South Africans have become accustomed to dealing with crime because we have no other choice. Various sources place South Africa near the pinnacle of lists of the highest crime rates in the world. If you are a South African, or someone living in South Africa, you most likely take a number of precautions at home, work and play to avoid falling victim to crime.
We know that criminals can, and do, strike at any time and at any place. Rather than do nothing, we adjust the way we do things to minimise or remove our risk of falling victim to crime. From physical measures like burglar bars and electric fences to behavioural changes such as not leaving doors unlocked to intruders, being aware of our surroundings when out and about, to security measures such as placing our valuables under lock and key, either at home or via professional services such as bank safety deposit boxes.
These lived experiences– have given us pertinent lessons from everyday life that can be applied to a category of crime that increased by 50% in 2021: cybercrime. Businesses on these shores, like the rest of the world, must have solid strategies in place to deal with online crime such as ransomware attacks. As South Africans, how do we apply physical, behavioural and security insights gained from daily life to dealing with the scourge of cybercrime?
Victim-blaming isn’t one of them, even though it often seems that the first port of call when a business is hacked and held to ransom by cybercriminals is to partake in said activity. When high-profile breaches and ransomware attacks have made global headlines, the public is often uncompromising in their response.
This is likely due to the substantial reputational damage that a data breach or ransomware attack can cause for a business. Should a loss of security lead to customer data exposures, the damage can be catastrophic, as ever-savvy consumers who lose faith in the affected organisation’s ability to protect their data takes their custom elsewhere. Business clients will be no less exacting if firms cannot demonstrate the measures they’ve implemented to keep valuable information under the digital lock and key.
So, what can businesses do?
There is little global cooperation to fight it. Dave Russell, VP, Enterprise Strategy at Veeam wrote recently: “International and intercontinental cooperation is the only way to create an environment where the risks are higher than the rewards for cyber-attackers. The scourge of ransomware accelerated during the pandemic, increasing the appetite of government and business leaders to break the geopolitical impasse that has enabled cybercriminals to run riot. But it won’t be easy, and a workable holistic solution is still years away.”
What can we learn from how we have responded as South African society to our exceptionally high crime rate? We rely on our human instinct to protect ourselves in our homes and when we are out and about, we make clear plans about how to manage our safety, and we attend venues that are protected by professionally trained security who monitor and react to emergency situations.
Every organisation should do the same thing. No discussion about the internet or digital strategy can take place without a focus on cyber security. It must be always front-of-mind, and it needs buy-in across the entire organisation, not just the IT department. Every business should have someone who is in charge of the company’s security strategy and response, and this person doesn’t just need access to the leadership team, they should ideally be a part of it.
Staff training and awareness are non-negotiable. Initiatives should be ongoing, and organisations should consider penetration testing and developing their own dummy attacks – where a member of staff that falls victim to the exercise is not ostracised – rather it is used as constructive training.
While it would be a natural instinct for any business to do whatever it takes to prevent a catastrophe, paying a ransom should never be an option. To quote Dave Russell once more: “Paying off cybercriminals to get systems back online is an unsustainable defence strategy. As governments become more active in seeking to prevent the spread of ransomware, we may see businesses who do so be investigated and reprimanded by independent regulators.”
While it is important that governments and stakeholders around the world work together to expedite measures in raising the stakes for cybercriminals, it is equally important for individual businesses to do everything in their power to protect themselves from attack. This requires a comprehensive Modern Data Protection strategy that combines effective front-line cybersecurity defences with a comprehensive approach to data management, backup and disaster recovery.
Staff writer
Tagged: African Cybercrime, Security, Top Stories