South Africa steps up battle against cybercrime as Dexter trojan hits fast food chains
The South African government has appointed a new advisory body to help with policy and technical issues around online security and cybercrime.
The National Cyber Security Advisory Council (NCAC) will report to the Department of Communications (DOC), and will act as a bridge between government and private sector, and is one of a series of committees and agencies provisioned for under a national framework which was passed in to law earlier this year.
Speaking at the council’s inauguration, DOC Minister Yunus Carrim said that it "seeks to coordinate government’s activities on cybersecurity and also ensure more effective cooperation between government, the private sector and civil society in tackling cybersecurity threats".
Last year South Africa ranked as the second-most targetted country globally by phishing attacks. Many experts worry that the rising number of mobile broadband subscribers will be particularly vulnerable: according to Sunette Potgieter, who works for the South African Police Service's (SAPS) specialist Hawks Forensic Division, 44 percent of mobile subscribers in the country aren’t aware that their phones have security options at all.
The seven-member council is made up of academics, lawyers, government researchers and private sector representatives, including Microsoft South Africa's chief security advisor Dr Khomotso Kganyago. It has been broadly welcomed by industry.
Prenesh Padayache is the CTO at Internet Solutions, one of the countries largest network providers.
"South Africa needs coordination and collaboration between industry role-players in establishing a safer online environment for consumers and businesses alike to operate in," Padayache says. "The NCAC will provide the platform to ensure it becomes easier for this happen."
Padayache says that NCAC should, however, look to broaden its own advisory base.
"We would like to see the NCAC establishing a National Computer Security Incident Response Team (CSIRT) with representation from all sectors to address cybersecurity threats and promote cybersecurity awareness. We also see NCAC hosting educational workshops to ensure that the knowledge is adequately shared across the industry."
The issue of online security is high on the country's agenda at the moment, following news that a variant of the Dexter trojan has been discovered on servers belonging to fast food chains and other franchises. Earlier this week, the Payments Association of South Africa (PASA) released a statement confirming that card details had been compromised by the trojan, which intercepts payment details from Windows-based point of sale (POS) terminals.
Walter Volker, CEO of PASA, said that he believed card details had been accessed by an international criminal organisation, and that steps had been taken to contain the problem.
"PASA is working with the banks and the card schemes to implement immediate measures to block the potential exposure of personal card data and bring the merchants to a state of full compliance in relation to the Payment Card Industry Data Security Standards (PCI DSS)," Volker said.
South African technology site TechCentral reported that it believes tens of millions of rand have been lost, despite the fact that the virus only affects magnetic stripe card readers and not the chip and pin standard which is widely deployed in the country.
Because of this, Volker says that banks won’t be recalling cards en masse, but will be watching for suspicious behaviour on accounts and warning customers who they think have been affected.