies has been crucial to operational efficiency and, ultimately, service delivery, it has also opened up new entry points for cybercriminals. 

The attack surface has increased, and meanwhile the attacks launched by cybercriminals have grown in frequency, strength, and severity. They’re also increasingly targeting critical infrastructure, including healthcare systems, utilities, and ports. 

And while South Africa is yet to experience a truly devastating attack, it’s certainly not immune to one. If the country is to protect its critical infrastructure (some of which is already in a vulnerable state), it needs an integrated approach that brings together various arms of the state and makes use of the latest tactics in both attack prevention and response. 

A growing global problem 

Cyberattacks targeting infrastructure have become increasingly commonplace. Just within the last few years, several major global powers have seen incredibly disruptive attacks on their critical infrastructure. In 2021, for example, an attack on the United States’ Colonial Pipeline (which carries gasoline and jet fuel to much of the Southern Eastern United States) caused it to shut down for several days. So big an impact was the shutdown that US President Joe Biden called a state of emergency, suspending limits on how much petroleum could be transported by road and rail. 

In the UK, meanwhile, an IT supplier to the country’s National Health Service (NHS) fell victim to a ransomware attack in 2022. As a result, several important functions – including patient referrals, ambulance dispatch, out-of-hours appointment bookings, mental health services and emergency prescriptions – were affected. 

Even smaller players on the world map aren’t immune to such attacks. In mid-2022, for instance, Estonia was the victim of its most intense cyberattack since 2007. And in May last year, a ransomware gang infiltrated Costa Rican government systems. 

Experts agree that in the case of South Africa, as with most countries, it is only a matter of time before the country experiences a highly disruptive attack. 

In fact, there have already been a number of cyber attacks on our shores. For example, a recent report by Interpol indicated that 34% of business email compromise events recorded in the continent were in South Africa. 

Integrated defences 

But what can the state and private sector players charged with running and maintaining critical infrastructure do to ensure that it’s kept as safe as possible? While there are no simple answers, an integrated approach is key. 

That starts with policy. If the government provides clear direction and makes it clear that cybersecurity is a country-wide responsibility, rather than something to be handled by a single department, everyone is much more likely to move in the same direction. Here, South Africa has already laid a decent foundation. 

The National Cybersecurity Policy Framework (NCPF), for instance, has been in place since 2015. Led by the Ministry of State Security, its aim is to provide a holistic approach to the promotion of cybersecurity measures by players across South Africa. It is supported by the National Cybersecurity Implementation Plan, which lays out roles and responsibilities, timeframes, specific performance indicators, and monitoring and evaluation mechanisms.                   

With those frameworks in place, education becomes critical. Remember, 95% of cybersecurity issues can be traced to human error. Social engineering and phishing attacks, in particular, are powerful tactics for cybercriminals and are used in the vast majority of cyberattacks. Unless people working at all levels across an organisation know what attachments not to open and which links not to click on, there’s likely to be exposure. 

Beyond that, it’s also important to ensure that the relevant cybersecurity skills are developed and retained, particularly within organisations dealing with critical infrastructure. Here too there is work to be done. Research released by Fortinet earlier this year found that 40% of South African companies struggle to hire and retain cybersecurity talent. Additionally, 86% indicated that they had experienced more than one cyberattack that could be at least partially attributed to a lack of cybersecurity skills over the past 12 months. 

Another area where integration is particularly important is intelligence. If state departments, organisations, and those in the private sector are able to seamlessly share intelligence around the kinds of threats they face, then building proper defences becomes much easier. 

Preparing for the worst 

Of course, in a world where cyberattacks should be viewed as a matter of “when, not if”, an integrated response plan is also needed. In the event of a successful cyberattack, organisations need to be able to respond quickly and in a way that gets any affected critical infrastructure back up and running as quickly as possible. 

That response plan should clearly lay out key roles and responsibilities for a team drawn from departments across the organisation. That team should also be well drilled in dealing with different event scenarios. Additionally, it should cover everything from how attacks that have been successful are investigated, how vulnerabilities are patched up, and how the attack should be communicated to stakeholders.       

While each organisation will have its own specific response plan requirements, it’s still possible for a broad cross-section of organisations to take an integrated approach and adopt similar best practices. 

Taking on a constant, growing threat 

Ultimately, cyberattacks are unlikely to decrease in frequency or ferocity in the near future. And in a fraught global socio-political and economic environment, attacks on critical infrastructure are only likely to grow in strength and sophistication. South Africa needs to be aware of that and plan accordingly. 

While an integrated approach won’t stop every attack, it will prevent many more than allowing organisations in charge of critical infrastructure to each take care of their own cybersecurity needs. Moreover, such an approach can also help mitigate the impact of any such attack. 

Right now, South Africa has the right building blocks in place for a fully integrated approach, but it should also be clear about the fact that there’s more to be done.