Although the South African National Defence Force (SANDF) as an organisation is, and senior SANDF officers individually are, aware of the importance of cybersecurity, awareness of, and education and training regarding, cybersecurity within the SANDF as a whole has to be increased. In addition, the organisation has to acquire the necessary technologies.

These were the findings of Stellenbosch University research psychologist and cybersecurity awareness training specialist Dr Kyle Bester. He interviewed senior SANDF officers attending courses at the South African National Defence College, while other officers attending the South African Military Academy and the South African National War College filled in questionnaires that he drew up, on the various aspects of cybersecurity. (This research was for his PhD thesis.)

“They were aware of the importance of information security and the consequences associated with a lack of compliance with cybersecurity guidelines in the organisation,” he reported. “Information sharing practices were identified as an area of concern, as the information about threats may not necessarily be filtered through all ranks in the organisation which could make it difficult to identify and respond to them efficiently.”

The SANDF itself engaged in cybersurveillance, as did the country’s law enforcement and intelligence agencies. The military interest in cyberspace embraced the identification of external and internal countermeasures, and greater resilience against threats. This allowed the extension of its operational activities, the protection of its own interests, and the maintenance of national cybersecurity.

“It could be difficult to implement a uniquely tailored cybersecurity education training programme suited for the various security levels in the organisation because of the SANDF’s continued budgetary constraints,” he cautioned. Moreover, the organisation needs to invest in more efficient cyber technology and software tools to counter cybersecurity threats. “Some [officers] also felt more attention should be paid to best practices and policy guidelines on cybersecurity in the organisation.”

It is essential that all SANDF personnel stay informed about cybersecurity risks and possible threats, in both their professional and personal lives. It is the personnel who are the essential element in maintaining the SANDF’s cybersecurity and who will implement the organisation’s policies and directives on the matter, he stated.