Regulatory compliance is a key driving factor for companies and national organisations to implement and monitor cybersecurity, but this is lacking in South Africa.

The costs associated with robust information technology (IT) security are insignificant, compared with any other costs associated with IT projects, and good IT security best practice worldwide, says global cybersecurity firm Kaspersky Lab enterprise and presales VP Veniamin Levtsov.

“However, there is no sharing of threat intelligence (information regarding cyberthreats), even within industries in South Africa. These are the types of information that Kaspersky Lab generates regularly in its threat reports and research notes.”

Levtsov points out that, if there were statutory independent bodies monitoring the implementation of cybersecurity compliance, they could share anonymous threat information with all members rapidly, enabling a sector to respond more effectively.

Better cybersecurity regulation and compliance would also reduce the overall vulnerability of South African companies and organisations to targeted and advanced attacks.

Many South African enterprises and government organisations are ill-prepared for cyberthreats and cyberattacks, with a significant number of computers – Kaspersky Lab estimates 98 000 – in the country forming part of international botnets and used to commit cybercrimes.

Further, about R2.8-billion a year of gross domestic product is lost, owing to cybercrime and corporate networks being breached.

Kaspersky Lab global research and analysis senior security researcher Mohammad Amin Hasbini highlights that advanced persistent threats often try to breach a targeted company or key person in a company using any vectors available, including targeting supplier companies, trusted partners and personal assistants, beside other vectors.

Even between direct competitors within an industry, it benefits all companies to share information about threats, he notes.

“South Africans are very aware of their physical security, but seem to be naïve or lax about their cybersecurity. Even within a company, there is often poor cybersecurity-data sharing. This is why better cybersecurity regulations can help make such a dramatic improvement,” says Levtsov.

South Africa lags international levels of cybersecurity, despite the economy being fairly advanced, thus presenting a high-profile target for cybercriminals

.