Dr. Jabu Mtsweni, Chief Researcher and Head of the Cyber & Information Security Centre at CSIR, delivered a presentation on Building Resilience Against Ransomware and Advanced Persistent Threats (APTs) at Public Sector Cybersecurity Summit 2023 on the 3rd of October 2023. #PublicSec2023 #Conference #Cybersecurity #PublicSector

1. Building Resilience Against Ransomware and
Advanced Persistent Threats (APTs).
Dr Jabu Mtsweni
Head of Information and Cyber Security
Technical Lead: National Policy Data Observatory
03 October 2023
Public Sector Cybersecurity Summit 2023

2. Ransomware is a
Legitimate Illegitimate Business
Division of Labor:
Builders, Sellers,
Buyers, Investors
and Psychologists
01
Top Skills and
Business Models:
Cyber-criminals
are very smart
02
Business Minded:
Ransomware kit
can cost as little
as R800
03
Return on
Investment:
R10 000 000
(in one project)
04
Trillion-Dollar
Industry
05

3. 4
Ransomware Google Trends in South Africa
Past 12 months

4. 5
Google Trends – Ransomware
interest and popularity by province

5. 6
Social Media: Ransomware Engagements
Past 30 days

6. 7
The rise of ransomware in South Africa

7. The State of Ransomware in South Africa 2023
Over 78% of South African organizations were hit by ransomware in 2022
Globally, 66% of the organisations experienced a ransomware attack in 2022
Exploited vulnerabilities common attack vector
Data stolen in 35% of the attacks
100% of South African organisations claim to have got data back via backups restore
45% of the organizations paid the ransom
Disclosed ransom paid to hackers in South Africa more than R 95 million.
Average cost to rcover from a ransomware attack R14.25 million (costs of downtime, people time, device
cost, network cost, lost opportunity or revenue, new security tools etc

8. 9

9. 10

10. 11
Culture

11. 12
Non-technical measures for building protection and resilience
Security
Governance
Security
By Design
360° Risk
Assessments
Build
Cybersecurity
Culture
Create and Test
Incident Response
Plans
Consider Cyber
Insurance
Relevant and
Business
Continuity
Working Disaster
Recovery Plans
Overall Maintain
Good Security
Hygiene
What about Sharing is Caring?
Non-exhaustive list

12. 13
Technical Measures to Build Protection and Resilience
Non-exhaustive list
Data & Identity
Management
Strong Passwords and
MFA
Secure Email
Gateways/URL
Filtering
Implement Access
Control List
Regular Health Checks
Regular
Backups
Vulnerability and
Patch Management
24/7/365 awareness,
monitoring, threat
detection, and
response
Security
Orchestration,
Automation, and
Response
Threat hunting and
intelligence
Sandbox and Test
Threats
Simulate Ransomware
Scenarios
Zero-Trust Network
Access
Network
Segmentation
Do not expose RDP
services to public
networks

13. 14
Throwing the bones in conclusion
You will be targeted
three times of more
by ransomware!
There is a 50% chance
that you will be a
ransomware victim in
the next 12 months

14. Thank you