Remote working conditions have opened a new window of opportunity for cybercrime, and online criminals have certainly taken advantage of this opportunity. Iain Massey, Senior Manager of Broker Enablement at Indwe, sheds light on the topic of cybercrime in South Africa, and how businesses can mitigate the risks of being the next target. 

When the Covid-19 pandemic reached South African shores in early 2020, the ensuing hard lockdown, launched on 27 March 2020, forced companies to abruptly adapt to remote working. Responding quickly, businesses had to source additional laptops, and other tech, and find new ways for previously office-bound staff to continue to work from their homes. 

Massey elaborates: “As organisational digital networks branched out into residential homes, more and more companies have found themselves increasingly vulnerable to cybercrime – and cybercriminals have certainly risen to the occasion!” 

Cybercrime is a growing threat to South African business

At the end of 2020, a study conducted by the Center for Strategic and International Studies estimated that malicious cyber activity costs the world $945 billion annually, while Cybersecurity Ventures estimates that global cybercrime costs could increase to $10.5 trillion by 2025. Alarmingly, South Africa is the second-most targeted country in the world when it comes to cyberattacks, according to PwC’sGlobal Economic Crime and Fraud Survey 2018. 

A recent IBM study has also revealed that the average cost of data breaches in South Africa is R48.1 million, a significant loss. The report sheds light on cybercrime as a growing threat to South African businesses: 

●        Cybercrime is the 4th most reported crime in South Africa and our phishing rate is the highest in the world, with 1 in every 785 emails identified as a phishing scam. 

●        Based on an analysis of data breaches experienced by South African organisations, the Ponemon IBM Cost of Data Breach Report 2021 found that the average total cost of a data breach was $1 million, or approximately R15 million higher where remote working is a factor causing the breach.

●        The report also stated that the average number of days to identify and contain a breach was 287 days, and the most common cause of malicious attacks globally was stolen or compromised credentials and cloud misconfigurations.

Cybercrime isn’t going away. Here’s what we can do about it

Virtual retail is now a daily reality, more so post-pandemic than ever before. It’s become necessary for businesses to adapt to the internet being an integral part of their day-to-day operations in the present and the future. To remain in command of cybersecurity in the new technological world, cybersecurity must be central to business, not a mere afterthought, no matter small or large that business is.

In fact, cybercriminals are now targeting small and mid-size businesses, as their defences are typically weaker than larger organisations. Once the smaller business’ systems are infiltrated, the cybercriminals might further gain an entry point into larger firms with whom the smaller company does business. 

The immediate effect of a cyberattack is an interruption to business services. However, other consequences could include reputational damage, loss of company assets, litigation, loss of business and financial loss. 

Massey implores managers, directors and board members to become more involved in ensuring that best practices are implemented and reviewed regularly as the technological landscape continues to change. “It isn’t just the IT division that’s responsible for cybersecurity,” he says. “The whole company needs to be involved and aware of the plans and processes that are in place to mitigate cybersecurity risk. If a staff member plugs a flash drive into their laptop to copy a document and it contains a virus, this affects the entire company connected to their network.” 

It’s now considered a matter of course that organisations offer full training to employees on data security and cyber threats and that all staff abide by a clean desk policy, which includes storing confidential documents in a safe place, whether in the office or at home. It’s also essential that all employee, client, customer and supplier data is stored and protected to comply with POPIA. 

For individuals and organisations in South Africa, cyberattacks are an increasing reality, which is why it’s paramount to take steps to protect yourself and your data, thereby reducing the risk of becoming a cybercrime victim.

Indwe urges business owners to take all the necessary precautions they can to protect themselves and their companies against cybercrime and, surrounded by so many unknowns, this should include investing in cybercrime insurance.