Over the past few years, organisations have seen accelerated waves of digitisation, digitalisation and digital transformation. State-owned and run organisations, many of which are in charge of critical infrastructure, are no exception.

While this rapid adoption of digital technologies has been crucial to operational efficiency and, ultimately, service delivery, it has also opened up new entry points for cybercriminals. 

The attack surface has increased, while the attacks by cybercriminals have grown in frequency, strength and severity. They’re also increasingly targeting critical infrastructure, including healthcare systems, utilities and ports. 

And while South Africa has yet to experience a truly devastating attack, it’s certainly not immune to one. If the country is to protect its critical infrastructure (some of which is already in a vulnerable state), it needs an integrated approach that brings together various arms of the state and uses the latest tactics in both attack prevention and response. 

A growing global problem 

Cyberattacks targeting infrastructure have become increasingly commonplace. Just within the past few years, several major global powers have seen incredibly disruptive attacks on their critical infrastructure.

In 2021, for example, an attack on the US’s Colonial Pipeline (which carries petrol and jet fuel to much of the southeastern US) caused it to shut down for several days. The impact of the shutdown was so great that President Joe Biden declared a state of emergency, suspending the limits on how much petroleum could be transported by road and rail. 

In the UK, an IT supplier to the National Health Service fell victim to a ransomware attack in 2022. As a result, several important functions – including patient referrals, ambulance dispatch, out-of-hours appointment bookings, mental health services and emergency prescriptions – were affected. 

Even smaller players on the world map aren’t immune to such attacks. In mid-2022, for instance, Estonia experienced its most intense cyberattack since 2007. And in May 2022, a ransomware gang infiltrated Costa Rican government systems. 

Education is critical – 95% of cybersecurity issues can be traced to human error.

Experts agree that in the case of South Africa, as with most countries, it is only a matter of time before the country experiences a highly disruptive attack. 

In fact, there have already been a number of cyberattacks on our shores. For example, a recent report by Interpol indicated that 34% of business email compromise events recorded in Africa were in South Africa. 

Integrated defences 

But what can the state and private sector players charged with running and maintaining critical infrastructure do to ensure that it’s kept as safe as possible? While there are no simple answers, an integrated approach is key. 

That starts with policy. If the government provides clear direction and makes it clear that cybersecurity is a countrywide responsibility, rather than something to be handled by a single department, everyone is much more likely to move in the same direction. Here, South Africa has already laid a decent foundation. 

The National Cybersecurity Policy Framework, for instance, has been in place since 2015. Led by the Ministry of State Security, its aim is to provide a holistic approach to the promotion of cybersecurity measures by players across South Africa. It is supported by the National Cybersecurity Implementation Plan, which lays out roles and responsibilities, timeframes, specific performance indicators and monitoring and evaluation mechanisms.

With those frameworks in place, education becomes critical – 95% of cybersecurity issues can be traced to human error. Social engineering and phishing attacks, in particular, are powerful tactics for cybercriminals and are used in the vast majority of cyberattacks.

Unless people working at all levels across an organisation know what attachments not to open and which links not to click on, there’s likely to be exposure. 

Read more in Daily Maverick: Catastrophic global cyber event predicted as SA government faces increasing attacks — experts

Beyond that, it’s also important to ensure that the relevant cybersecurity skills are developed and retained, particularly within organisations dealing with critical infrastructure. Here too there is work to be done. Research released by Fortinet in 2023 found that 40% of South African companies struggle to hire and retain cybersecurity talent. And 86% said they had experienced more than one cyberattack that could be at least partially attributed to a lack of cybersecurity skills over the past 12 months. 

Another area where integration is particularly important is intelligence. If state departments, organisations and those in the private sector are able to seamlessly share intelligence around the kinds of threats they face, then building proper defences becomes much easier. 

Preparing for the worst 

Of course, in a world where cyberattacks should be viewed as a matter of “when, not if”, an integrated response plan is also needed. In the event of a successful cyberattack, organisations need to be able to respond quickly and in a way that gets any affected critical infrastructure back up and running as quickly as possible. 

Read more in Daily Maverick: Five things South Africa must do to combat cybercrime

That response plan should clearly lay out key roles and responsibilities for a team drawn from departments across the organisation. That team should also be well drilled in dealing with different event scenarios. Additionally, it should cover everything from how attacks that have been successful are investigated, how vulnerabilities are patched up and how the attack should be communicated to stakeholders.       

While each organisation will have its own specific response plan requirements, it’s still possible for a broad cross-section of organisations to take an integrated approach and adopt similar best practices. 

Taking on a constant, growing threat 

Ultimately, cyberattacks are unlikely to decrease in frequency or ferocity in the near future. And in a fraught global sociopolitical and economic environment, attacks on critical infrastructure are only likely to grow in strength and sophistication. South Africa needs to be aware of that and plan accordingly. 

While an integrated approach won’t stop every attack, it will prevent many more than allowing organisations in charge of critical infrastructure to each take care of their own cybersecurity needs. Moreover, such an approach can also help mitigate the impact of any such attack. 

Right now, South Africa has the right building blocks in place for a fully integrated approach, but it should also be clear about the fact that there’s more to be done. DM

Adius Ncube is a partner in the Public Sector Practice in Johannesburg at management consultancy Oliver Wyman.