SA National Defence Force at risk of cyberattacks, research finds

The SA Defence Force (SANDF) is vulnerable to cyberattacks just like any other organisation.

These are the findings of Kyle Bester’s doctoral thesis titled “Exploring the views and perceptions of cybersecurity among South African military offences”. Bester, a research psychologist and cybersecurity awareness training specialist, obtained his doctorate in military science at Stellenbosch University recently. He urged the SANDF to increase cybersecurity awareness among military officers, offer them appropriate training and education, and purchase the required technology to prevent cyberthreats.

“Cybersecurity awareness is necessary for transforming not only the SANDF's organisational culture concerning how technology is embraced, but also how threats are perceived and eventually mitigated,” said Bester.

Bester explored military officers' views and perceptions of cybersecurity. He said these could provide insight into how the SANDF promotes cybersecurity awareness and mitigates threats.

He interviewed senior-ranking officers enrolled in a professional military development course at the SA National Defence College. He also asked students at the academy and the SA National War College to complete a questionnaire on information sharing, security orientation, cybersecurity awareness, and cyberculture.

The military officers were aware of cyberthreats that could harm the SANDF and have adapted their offline and online security behaviour appropriately, he said. 

“They were of the view that it was not safe to share organisational information on social media platforms as this may put the SANDF at risk of cyberattacks. They also felt their personal information was important, which might imply the ill-considered exchange of personal data in cyberspace might leave them vulnerable to being exploited,” said Bester.

“They were aware of the importance of information security and the consequences associated with a lack of compliance with cybersecurity guidelines in the organisation.

“Information sharing practices were identified as an area of concern, as the information about threats may not necessarily be filtered through all the ranks in the organisation which could make it difficult to identify and respond to them efficiently.”

Bester said the participants also emphasised the need for education and training to create cybersecurity awareness across the organisation.

“It could be difficult to implement a uniquely tailored cybersecurity education training programme suited for the various security levels in the organisation because of the SANDF's continued budgetary constraints,” said Bester.

Participants also indicated a need for more efficient software and technological tools to deal with cybersecurity threats in the SANDF.

“Some also felt more attention should also be paid to best practices and policy guidelines on cybersecurity in the organisation,” he said.

Bester said the SANDF realises the importance of cybersecurity, especially since it engages in cyber-surveillance together with law enforcement agencies and intelligence services. Cyberspace is of interest to the military because it allows it to identify internal and external countermeasures, as well as increase opportunities for resilience against threats, thus extending operational activities and protecting its own interests and maintaining national cybersecurity, he said.

“It is, therefore, of key importance for all military personnel to remain informed about relevant security risks and possible threats they might encounter in a professional or personal context. They are key for maintaining cybersecurity in the SANDF, as well as for employing policies and directives.

“Increased cybersecurity awareness is paramount because military officers are vulnerable to being misled or even forced by nefarious online actors to share sensitive information about operational activities. They could also create involuntary or voluntary points of access for malicious software through which these actors could enter the SANDF's network.”

Consequently, further emphasis should be placed on exploring military officers' perceptions concerning cybersecurity as the human component has already been identified as the main vulnerability in managing security, said Bester.

TimesLIVE