Cybersecurity is one of the most significant risks facing South African companies and the government, as well as the world, with the World Economic Forum placing it among the top ten biggest threats faced by the world today. 

However, the ability of the private and public sectors to respond adequately to the threat hinges on developing a cybersecurity skills pipeline, Council for Scientific and Industrial Research (CSIR) cybersecurity systems research group leader Billy Petzer said on April 4 at a cybersecurity media briefing in Pretoria.

He said the biggest risk in terms of cybersecurity was people, but the good news was that this was easy to address, since about 98% of all cybersecurity breaches occured because of human error. Therefore, through better training, cybercrime incidents could be reduced.

“To address the issue of cybercrime, it's crucial to have a comprehensive strategy that involves both prevention and response. This includes measures such as investing in cybersecurity infrastructure, promoting cybersecurity awareness and education, implementing effective incident response plans, and cooperating with international partners to share information and resources,” Petzer said.

He added that South Africa was currently ranked sixth globally for cybercrime density - the amount of cybercrime per capita. 

“Some sources even place us as third, which is a worrying trend. As things stand at the moment, we are not looking great as a country,” he noted.

Petzer pointed out that the economic impact of cybercrime yearly in South Africa was estimated at about R2.2-billion, being the eighth most targeted country in the world for ransomware and having the highest incidence of business email compromise on the continent.

He pointed out that more than half of South African firms' systems were infected by ransomware at some point over the past year. 

“These are only the statistics that we know about, and some estimates suggest that the actual figures could be much higher,” he noted.

According to recent figures published by the South African Banking Risk Information Centre, losses in digital banking in South Africa have increased by about 25%, with fraud having increased by 63% since 2001. 

“There are also incidents that go unreported, such as cyber extortion, extortion and cyberbullying, which impact on individuals on the street who often do not report these incidents. The estimates for the prevalence of these kinds of incidents are quite worrying,” Petzer said.

He noted several cybersecurity attacks over the past year on several government departments, as well as private and State-owned entities, such as Transnet, Experian, Transunion, Life Healthcare, Shoprite Holdings and various South African banks.

The problem is that we have such a unique and complex socioeconomic landscape, that the challenges faced locally are compounded even further on a local level,” Petzer said.

He believes South Africa is the most unequal country in the world, which has resulted in a high rate of poverty and a high unemployment rate, which drives a high crime rate. 

“What this further does is serves to provide a big, vulnerable population to crime. The population who [mainly] live under the bread line are more vulnerable [and] are the ones who suffer more easily from fraud, financial theft or cyber incidents. The impact on a vulnerable individual is much higher than the more affluent counterpart,” Petzer said.

He noted that improving South Africa’s cybersecurity capabilities was critical because it was the most technologically advanced country in Africa, with high smartphone penetration in particular. With more people accessing the Internet, more were at risk of cybersecurity threats.

“Some estimates put it at about 90% per capita of the population that has a smartphone or access to a smartphone with a high level of Internet access. At the moment, 2% of people have access to Internet, a large portion of which is by mobile. This is predicted to reach more than 90% by 2027,” Petzer explained.

He argued that, to effectively combat the threat of cybercrime, more cybersecurity professionals needed to be trained, as there was a critical shortage of the skills needed globally.

“We need to collaboratively invest in our youth, in our people, and in our organisations. We need to give them training opportunities and exposure. Even if you're afraid that they might move on to other opportunities, the market and the country will still benefit. We need to endeavour to make the field more accessible.

"The barrier to entry to become a cybersecurity professional is too high. We need to look at that through collaborative efforts, which emphasize training and awareness. We need to promote collaboration, partnership and support, and we need to share information, resources and knowledge,” Petzer implored.

He warned that it was important for individuals and organizations to take steps to protect themselves from cyberthreats. This included using strong passwords, regularly updating software and operating systems, being cautious when opening emails and clicking on links, and backing up important data regularly.

“It's also important for individuals and organisations to report incidents of cybercrime to the relevant authorities, even if they don't think anything can be done about it. Reporting cybercrime helps law enforcement to identify patterns and trends, and can also help to prevent future attacks,” he said.