Experts question SANDF’s cyber-defence readiness

The Defence Department of South Africa is facing scrutiny over its ability to protect the country's critical military infrastructure from cyberattacks. A report by Interpol revealed that South Africa accounts for 92% of ransomware detections in Africa, casting doubt on the SANDF's preparedness to withstand such threats. MK Party MP Irvin Mogale questioned Defense and Military Veterans Minister Angie Motshekga about the department's countermeasures, regulatory policy frameworks, and training programs in place to combat cyber threats.

Motshekga assured that the department has monitoring capabilities for its information and communications systems security, conducts monthly vulnerability assessments and penetration tests, and partners with various institutions for training defense personnel. However, Mike Bolhuis, a specialist investigator in serious crimes, argued that monitoring and identifying vulnerabilities are just part of an effective defense strategy.

He emphasized that weaknesses must be promptly addressed, security incidents contained before escalation, and critical systems must remain operational during and after an attack. Bolhuis stressed that cybersecurity strategies require measurable outcomes, including independent security assessments, defined incident-response procedures, regular simulations, reliable backups and recovery, and transparent progress reporting.

He cautioned that a policy framework alone does not guarantee effective protection without proper implementation, accountability, and adequate resources.

Professor Manoj Maharaj from the University of KwaZulu-Natal pointed out that the minister's response identified key elements of cyber defense but lacked details on response times, 24/7 monitoring, attack containment, and operational restoration. He advised the SANDF to translate these frameworks into clear responsibilities and tested arrangements for cooperation with civilian agencies and infrastructure operators.

Maharaj also recommended regular evaluations of the measures against the changing threat landscape and provided specific suggestions for improving the effectiveness of training programs, such as addressing phishing and impersonation using AI-generated voices or video.