Cyber threat intelligence practices in the national sphere of government in South Africa

Abstract

Over the past two decades, cybercrime and cybercriminals have had a great impact on the safety, security and protection of the public sector’s confidential data and information assets. The increased usage of the internet and new, advanced 4IR technologies, and the digitisation of government’s public sector goods and services have become a growing concern to the government and its public sector institutions. In the South African context, as a developing country, it unfortunately lags behind advanced and developed nations in terms of fully counteracting cybercrime and cybercriminal operations. Despite this challenge, the South African government has been making tremendous efforts in combatting cybercrime. The aim of this article is to contextualise the study and practice of cyber threat intelligence at the national sphere of government in the South African public sector, namely, the former Department of Energy (DoE), former Department of Science and Technology (DST) and the former Department of Environmental Affairs (DEA) a qualitative research approach was followed using a case study approach. Primary data was collected through semi-structured interviews with senior departmental management. The findings are presented according to the Threat Intelligence Lifecycle analysis which serves as an analytical framework. The study concludes that in order to achieve effective cybersecurity practices and principles in the public sector , the government must identify the top trends commonly associated with cybersecurity to be able to develop and implement counteractive strategies and approaches, as well as to improve security systems and programs to ensure that an organisation is sufficiently prepared for and protected against cybercriminals and cyberattacks.

Keywords: {'name': 'Government Data and Information Security Systems'}, {'name': 'cybersecurity'}, {'name': 'cyberrisks'}, {'name': 'cyber threat intelligence'}

Authors & affiliations

Lucia Masilela
Affiliation not supplied

Danielle Nel-Sanders
Affiliation not supplied

Deposited references

Supplied references, not a list of publications citing this article.

Accenture. (2015). How to Make Your Enterprise Cyber Resilient. South Africa: Accenture.

Brickey, J. (2012). Defining Cyber Terrorism: Capturing a Broad Range of Activities in Cyberspace. Retrieved from https://ctc.usma.edu/defining-cyberterrorism-capturing-a-broad-range-of-activities-in-cyberspace/. (Accessed on 10 March 2018).

Chismon, C., & Ruks, M. (2015). Threat Intelligence: Collecting, Analysing, Evaluating. London: MWR Info Security.

CyberEdge Group, LLC. (2018). The Threat Intelligence Handbook: A Practical Guide for Security Teams to Unlocking the Power of Intelligence. United States of America, Annapolis: CyberEdge Group, LLC.

Davis, F., & Ranchod, V. (2017). Cyber Risk: An Emerging Threat for the Banking Sector: “Why African Banks Must Focus More on Cyber Risk”. Johannesburg: Duke Corporate Education.

Department of Local Government and Human Settlements. (2015). Information Communication Technology: Policy on ICT Security. RSA: Northwest Provincial Government.

KPMG. (2017). Threat Prevention at the Highest Level: Overview of Risk for Insurance Brokers. South Africa: KPMG.

National Cyber Security Centre (NCSC). (2019). Cyber Threat Intelligence in Government: A Guide for Decision Makers and Analysts. United Kingdom Government: London.

Ozkaya, E. (2022). Practical Cyber Threat Intelligence: Gather, Process, and Analyse Threat Actor Motives, Targets, and Attacks with Cyber Intelligence Practices. BPD Online Publishing: London.

PwC. (2016). Economic Crime: A South African Pandemic: No Sector Region Is Immune. South Africa: PwC.

Republic of South Africa (RSA). (1996b). The Minimum Information Security Standards (MISS). Government Printer.

Republic of South Africa (RSA). (1998b). The State Information Technology Agency (SITA) Act, No. 88 of 1998. Pretoria: Government Printers.

Republic of South Africa (RSA). (2002a). The Electronic Communications and Transactions (ECT) Act, No. 25 of 2002. Pretoria: Government Printers.

Republic of South Africa (RSA). (2002b). The State Information Technology Agency (SITA) Amendment Act, No. 38 of 2002. Pretoria: Government Printers.

Republic of South Africa (RSA). (2002c). The Intelligence Services Act, No. 65 of 2002. Pretoria: Government Printers.

Republic of South Africa (RSA). (2002d). The Regulation of Interception of Communication and Provision of Communication-related Information Act (RICA), No. 70 of 2002. Pretoria: Government Printers.

Republic of South Africa (RSA). (2011). Cyber Security Awareness Month Fails to Deter Phishers. Available at: http://www.rsa.com/solutions/consumer_authentication/intel%20report/11541_Online_Fraud_report_1011.pdf. (Accessed on 10 September 2018).

Republic of South Africa (RSA). (2013). The Protection of Personal Information (PoPI) Act, No. 4 of 2013. Pretoria: Government Printers.

DOI: 10.1080/08850607.2013.780552

Tounsi, W. (2019). What is Cyber Threat Intelligence and How is it Evolving? Retrieved from https://media.wiley.com/product_data/excerpt/81/17863044/1786304481-46.pdf. (Accessed: 18 August 2023).

Wolfpack Information Risk (Pty) Ltd. (2016). SA Critical Infrastructure Protection (CIIP): Institutional Intelligence Report. South Africa: Wolfpack Information Risk (Pty) Ltd.

DOI: 10.1016/j.cose.2020.101867