KRM 320: Cybercrime and Cyber Security in South Africa

Comprehensive practice flashcards for KRM 320 covering cyber incident classifications, perpetrator types, motivations, historical trends in South Africa (2010–2020), cybersecurity measures, and core cybercrime concepts.

What two noteworthy cyber incidents did the City of Johannesburg experience during 2019?

1. A ransomware attack affecting City Power, the City of Johannesburg electricity utility.
2. A network breach detected after a ransom note was received from a group called the Shadow Kill hackers.

Which major South African private hospital operator fell victim to a cyberattack during the COVID-19 pandemic surge?

Life Healthcare Group (the second-largest private hospital operator in South Africa).

What reporting limitation exists regarding South Africa’s national Computer Security Incident Response Team?

While it provides a service for stakeholders to report cyber incidents, it does not report such incidents to the general public.

How many newsworthy cyber incidents affecting South Africa were analyzed in the decade study (2010–2020) by Pieterse?

74 newsworthy cyber incidents.

What criteria were used to select the cyber incidents analyzed in the 2010–2020 study?

The incident had to affect South African organisations or citizens, and its impact had to cause a breach or lead to financial loss.

How is a "Compromised website" defined as a cyber incident type?

Intentional or unintentional activity affecting the confidentiality, integrity, or availability of the website.

How is "Cybercrime" defined in the incident type classification?

Criminal activity involving a computer, network device, or network causing financial impact.

What does the incident type "Data exposure" refer to?

Disclosure or leakage of data or information within the public domain.

How is "System intrusion" classified in cyber incident types?

Unauthorised or illegitimate access to a system or network.

What does a "Denial of service" cyber incident entail?

Preventing authorised or legitimate users from accessing network resources.

How is a "Hacktivist" (or "Hackivist") defined in the perpetrator type category?

An individual or group affiliated with activist groups promoting political agendas of social change.

How is an "Insider" defined in perpetrator classifications?

An individual with a trusted relationship, institutional knowledge, and legitimate access but acting maliciously for personal gain.

What is the definition of a "Hacker" according to perpetrator types?

A well-versed or unskilled individual using tools developed by elite computer users to break security and infiltrate networks or information systems.

How is a "Cybercriminal" defined in perpetrator types?

An individual or group affiliated to criminal groups motivated by financial gain.

What constitutes a "Nation state" perpetrator?

State-sponsored sophisticated hackers who target the information systems or networks of other countries.

What defines a "Non-malicious individual" perpetrator?

A person causing internal or external disclosure of a security flaw or a vulnerability affecting an information system.

What are the five categories used to classify the motivation behind cyber incidents?

1. Political (e.g., spreading propaganda)
2. Economic (illegal actions driven by financial gain)
3. Fun/Personal (proving skills, solving problems, exposing flaws)
4. Accidental (unintentional/unexpected discovery of a vulnerability)
5. Criminal (conscious decision to intentionally conduct wrongdoing)

What notable cyber incident took place in South Africa in 2012?

A hacker named H4ksniper claimed responsibility for disrupting three South African governmental websites.

What recurring cyber incidents occurred in South Africa during 2013–2014?

Several accidental exposures of confidential data, including multiple occasions involving the exposure of personally identifiable information (PII) by Vodacom.

What was the cause of the mass hacking of South African websites in 2014?

Unpatched security vulnerabilities in websites using outdated versions of web content management systems.

What shift in cyber incident trends occurred in South Africa between 2016 and 2020?

Compromised websites remained frequent, but there was an increase in cyber incidents exposing data that were found to be politically or criminally motivated.

What was the most prevalent cyber incident type in South Africa over the analyzed decade (2010–2020)?

Data exposure, followed by compromised websites, system intrusions, cybercrime, and denial of service.

Which three sectors in South Africa were most affected by cyber incidents from 2010 to 2020?

The public sector, the financial sector, and the telecommunications sector.

How were cyber incidents manifested in South Africa's public sector over the 2010–2020 decade?

State-owned, publicly controlled, or publicly funded entities fell victim to cyber incidents primarily causing compromised websites or data exposure.

What types of cyber incidents typically affected South Africa's telecommunication sector?

Incidents causing denial of service as well as data exposure (the latter often caused by non-malicious individuals).

What was the order of prevalence among perpetrator types identified in South Africa between 2010 and 2020?

Hackers were the most common, followed by hacktivists, cybercriminals, non-malicious individuals, and insiders.

What were the dominant motivations behind cyber incidents in South Africa over the decade reviewed, ranked by prevalence?

Criminal motivations were the most common, followed by economic, and then political motivations.

What strong relationships between perpetrator types and motivations were identified in the decade study?

• Hackers were strongly linked to criminal motivations (primarily leading to data exposure or compromised websites).
• Cybercriminals were primarily driven by economic motives and associated with cybercrime incidents.
• Hacktivists were strongly linked to political motivations.

What legislative milestones for South African cybersecurity occurred in 2021?

The Protection of Personal Information Act (PoPIA) was fully implemented, and the Cybercrimes Bill was newly signed into law.

What five factors negatively impact South Africa's cybersecurity and increase its attack surface?

1. Lack of investment in cybersecurity
2. Slow development of cybercrime legislation
3. Lack of awareness of cyber threats
4. Increasing use of IT
5. Cyber attackers taking notice

What is a "defence-in-depth" approach in cybersecurity?

A military strategy used in information security that offers a multi-layered security approach using various security controls throughout an IT system, providing redundancy through physical, technical, and administrative controls.

What purpose does a publicly available cyber threat dashboard serve in cybersecurity reporting?

It visualizes cyber incidents to provide an overview of South Africa's cyber threat landscape and enables trend analysis used to prepare and defend against potential cyberattacks.

What does the principle "Be prepared for when, not if" require organizations to do?

Ensure that the required people, processes, and technologies are in place to identify, protect, detect, respond to, and recover from cyberattacks.

What are the three ways a computer, network, or electronic device is involved in cybercrime?

1. The object or target of the crime
2. The instrument used to commit the crime
3. Used as a repository of evidence relating to a crime

What is a Distributed Denial of Service Attack (DDOS)?

An attack that prevents legitimate users from using a service by crashing or flooding a service or server.

How are "Cyber manipulation" and "Cyber-ransom" defined?

• Cyber manipulation: Getting access to an IT system or tricking someone to assist.
• Cyber-ransom: Blackmailing a company to buy back sensitive information.

What is "Skimming" in the context of cybercrime?

An illegal technique where details of a credit card stored on the magnetic strip are copied or skimmed.