Hacking yourself must become the norm

Issue 3 2021 Information Security

With the Protection of Personal Information Act (PoPIA) coming into full effect in July 2021 and bringing with it the threat of financial and reputational damages for organisations that are found to be in contravention, businesses need to take a more proactive approach toward cybersecurity, including ongoing penetration testing and continuous refinement of policies and procedures around dealing with personal information.


Richard Frost.

In a digital age where businesses are more reliant on online and cloud services to interact and engage with customers and even sell their products and services, the impact to organisations and the rewards to threat actors in bringing down or breaching these services are increasing rapidly. Not only are the threats increasing daily, but they are also becoming more dynamic and growing in complexity. This can leave defence technologies - which are by nature more static than the evolving threat landscape - exposed.

The breaches have been growing in number, with more businesses around the globe being targeted and the personal information of tens of thousands or even millions of individuals being compromised. In the past, such was often greeted with uproar and indignation from consumers, only for the story to fade away over a matter of weeks. This has been changing locally and abroad; the implementation of data privacy regulations in the US, UK and EU have seen large corporations being penalised for the loss of customer data during breaches, including British Airways, Equifax, Google, Uber and Yahoo amongst others.

Similarly, the PoPI Act states that organisations must take appropriate measures to protect personal information against unlawful access or processing, as well as loss, damage, or unauthorised destruction. In a nutshell, it is all about first getting consent from an individual and then putting in place policies, procedures and technologies to ensure proper protection and confidentiality of personally identifiable information, from point of capture to transmission, processing and storing.

Non-compliance can result in the Information Regulator imposing sizeable penalties of up to R10 million, imprisonment of up to 10 years, or even both. Worse than the financial impact (which larger companies might be able to cough up), is the reputational damage, with the act requiring affected organisations to publicly acknowledge breaches, disclose what was affected and more, putting their brand in a bad light.

Considering that network and data breaches now go beyond the realm of technical challenges and into having a financial implication for businesses, what can they do to better protect themselves? Organisations will have to be more diligent in identifying all their assets, looking at where and how data is stored, discovering what information sits on every system across your organisation (what about confidential data stored on employee laptops and not on secure shared drives?) and more. Systems are also continually changing as updates are rolled out and controls and policies need to be put in place to keep track of all information.

Making ongoing testing the norm

As such, rather than just implement measures and hope it does the work, it is becoming increasingly important for organisations to carry out regular penetration tests to uncover exploitable vulnerabilities and identify the impact to the business – before a hacker does. Ongoing testing militates against future issues, provides assurance of the security of a system, evaluates how a potential threat actor could gain access, prioritises gaps to be dealt with and to be better equipped to protect themselves against cyber-attacks.

Organisations should turn to partners who fully understand the requirements of regulation such as PoPIA, as well as cybersecurity, data privacy and more, as well as use trusted methodology – tailored to meet the customer’s environment – that takes into account guidelines from sources such the Open Web Application Security Project (OWASP), Payment Card Industry (PCI), MITRE Attack Framework and the Technical Guide to Information Security Testing and Assessment. At the very least, these tests should encompass the following:

• Gathering publicly available information using sources such as search engines and websites to map out an organisation’s public footprint and point out areas of concern.

• Network scanning, performing automated sweeps of IP addresses of systems provided and discovered from on-network and off-network sources.

• System profiling to identify operating systems and version numbers running on the system for further testing.

• Service profiling to identify services and applications running on systems, as well as their version numbers for further testing.

• Vulnerability identification, validation and exploitation: potential vulnerabilities are identified and validated to minimise errors (false reports of problems). This involves attempts to exploit the found vulnerability.

There is also a growing need to drive awareness around PoPIA, as has been stipulated by the act, in order to build familiarity with the regulation and to ensure that employees working with personally identifiable information are fully aware of what is required from them. It goes beyond just one act however and organisations need to use non-technical language so that employees are clearly aware of the sensitivities around working with such data, as well as the dangers of storing such data on unsecured personal devices.

This has become especially critical in an age of remote working, so that organisations can ensure that confidential data is only accessible by authorised persons and put in place the necessary policies and procedures to ensure that such information is only stored to the organisation’s secured and shared storage space – be it a data centre or a cloud service. With PoPIA in full effect, not getting this right has become an exceedingly costly proposition for business.


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Upgrade your PCs to improve security
Information Security Infrastructure
Truly secure technology today must be designed to detect and address unusual activity as it happens, wherever it happens, right down to the BIOS and silicon levels.

Read more...
Open source code can also be open risk
Information Security Infrastructure
Software development has changed significantly over the years, and today, open-source code increasingly forms the foundation of modern applications, with surveys indicating that 60 – 90% of the average application's code base consists of open-source components.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...
SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Survey highlights cost of cyberdamage to industrial companies
Kaspersky Information Security News & Events
The majority of industrial organisations estimate their financial losses caused by cyberattacks to be over $1 million, while almost one in four report losses exceeding $5 million, and for some, it surpasses $10 million.

Read more...
Digital economy needs an agile approach to cybersecurity
Information Security News & Events
South Africa is the most targeted country in Africa when it comes to infostealer and ransomware attacks. Being at the forefront of the continent’s digital transformation puts South Africa in the crosshairs for sophisticated cyberattacks

Read more...
SIEM rule threat coverage validation
Information Security News & Events
New AI-detection engineering assistant from Cymulate automates SIEM rule validation for SecOps and blue teams by streamlining threat detection engineering with automated testing, control integrations and enhanced detections.

Read more...
Cybersecurity a challenge in digitalising OT
Kaspersky Information Security Industrial (Industry)
According to a study by Kaspersky and VDC Research on securing operational technology environments, the primary risks are inadequate security measures, insufficient resources allocated to OT cybersecurity, challenges surrounding regulatory compliance, and the complexities of IT/OT integration.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.